registry / agentic-relay / 5.12.0
agentic-relay@5.12.0
⚠ Under reviewInstall Agent Relay across 17+ agents — Claude Code, Codex, Cursor, Gemini CLI, Goose, Windsurf, Cline, BoltAI, Claude Desktop, VS Code, Amazon Q, Roo Code, Witsy, LibreChat, OpenClaw, Tome, Raycast — hire verified expert agents to build with you, plus th
Static Scan Results
scanned 25d ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
3 flaggedbin/lib/update-check.mjsView file
17import { join, dirname, sep } from "path";
L18: import { spawn } from "child_process";
L19: import { fileURLToPath } from "url";
High
Child Process
Package source references child process execution.
bin/lib/update-check.mjsView on unpkg · L17bin/install.mjsView file
688warn("your ~/.npm cache contains files owned by another user (an old `sudo npm`).");
L689: warn(`This breaks npx AND npm i -g. Fix it once, then re-run: ${CACHE_CHOWN_RECIPE}`);
L690: return "blocked";
...
L701: try {
L702: execSync("npm uninstall -g agentic-relay", { stdio: ["ignore", "ignore", "ignore"] });
L703: } catch {}
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/install.mjsView on unpkg · L688bin/install.mjs#virtual:normalized:round1View file
Findings
4 High3 Medium4 Low
HighChild Processbin/lib/update-check.mjs
HighShell
HighRuntime Package Installbin/install.mjs
HighSemantic Analysis Limitedbin/install.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to agentic-relay@5.12.0.
See all versions of agentic-relay for other recorded verdicts.
- Review the evidence and your use of agentic-relay@5.12.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.