aws-runtime-bridge@1.9.116: Suspicious npm security report (Warn) | LPM Firewall
Flagged as AI-agent capability risk
Allowed by default with warning: agent-facing configuration or capability changes need review before use.
aws-runtime-bridge@1.9.116 Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
AgentsWorkStudio runtime bridge service for machine-level agent runtime integration
scanned 26d ago · by lpm-firewall-ai Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Install triggers Chromium provisioning; executing the CLI/importing `dist/index.js` starts the bridge; `awsb service install` explicitly enables persistence.
Impact
A configured or exposed bridge could provide broad host and AI-agent control, consistent with its stated runtime role.
Mechanism
local runtime bridge with PTY/browser/desktop and AI-agent integration
Rationale
The package intentionally implements broad runtime and AI-agent control capabilities, warranting a warning. Its install hooks and persistence paths are package-aligned or explicitly invoked, with no concrete malicious chain found.
Evidence
package.json scripts/ensure-playwright-browser.mjs dist/index.js dist/services/cli-commands.js dist/services/auto-register.js dist/services/cc-switch-sdk.js scripts/ensure-bin-executable.mjs ~/.aws-bridge/config.json ~/.claude/settings.json ~/.claude.json ~/.codex/config.toml ~/.config/opencode/opencode.json
localhost:8080 npmmirror.com /mirrors/playwright
public snapshot AI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
`package.json` postinstall executes a Playwright Chromium installer. `dist/index.js` starts an HTTP/WebSocket runtime service on import/CLI execution. `dist/index.js` mounts PTY, file-browser, remote-desktop, browser and agent routes. `dist/adapter/OpencodeSdkAdapter.js` spawns configured OpenCode processes with environment overrides. `dist/services/cc-switch-sdk.js` targets Claude, Codex and OpenCode configuration/skill paths. Evidence against
Postinstall only chmods its own CLI and invokes bundled Playwright tooling. Playwright download host is user-selected or a documented registry mirror. Service persistence is behind explicit `awsb service install`, not postinstall. Auto-registration requires configured user key/enablement; default scheduler is localhost. No source evidence of credential harvesting, covert exfiltration, or remote payload download/execution. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Filesystem Network Shell WebSocket
Supply chain HighEntropyStrings Minified Obfuscated UrlStrings
scanned 229 file(s), 1.44 MB of source, external domains: 127.0.0.1, example.com, npmmirror.com, registry.npmjs.org, secure.example.com, www.apple.com
10 flagged · loading source • scripts.postinstall = node scripts/ensure-bin-executable.mjs && node scripts/ensure-playwright-browser.mjs
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg • scripts.postinstall = node scripts/ensure-bin-executable.mjs && node scripts/ensure-playwright-browser.mjs
Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg 1 #!/usr/bin/env node
L2: import{existsSync as D,readFileSync as B}from"node:fs";import E from"node:os";import x from"node:path";import M from"cors";import I from"express";import{adapterRegistry as O}from"....
L3:
High Child Process
Package source references child process execution.
dist/index.js View on unpkg · L1 1 #!/usr/bin/env node
L2: import{existsSync as D,readFileSync as B}from"node:fs";import E from"node:os";import x from"node:path";import M from"cors";import I from"express";import{adapterRegistry as O}from"....
L3:
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/index.js View on unpkg · L1 1 import{Router as N}from"express";import _ from"axios";import{spawn as x}from"node:child_process";import{createHash as z,timingSafeEqual as X}from"node:crypto";import{fileURLToPath ...
L2:
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/routes/instance.js View on unpkg · L1 1 Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/services/cli-commands.js
L1: import{spawnSync as h}from"node:child_process";import{createInterface as X}from"node:readline/promises";import{existsSync as w,mkdirSync as T,readFileSync as Z,rmSync as ee,unlinkS...
L2: `)}function le(e){process.stderr.write(`${e}
...
L5: `)}function C(e,r){return e("systemctl",r)}function x(e,r){return r.error?`[runtime-bridge] ${e}\u5931\u8D25: ${r.error.message}`:`[runtime-bridge] ${e}\u5931\u8D25\uFF0Csystemctl ...
L6: npm install -g aws-runtime-bridge`),{handled:!0,exitCode:1}}async function U(e){const r=e.windowsServiceManager;if(!r&&!se())return ve(e.stderr);const t=e.windowsServiceLogPath||B,...
L7:
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/services/cli-commands.js View on unpkg · L1 1 import{spawnSync as h}from"node:child_process";import{createInterface as X}from"node:readline/promises";import{existsSync as w,mkdirSync as T,readFileSync as Z,rmSync as ee,unlinkS...
