registry / automation-tool-manager / 1.8.5

automation-tool-manager@1.8.5

Automation Agent

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 4.79 KB of source

Source & flagged code

6 flagged

package.jsonView file

Lines 18-41json

18 "jar": "target/tool-manager-1.3.2.jar",

19 "javafx": false,

20 "title": "Automation Agent"

21 },

22 "files": [

23 "jdeploy-bundle",

24 "scripts/setup.sh",

25 "target/tool-manager-1.3.2.jar"

26 ],

27 "dependencies": {

28 "command-exists-promise": "^2.0.2",

30 "node-fetch": "2.6.7",

31 "shelljs": "^0.10.0",

32 "tar": "^7.5.12",

33 "vite": "8.0.5",

34 "yauzl": "3.2.1"

35 },

36 "scripts": {

37 "test": "echo \"Error: no test specified\" && exit 1",

38 "postinstall": "sh ./scripts/setup.sh"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L38

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L38

39 }

40}

scripts/setup.shView file

•path = scripts/setup.sh kind = build_helper sizeBytes = 48851 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/setup.shView on unpkg

jdeploy-bundle/jar-runner.jarView file

•path = jdeploy-bundle/jar-runner.jar kind = compressed_blob sizeBytes = 1839 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

jdeploy-bundle/jar-runner.jarView on unpkg

•path = jdeploy-bundle/jar-runner.jar kind = nested_archive_needs_inspection sizeBytes = 1839 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

jdeploy-bundle/jar-runner.jarView on unpkg

jdeploy-bundle/tool-manager-1.3.2.jarView file

•path = jdeploy-bundle/tool-manager-1.3.2.jar kind = high_entropy_blob sizeBytes = 34094019 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

jdeploy-bundle/tool-manager-1.3.2.jarView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = sh ./scripts/setup.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

automation-tool-manager@1.8.5

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code