registry / agentic-relay / 5.0.6
agentic-relay@5.0.6
Install Agent Relay across 17+ agents — Claude Code, Codex, Cursor, Gemini CLI, Goose, Windsurf, Cline, BoltAI, Claude Desktop, VS Code, Amazon Q, Roo Code, Witsy, LibreChat, OpenClaw, Tome, Raycast — hire verified expert agents to build with you, plus th
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
3 flaggedbin/lib/update-check.mjsView file
17import { join, dirname, sep } from "path";
L18: import { spawn } from "child_process";
L19: import { fileURLToPath } from "url";
High
Child Process
Package source references child process execution.
bin/lib/update-check.mjsView on unpkg · L1711* vars are set, stderr isn't a TTY (don't pollute piped/scripted runs), or the
L12: * CLI is running out of an ephemeral npx cache (npx users get @latest anyway).
L13: */
...
L17: import { join, dirname, sep } from "path";
L18: import { spawn } from "child_process";
L19: import { fileURLToPath } from "url";
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/lib/update-check.mjsView on unpkg · L11bin/lib/cache.mjsView file
31try {
L32: return JSON.parse(readFileSync(path, "utf-8"));
L33: } catch {
Low
Findings
3 High3 Medium5 Low
HighChild Processbin/lib/update-check.mjs
HighShell
HighRuntime Package Installbin/lib/update-check.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptobin/lib/cache.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to agentic-relay@5.0.6.
See all versions of agentic-relay for other recorded verdicts.
- Review the evidence and your use of agentic-relay@5.0.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.