L2: `)}function le(e){process.stderr.write(`${e}
...
L5: `)}function C(e,r){return e("systemctl",r)}function x(e,r){return r.error?`[runtime-bridge] ${e}\u5931\u8D25: ${r.error.message}`:`[runtime-bridge] ${e}\u5931\u8D25\uFF0Csystemctl ...
L6: npm install -g aws-runtime-bridge`),{handled:!0,exitCode:1}}async function U(e){const r=e.windowsServiceManager;if(!r&&!se())return ve(e.stderr);const t=e.windowsServiceLogPath||B,...
L7:
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/services/cli-commands.js View on unpkg · L1 1 import{spawn as E}from"node:child_process";import{EventEmitter as x}from"node:events";import*as w from"node:fs";import*as T from"node:net";import*as O from"node:os";import*as h fro...
L2: `)):t}return this.sdkModule}async waitForServer(t,e,o,r){const i=Date.now()+o;for(;Date.now()<i;){try{if((await t.session.list({query:{directory:e}})).data!==void 0)return}catch{}a...
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/adapter/OpencodeSdkAdapter.js View on unpkg · L1 scripts/ensure-playwright-browser.mjs View file 20 */
L21: import { execFile, spawnSync } from "node:child_process";
L22: import { createRequire } from "node:module";
...
L34: try {
L35: const packageJsonPath = require.resolve("playwright/package.json");
L36: return join(dirname(packageJsonPath), "cli.js");
...
L49: encoding: "utf-8",
L50: shell: process.platform === "win32",
L51: stdio: ["ignore", "pipe", "ignore"],
L52: });
L53: if (result.status === 0 && result.stdout) {
L54: const url = result.stdout.trim();
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
scripts/ensure-playwright-browser.mjs View on unpkg · L20 package/acode/dist/grammars/grammars/tree-sitter-go.wasm View file • path = [redacted]-sitter-go.wasm
kind = wasm_module
sizeBytes = 217182
magicHex = [redacted]
Medium Ships Wasm Module
Package ships WebAssembly modules.
package/acode/dist/grammars/grammars/tree-sitter-go.wasm View on unpkg 6 High 7 Medium 8 Low
High Install Time Lifecycle Scripts package.json
High Child Process dist/index.js
High Shell
High Same File Env Network Execution dist/adapter/OpencodeSdkAdapter.js
High Sandbox Evasion Gated Capability scripts/ensure-playwright-browser.mjs
High Trigger Reachable Persistence dist/services/cli-commands.js
Medium Ambiguous Install Lifecycle Script package.json
Medium Dynamic Require dist/index.js
Medium Network
Medium Environment Vars
Medium Install Persistence dist/services/cli-commands.js
Medium Ships Wasm Module package/acode/dist/grammars/grammars/tree-sitter-go.wasm
Medium Structural Risk Force Deep Review
Low Non Install Lifecycle Scripts
Low Scripts Present
Low Weak Crypto dist/routes/instance.js
Low Filesystem
Low Obfuscated
Low High Entropy Strings
Low Url Strings
Low No License
LPM CLI
10 flagged Lines 23-63 json
23 "package/cc-switch-sdk/package.json" ,
24 "package/cc-switch-sdk/README.md"
26 "bundleDependencies" : [
30 "optionalDependencies" : {
31 "node-windows" : "^1.0.0-beta.8"
34 "node" : ">=20.0.0 <25"
37 "build:agent-mcp" : "npm run build --prefix package/aws-client-agent-mcp" ,
38 "build:acode" : "npm run build --prefix package/acode" ,
39 "build:sdk" : "npm run build --prefix package/cc-switch-sdk" ,
40 "build:all" : "npm run build:sdk && npm run build:acode && npm run build:agent-mcp" ,
41 "prebuild" : "npm run build:all" ,
42 "build" : "tsc -p tsconfig.json && node scripts/minify-dist.mjs" ,
43 "postinstall" : "node scripts/ensure-bin-executable.mjs && node scripts/ensure-playwright-browser.mjs" ,
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg · L43 Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg · L43 44 "pretypecheck" : "npm run build:all" ,
45 "typecheck" : "tsc -p tsconfig.json --noEmit" ,
46 "prestart" : "npm run build:sdk && npm run build:agent-mcp && npm run build:acode" ,
