registry / automation-tool-manager / 1.9.3

automation-tool-manager@1.9.3

⚠ Under review

Automation Agent

Static Scan Results

scanned 18d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 6.32 KB of source

Source & flagged code

7 flagged

package.jsonView file

Lines 18-41json

18 "jar": "target/tool-manager-1.3.8.jar",

19 "javafx": false,

20 "title": "Automation Agent"

21 },

22 "files": [

23 "jdeploy-bundle",

24 "scripts/setup.sh",

25 "target/tool-manager-1.3.8.jar"

26 ],

27 "dependencies": {

28 "command-exists-promise": "^2.0.2",

30 "node-fetch": "2.6.7",

31 "shelljs": "^0.10.0",

32 "tar": "^7.5.12",

33 "vite": "8.0.5",

34 "yauzl": "3.2.1"

35 },

36 "scripts": {

37 "test": "echo \"Error: no test specified\" && exit 1",

38 "postinstall": "sh ./scripts/setup.sh"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L38

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L38

39 }

40}

scripts/setup.shView file

•path = scripts/setup.sh kind = build_helper sizeBytes = 48851 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/setup.shView on unpkg

jdeploy-bundle/tool-manager-1.3.8.jarView file

•path = jdeploy-bundle/tool-manager-1.3.8.jar kind = high_entropy_blob sizeBytes = 34099213 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

jdeploy-bundle/tool-manager-1.3.8.jarView on unpkg

•path = jdeploy-bundle/tool-manager-1.3.8.jar kind = compressed_blob sizeBytes = 34099213 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

jdeploy-bundle/tool-manager-1.3.8.jarView on unpkg

•path = jdeploy-bundle/tool-manager-1.3.8.jar kind = nested_archive_needs_inspection sizeBytes = 34099213 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

jdeploy-bundle/tool-manager-1.3.8.jarView on unpkg

jdeploy-bundle/jdeploy.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = automation-tool-manager@1.9.11 matchedIdentity = npm:YXV0b21hdGlvbi10b29sLW1hbmFnZXI:1.9.11 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

jdeploy-bundle/jdeploy.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = sh ./scripts/setup.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = sh ./scripts/setup.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/setup.shView file

•path = scripts/setup.sh kind = build_helper sizeBytes = 48851 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/setup.shView on unpkg

jdeploy-bundle/tool-manager-1.3.8.jarView file

•path = jdeploy-bundle/tool-manager-1.3.8.jar kind = high_entropy_blob sizeBytes = 34099213 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

jdeploy-bundle/tool-manager-1.3.8.jarView on unpkg

•path = jdeploy-bundle/tool-manager-1.3.8.jar kind = compressed_blob sizeBytes = 34099213 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

jdeploy-bundle/tool-manager-1.3.8.jarView on unpkg

•path = jdeploy-bundle/tool-manager-1.3.8.jar kind = nested_archive_needs_inspection sizeBytes = 34099213 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

jdeploy-bundle/tool-manager-1.3.8.jarView on unpkg

jdeploy-bundle/jdeploy.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

jdeploy-bundle/jdeploy.jsView on unpkg

Findings

3 High5 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobjdeploy-bundle/tool-manager-1.3.8.jar

HighPrevious Version Dangerous Deltajdeploy-bundle/jdeploy.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Build Helperscripts/setup.sh

MediumShips Compressed Blobjdeploy-bundle/tool-manager-1.3.8.jar

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowNested Archive Needs Inspectionjdeploy-bundle/tool-manager-1.3.8.jar

Affected versions and remediation

This report applies to automation-tool-manager@1.9.3.

See version security history for other recorded verdicts.

Review the evidence and your use of automation-tool-manager@1.9.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-20 08:34:56.085Z (UTC).