registry / agent-relay-server / 0.129.7

agent-relay-server@0.129.7

Lightweight HTTP message relay for inter-agent communication across machines

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

CopyleftLicenseWildcardDependency

scanned 656 file(s), 12.1 MB of source, external domains: 127.0.0.1, api.github.com, cdn.jsdelivr.net, chatgpt.com, example.com, github.com, petstore3.swagger.io, radix-ui.com, react.dev, www.apple.com, www.w3.org

Source & flagged code

6 flagged

package.jsonView file

Lines 29-69json

29 "scripts/orchestrator-spawn-smoke.ts",

30 "scripts/cd-watcher.ts",

31 "runner/src/**/*.ts",

32 "runner/plugins/**",

33 "runner/hooks/**",

34 "!runner/**/*.test.ts",

35 "public/**",

36 "docs/openapi.json",

37 "README.md",

38 "SECURITY.md",

39 "CONTRIBUTING.md"

40 ],

41 "dependencies": {

42 "agent-relay-channels-host": "0.129.7",

43 "agent-relay-providers": "0.104.4",

44 "agent-relay-sdk": "0.2.126",

45 "ajv": "^8.20.0"

46 },

47 "scripts": {

48 "prepack": "bun run build:claude-monitor >&2 && bun run build:dashboard:bundle >&2",

49 "postinstall": "node scripts/install-bin-shim.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

50 "start": "bun run src/index.ts",

51 "dev": "PUBLIC_DIR=$PWD/public bun --watch run src/index.ts",

52 "dev:dashboard": "cd dashboard && bun run dev",

53 "build:sdk": "cd sdk && bun run build",

54 "build:claude-monitor": "bun run scripts/build-claude-monitor.ts",

55 "build:claude-monitor:check": "bun run scripts/build-claude-monitor.ts --check",

56 "build:dashboard": "bun run build:dashboard:bundle && bun run deploy:dashboard",

57 "build:dashboard:bundle": "sh scripts/gate.sh sh -c 'bun run build:sdk && cd dashboard && bun run build'",

58 "deploy:dashboard": "bun run scripts/deploy-dashboard.ts",

59 "ci:land": "sh scripts/gate.sh bun run scripts/ci-land.ts",

60 "ci:release": "sh scripts/gate.sh sh -c 'bun run build:dashboard:bundle && bun run build:claude-monitor:check && bun run lint:import-boundaries && bun run lint:provider-contract && bun run typecheck && bun run docs:api:check && bun test --bail'",

61 "ci": "bun run ci:land",

62 "test": "sh scripts/gate.sh sh -c 'bun run test:guards && bun test --bail'",

63 "test:guards": "bun test --bail=1 src/file-size-ratchet.test.ts src/duplication-ratchet.test.ts src/env-access-ratchet.test.ts src/no-raw-control-bytes.test.ts src/transport-thinness-ratchet.test.ts src/commands-db-ttl-guard.test.ts src/circular-deps.test.ts scripts/release-deploy-guard.test.ts scripts/release-tree-guard.test.ts",

64 "smoke:spawn": "bun run scripts/orchestrator-spawn-smoke.ts",

65 "publish:smoke": "bun run scripts/publish-smoke.ts",

66 "lint:provider-contract": "bun run scripts/check-provider-contract.ts",

67 "lint:import-boundaries": "bun run scripts/check-import-boundaries.ts",

68 "contract:real-agents": "bun run scripts/provider-contract-real-agents.ts",

69 "contract:real-agents:required": "bun run scripts/provider-contract-real-agents.ts --required",

runner/plugins/claude/claude-statusline-probe.cjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

4const { mkdirSync, renameSync, writeFileSync } = require("node:fs");

5const { tmpdir } = require("node:os");

Medium

Dynamic Require

src/steward.tsView file

Lines 1-21typescript

1import { createHash } from "node:crypto";

2import { basename, resolve } from "node:path";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/steward.tsView on unpkg · L1

3import { stewardFallbackTarget } from "./config";

