registry / agentic-relay / 5.2.5
agentic-relay@5.2.5
⚠ Under reviewInstall Agent Relay across 17+ agents — Claude Code, Codex, Cursor, Gemini CLI, Goose, Windsurf, Cline, BoltAI, Claude Desktop, VS Code, Amazon Q, Roo Code, Witsy, LibreChat, OpenClaw, Tome, Raycast — hire verified expert agents to build with you, plus th
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedbin/lib/update-check.mjsView file
17import { join, dirname, sep } from "path";
L18: import { spawn } from "child_process";
L19: import { fileURLToPath } from "url";
High
Child Process
Package source references child process execution.
bin/lib/update-check.mjsView on unpkg · L17bin/lib/cache.mjsView file
31try {
L32: return JSON.parse(readFileSync(path, "utf-8"));
L33: } catch {
Low
Weak Crypto
Package source references weak cryptographic algorithms.
bin/lib/cache.mjsView on unpkg · L31bin/install.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = agentic-relay@5.0.8
matchedIdentity = npm:YWdlbnRpYy1yZWxheQ:5.0.8
similarity = 0.769
summary = stored previous version shares package body but lacks this dangerous source file
Findings
1 Critical3 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltabin/install.mjs
HighChild Processbin/lib/update-check.mjs
HighShell
HighRuntime Package Installbin/install.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptobin/lib/cache.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to agentic-relay@5.2.5.
See all versions of agentic-relay for other recorded verdicts.
- Review the evidence and your use of agentic-relay@5.2.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.