registry / agentic-relay / 5.0.2

agentic-relay@5.0.2

Install Agent Relay AI search across 17+ agents — Claude Code, Codex, Cursor, Gemini CLI, Goose, Windsurf, Cline, BoltAI, Claude Desktop, VS Code, Amazon Q, Roo Code, Witsy, LibreChat, OpenClaw, Tome, Raycast — plus the `agentrelay` CLI for live agent ses

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 13 file(s), 90.5 KB of source, external domains: attentionmarket-auth.vercel.app, peruwnbrqkvmrldhpoom.supabase.co, registry.npmjs.org

Source & flagged code

3 flagged

bin/lib/update-check.mjsView file

Lines 1-37javascript

1/**

2 * Async update notifier (the Vercel/update-notifier pattern, zero-dep).

3 *

4 * The CLI never blocks on the network: each run reads a tiny local state file

5 * and prints a one-line stderr nag if a newer version was seen on a PREVIOUS

6 * run; when the state is older than 24h it spawns a detached, unref'd child

7 * (this module with --refresh) that fetches the registry and rewrites the

8 * state for next time.

9 *

10 * Suppressed when: AGENT_RELAY_NO_UPDATE_CHECK / NO_UPDATE_NOTIFIER / CI env

11 * vars are set, stderr isn't a TTY (don't pollute piped/scripted runs), or the

12 * CLI is running out of an ephemeral npx cache (npx users get @latest anyway).

13 */

15import { readFileSync, writeFileSync, mkdirSync, realpathSync } from "fs";

16import { homedir } from "os";

17import { join, dirname, sep } from "path";

18import { spawn } from "child_process";

19import { fileURLToPath } from "url";

High

Child Process

Package source references child process execution.

bin/lib/update-check.mjsView on unpkg · L17

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/lib/update-check.mjsView on unpkg · L11

21export const STATE_PATH = join(homedir(), ".config", "agent-relay", "update-check.json");

22const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;

23const SELF_PATH = fileURLToPath(import.meta.url);

25/** Numeric-dotted semver compare: 1 if a > b, -1 if a < b, 0 if equal. */

26export function compareSemver(a, b) {

27 const pa = String(a).split(".").map((n) => parseInt(n, 10) || 0);

28 const pb = String(b).split(".").map((n) => parseInt(n, 10) || 0);

29 for (let i = 0; i < Math.max(pa.length, pb.length); i++) {

30 const da = pa[i] || 0;

31 const db = pb[i] || 0;

32 if (da !== db) return da > db ? 1 : -1;

33 }

34 return 0;

35}

37/**

bin/lib/cache.mjsView file

Lines 11-51javascript

11import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";

12import { join } from "path";

13import { createHash } from "crypto";

15const SEARCH_TTL_MS = 60 * 60 *

Source & flagged code

3 flagged · loading source

bin/lib/update-check.mjsView file

17import { join, dirname, sep } from "path"; L18: import { spawn } from "child_process"; L19: import { fileURLToPath } from "url";

High

Child Process

Package source references child process execution.

bin/lib/update-check.mjsView on unpkg · L17

11* vars are set, stderr isn't a TTY (don't pollute piped/scripted runs), or the L12: * CLI is running out of an ephemeral npx cache (npx users get @latest anyway). L13: */ ... L17: import { join, dirname, sep } from "path"; L18: import { spawn } from "child_process"; L19: import { fileURLToPath } from "url";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/lib/update-check.mjsView on unpkg · L11

bin/lib/cache.mjsView file

31try { L32: return JSON.parse(readFileSync(path, "utf-8")); L33: } catch {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/lib/cache.mjsView on unpkg · L31

Findings

3 High3 Medium5 Low

HighChild Processbin/lib/update-check.mjs

HighShell

HighRuntime Package Installbin/lib/update-check.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptobin/lib/cache.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

bin/lib/update-check.mjsView file

Lines 1-37javascript

1/**

2 * Async update notifier (the Vercel/update-notifier pattern, zero-dep).

3 *

4 * The CLI never blocks on the network: each run reads a tiny local state file

5 * and prints a one-line stderr nag if a newer version was seen on a PREVIOUS

6 * run; when the state is older than 24h it spawns a detached, unref'd child

7 * (this module with --refresh) that fetches the registry and rewrites the

8 * state for next time.

9 *

10 * Suppressed when: AGENT_RELAY_NO_UPDATE_CHECK / NO_UPDATE_NOTIFIER / CI env

11 * vars are set, stderr isn't a TTY (don't pollute piped/scripted runs), or the

12 * CLI is running out of an ephemeral npx cache (npx users get @latest anyway).

13 */

15import { readFileSync, writeFileSync, mkdirSync, realpathSync } from "fs";

16import { homedir } from "os";

17import { join, dirname, sep } from "path";

18import { spawn } from "child_process";

19import { fileURLToPath } from "url";

High

Child Process

Package source references child process execution.

bin/lib/update-check.mjsView on unpkg · L17

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/lib/update-check.mjsView on unpkg · L11

21export const STATE_PATH = join(homedir(), ".config", "agent-relay", "update-check.json");

22const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;

23const SELF_PATH = fileURLToPath(import.meta.url);

25/** Numeric-dotted semver compare: 1 if a > b, -1 if a < b, 0 if equal. */

26export function compareSemver(a, b) {

27 const pa = String(a).split(".").map((n) => parseInt(n, 10) || 0);

28 const pb = String(b).split(".").map((n) => parseInt(n, 10) || 0);

29 for (let i = 0; i < Math.max(pa.length, pb.length); i++) {

30 const da = pa[i] || 0;

31 const db = pb[i] || 0;

32 if (da !== db) return da > db ? 1 : -1;

33 }

34 return 0;

35}

37/**

bin/lib/cache.mjsView file

Lines 11-51javascript

11import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";

12import { join } from "path";

13import { createHash } from "crypto";

15const SEARCH_TTL_MS = 60 * 60 *