registry / agents-chat-cli / 3.28.1
agents-chat-cli@3.28.1
⚠ Under review多智能体群聊工具 - 支持 OpenCode/Claude Code/Codex/pi 内核，微信风格聊天界面
Static Scan Results
scanned 1mo ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourceapp/server.jsView file
8const url = require('url');
L9: const { spawn } = require('child_process');
L10:
High
4const { checkLatest, UPDATE_COMMAND } = require('./lib/updatecheck');
L5: const http = require('http');
L6: const fs = require('fs');
...
L8: const url = require('url');
L9: const { spawn } = require('child_process');
L10:
...
L16: // ---------- 日志 tee：控制台输出同时写入 .data/server.log ----------
L17: const LOG_DIR = process.env.AGENTS_CHAT_DATA || path.join(ROOT_DIR, '.data');
L18: try { fs.mkdirSync(LOG_DIR, { recursive: true }); } catch { /* ignore */ }
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
app/server.jsView on unpkg · L4•matchType = previous_version_dangerous_delta
matchedPackage = agents-chat-cli@3.44.1
matchedIdentity = npm:YWdlbnRzLWNoYXQtY2xp:3.44.1
similarity = 0.400
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
Findings
5 High2 Medium4 Low
HighChild Processapp/server.js
HighShellbin/agents-chat.js
HighSame File Env Network Executionapp/server.js
HighSemantic Analysis Limitedpackage.json
HighPrevious Version Dangerous Deltaapp/server.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to agents-chat-cli@3.28.1.
See all versions of agents-chat-cli for other recorded verdicts.
- Review the evidence and your use of agents-chat-cli@3.28.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.