arcy.js@0.2.8
ARCY, the universal JavaScript utility for embedding an AI agent that talks to, learns from, and acts on behalf of your users.
AI Security Review
scanned 24d ago · by lpm-firewall-aiThe inspected source shows a prepublish-only build hook and package-aligned API and telemetry requests. The scanner’s network and secret-pattern signals do not establish credential theft or another attack in context.
Static reason
One or more suspicious static signals were detected.
Trigger
Consumers import or invoke the SDK in a browser.
Impact
No confirmed attack surface was established by the inspected source.
Mechanism
The SDK communicates with its own API and sends telemetry batches to its configured service URL; the inspected telemetry request omits browser credentials.
AI rationale
The inspected source shows a prepublish-only build hook and package-aligned API and telemetry requests. The scanner’s network and secret-pattern signals do not establish credential theft or another attack in context.
Network endpoints1
api.arcyai.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares only a prepublishOnly release-check/build hook; no install lifecycle hook is present.
- The SDK uses the package’s api.arcyai.com service for its flow API.
- Telemetry sends event batches to its configured service URL, with credentials omitted from the request.
Evidence against
Behavioral surface
Network
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
6 flaggeddist/chunk-2NTFPTD7.jsView file
261patternName = generic_password
severity = medium
line = 261
Medium
dist/index.cjsView file
•Trigger-reachable fixed external POST callback chain: manifest.main -> dist/index.cjs
/* arcy.js — https://arcyai.com */
method: "POST",
body: JSON.stringify(sessionId ? { sessionId } : {}),
method: "POST",
body: JSON.stringify(sessionId ? { sessionId } : {}),
async function postFlowAnswer(flowCvid, body, options) {
method: "POST",
body: JSON.stringify({ ...body, ...sessionId ? { sessionId } : {} }),
High
Trigger Reachable External Post Callback
A manifest entrypoint or package-local install chain reaches a fixed external POST callback.
dist/index.cjsView on unpkg2740_condition();
DEFAULT_API_BASE = "https://api.arcyai.com";
FLOW_CATALOG_PATH = "/api/v1/sdk/flows/catalog";
FLOW_RUN_PATH = "/api/v1/sdk/flows";
TARGET_ARM_PATH = "/api/v1/sd
Findings
1 High3 Medium8 Low
HighTrigger Reachable External Post Callbackdist/index.cjs
MediumSecret Patterndist/chunk-2NTFPTD7.js
MediumNetwork
MediumSecret Patterndist/control-resolver.cjs
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.cjs
LowAi Review Evidencedist/index.cjs
Affected versions and remediation
This report applies to arcy.js@0.2.8.
See all versions of arcy.js for other recorded verdicts.
- Review the evidence and your use of arcy.js@0.2.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.