4import { getSpawnPolicy, getStewardConfig, setConfig } from "./config-store";

runner/plugins/claude/hooks/user-prompt-submit.shView file

•path = [redacted]-prompt-submit.sh kind = build_helper sizeBytes = 1082 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runner/plugins/claude/hooks/user-prompt-submit.shView on unpkg

public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View file

•path = public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2 kind = high_entropy_blob sizeBytes = 15308 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View on unpkg

scripts/cd-watcher.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = agent-relay-server@0.129.6 matchedIdentity = npm:YWdlbnQtcmVsYXktc2VydmVy:0.129.6 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/cd-watcher.tsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-bin-shim.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

runner/plugins/claude/claude-statusline-probe.cjsView file

3L4: const { mkdirSync, renameSync, writeFileSync } = require("node:fs"); L5: const { tmpdir } = require("node:os");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

runner/plugins/claude/claude-statusline-probe.cjsView on unpkg · L3

src/steward.tsView file

1import { createHash } from "node:crypto"; L2: import { basename, resolve } from "node:path";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/steward.tsView on unpkg · L1

runner/plugins/claude/hooks/user-prompt-submit.shView file

•path = [redacted]-prompt-submit.sh kind = build_helper sizeBytes = 1082 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runner/plugins/claude/hooks/user-prompt-submit.shView on unpkg

public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View file

•path = public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2 kind = high_entropy_blob sizeBytes = 15308 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View on unpkg

scripts/cd-watcher.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/cd-watcher.tsView on unpkg

Findings

3 High7 Medium8 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobpublic/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2

HighPrevious Version Dangerous Deltascripts/cd-watcher.ts

MediumDynamic Requirerunner/plugins/claude/claude-statusline-probe.cjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Build Helperrunner/plugins/claude/hooks/user-prompt-submit.sh

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowWeak Cryptosrc/steward.ts

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowCopyleft License

Source & flagged code

6 flagged

package.jsonView file

Lines 29-69json

29 "scripts/orchestrator-spawn-smoke.ts",

30 "scripts/cd-watcher.ts",

31 "runner/src/**/*.ts",

32 "runner/plugins/**",

33 "runner/hooks/**",

34 "!runner/**/*.test.ts",

35 "public/**",

36 "docs/openapi.json",

37 "README.md",

38 "SECURITY.md",

39 "CONTRIBUTING.md"

40 ],

41 "dependencies": {

42 "agent-relay-channels-host": "0.129.7",

43 "agent-relay-providers": "0.104.4",

44 "agent-relay-sdk": "0.2.126",

45 "ajv": "^8.20.0"

46 },

47 "scripts": {

48 "prepack": "bun run build:claude-monitor >&2 && bun run build:dashboard:bundle >&2",

49 "postinstall": "node scripts/install-bin-shim.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

50 "start": "bun run src/index.ts",

51 "dev": "PUBLIC_DIR=$PWD/public bun --watch run src/index.ts",

52 "dev:dashboard": "cd dashboard && bun run dev",

53 "build:sdk": "cd sdk && bun run build",

54 "build:claude-monitor": "bun run scripts/build-claude-monitor.ts",

55 "build:claude-monitor:check": "bun run scripts/build-claude-monitor.ts --check",

56 "build:dashboard": "bun run build:dashboard:bundle && bun run deploy:dashboard",

57 "build:dashboard:bundle": "sh scripts/gate.sh sh -c 'bun run build:sdk && cd dashboard && bun run build'",

58 "deploy:dashboard": "bun run scripts/deploy-dashboard.ts",

59 "ci:land": "sh scripts/gate.sh bun run scripts/ci-land.ts",

61 "ci": "bun run ci:land",

62 "test": "sh scripts/gate.sh sh -c 'bun run test:guards && bun test --bail'",

64 "smoke:spawn": "bun run scripts/orchestrator-spawn-smoke.ts",

65 "publish:smoke": "bun run scripts/publish-smoke.ts",

66 "lint:provider-contract": "bun run scripts/check-provider-contract.ts",

67 "lint:import-boundaries": "bun run scripts/check-import-boundaries.ts",

68 "contract:real-agents": "bun run scripts/provider-contract-real-agents.ts",

69 "contract:real-agents:required": "bun run scripts/provider-contract-real-agents.ts --required",

runner/plugins/claude/claude-statusline-probe.cjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

4const { mkdirSync, renameSync, writeFileSync } = require("node:fs");

5const { tmpdir } = require("node:os");

Medium

Dynamic Require

src/steward.tsView file

Lines 1-21typescript

1import { createHash } from "node:crypto";

2import { basename, resolve } from "node:path";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/steward.tsView on unpkg · L1

3import { stewardFallbackTarget } from "./config";

4import { getSpawnPolicy, getStewardConfig, setConfig } from "./config-store";

runner/plugins/claude/hooks/user-prompt-submit.shView file

•path = [redacted]-prompt-submit.sh kind = build_helper sizeBytes = 1082 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runner/plugins/claude/hooks/user-prompt-submit.shView on unpkg

public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View file

•path = public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2 kind = high_entropy_blob sizeBytes = 15308 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View on unpkg

scripts/cd-watcher.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/cd-watcher.tsView on unpkg