registry / agentgui / 1.0.1062

agentgui@1.0.1062

⚠ Under review

Multi-agent ACP client with real-time communication

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 20 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

GitDependencyNoLicenseWildcardDependency

scanned 53 file(s), 950 KB of source, external domains: 127.0.0.1, 247420.xyz, anentrypoint.github.io, cdn.jsdelivr.net, fonts.gstatic.com, github.com, unpkg.com, www.w3.org

Source & flagged code

9 flagged

package.jsonView file

Lines 2-42json

2 "name": "agentgui",

3 "version": "1.0.1062",

4 "description": "Multi-agent ACP client with real-time communication",

5 "type": "module",

6 "main": "electron/main.js",

7 "bin": {

8 "agentgui": "./bin/gmgui.cjs"

9 },

10 "repository": {

11 "type": "git",

12 "url": "git+https://github.com/AnEntrypoint/agentgui.git"

13 },

14 "bugs": {

15 "url": "https://github.com/AnEntrypoint/agentgui/issues"

16 },

17 "homepage": "https://github.com/AnEntrypoint/agentgui#readme",

18 "scripts": {

19 "start": "bun server.js || node server.js",

20 "dev": "node server.js --watch",

21 "test": "bun test.js && bun test-integration.js",

22 "postinstall": "node scripts/patch-fsbrowse.js && (cd node_modules/better-sqlite3 && node-gyp rebuild 2>/dev/null) || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 "electron": "electron electron/main.js",

24 "electron:dev": "PORT=3000 electron electron/main.js"

25 },

26 "dependencies": {

27 "@anthropic-ai/claude-code": "^2.1.37",

28 "@google/gemini-cli": "latest",

29 "@kilocode/cli": "latest",

30 "better-sqlite3": "^12.9.0",

31 "busboy": "^1.6.0",

32 "ccsniff": "github:AnEntrypoint/ccsniff#main",

33 "express": "^5.2.1",

34 "fsbrowse": "latest",

35 "lru-cache": "^11.2.7",

36 "opencode-ai": "^1.2.15",

37 "puppeteer-core": "^24.37.5",

38 "webjsx": "^0.0.73",

39 "ws": "^8.14.2",

40 "xstate": "^5.32.0"

41 },

42 "devDependencies": {

bin/gmgui.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { spawn, spawnSync } = require('child_process');

3const path = require('path');

High

Child Process

Package source references child process execution.

bin/gmgui.cjs

lib/terminal.jsView file

Lines 3-43javascript

3// PASSWORD Basic-auth check. This module does no auth on its own - never

4// expose without the gate.

6import os from 'os';

7import { spawn } from 'child_process';

8import crypto from 'crypto';

database.jsView file

Lines 18-58javascript

18 getResumableConversations: () => [],

19 getActiveSessions: () => [],

20 getSessionsProcessingLongerThan: () => [],

21 getConversationsList: () => [],

22 getConversation: ()

test-integration.jsView file

Lines 2-42javascript

2 * Integration tests for agentgui: WS streaming, file operations, auth, sessions, offline/reconnect.

3 *

4 * Philosophy (matching test.js): mock-free, direct production code on real HTTP/WS servers,

5 *

scripts/capture-screenshots.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2// Boot agentgui with a fixture DB on an ephemeral port and capture a set of PNGs.

3// Uses puppeteer-core with a system-provided chromium (set CHROME or it autodetects).

4//

5// Usage: node scripts/capture-screenshots.mjs [--fixtures=./fixtures] [--out=./docs/screenshots]

7import fs from 'fs';

8import path from

electron/main.jsView file

Lines 1-30javascript

1import { app, BrowserWindow, dialog } from 'electron';

2import { spawn } from 'child_process';

3import { fileURLToPath } from 'url';

4import path from 'path';

lib/http-handler.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = agentgui@1.0.1058 matchedIdentity = npm:YWdlbnRndWk:1.0.1058 similarity = 0.962 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/http-handler.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code