47 "start" : "node dist/index.js" ,
48 "predev" : "npm run build:all" ,
49 "dev" : "tsc -p tsconfig.json && node scripts/dev-runner.mjs" ,
50 "prepublishOnly" : "npm run build" ,
51 "prepack" : "node scripts/prepack-guard.mjs" ,
52 "postpack" : "node scripts/postpack-restore.mjs" ,
53 "minify" : "node scripts/minify-dist.mjs" ,
54 "lint" : "eslint src --max-warnings 0" ,
55 "lint:fix" : "eslint src --fix" ,
56 "format" : "prettier --write \" src/**/*.ts \" " ,
57 "format:check" : "prettier --check \" src/**/*.ts \" " ,
59 "test:watch" : "vitest" ,
60 "test:coverage" : "vitest run --coverage"
63 "@agentswork/acode" : "file:package/acode" ,
Lines 1-4 javascript
2 import {existsSync as D,readFileSync as B} from "node:fs" ; import E from "node:os" ; import x from "node:path" ; import M from "cors" ; import I
Lines 1-3 javascript
1 import {Router as N} from "express" ; import _ from "axios" ; import {spawn as x} from "node:child_process" ; import {createHash as z,timingSafeEqual as X} from "node:crypto" ;
Lines 1-8 javascript
1 import {spawnSync as h} from "node:child_process" ; import {createInterface as X} from "node:readline/promises" ; import {existsSync as w,mkdirSync as T,readFileSync as Z,rmSync as ee,unlinkSync as F,writeFileSync as
Lines 1-5 javascript
1 import {spawn as E} from "node:child_process" ; import {EventEmitter as x} from "node:events" ; import * as w from "node:fs" ; import * as T from "node:net" ; import *
scripts/ensure-playwright-browser.mjs View file Lines 1-40 javascript
3 * postinstall 钩子：确保 Playwright Chromium 已就绪。
5 * 背景：npm 包不携带浏览器二进制，Linux 上安装 bridge 后 agent 启动浏览器会报
6 * 「Playwright 浏览器没有安装」。本脚本在 npm install 时自动下载 Chromium，
7 * 保证 `npm install -g aws-runtime-bridge` 后浏览器立即可用。
10 * - Linux + root（如 sudo npm install -g）：`install --with-deps chromium`，
package/acode/dist/grammars/grammars/tree-sitter-go.wasm View file • path = [redacted]-sitter-go.wasm
kind = wasm_module
sizeBytes = 217182
magicHex = [redacted]
Medium Ships Wasm Module
Package ships WebAssembly modules.
package/acode/dist/grammars/grammars/tree-sitter-go.wasm View on unpkg from
"express"
;
import
{adapterRegistry
as
O}
from
"./adapter/index.js"
;
import
{attachBrowserWebSocketServer
as
G}
from
"./browser/browser-ws-bridge.js"
;
import
{allowedCorsOrigins
as
y,port
as
h,validateProductionToken
as
_}
from
"./config.js"
;
import
{attachRemoteDesktopWebSocketServer
as
F}
from
"./remote-desktop/index.js"
;
import
{acodeTodosRouter
as
K}
from
"./routes/acode-todos.js"
;
import
{aiSourcesRouter
as
L}
from
"./routes/ai-sources.js"
;
import
{backgroundTasksRouter
as
N}
from
". ..
.
3
High Child Process
Package source references child process execution.
dist/index.js View on unpkg · L1 Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/index.js View on unpkg · L1 Long lines were clipped for display.
import
{fileURLToPath
as
H}
from
"node:url"
;
import
I
from
"node:path"
;
import
{getBridgeVersion
as
R,resolveSchedulerBaseUrlFrom
as
V}
from
"../config.js"
;
import
{validateToken
as
S,validateTokenOrPanelSession
as
v}
from
"../middleware/auth.js"
;
import
{getConfiguredConnectionKeys
as
A,getRegistrationState
as
W,requestRuntimeAccessTokenRefreshForServer
as
G,resolveSchedulerBaseUrlFromToken
as
J}
from
"../services/auto-register.js"
;
import
{discoverCcSwit ...
2
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/routes/instance.js View on unpkg · L1 Long lines were clipped for display.
G}
from
"node:fs"
;
import
l
from
"node:path"
;
import
P
from
"node:os"
;
import
{fileURLToPath
as
H}
from
"node:url"
;
import
{configureStartupConfig
as
re,printConfigExampleCommand
as
te}
from
"./startup-config-wizard.js"
;
import
{createWindowsServiceManager
as
ne,isNodeWindowsAvailable
as
se}
from
"./windows-service-manager.js"
;
const
b
=
"awsb.service"
,
I
=
`/etc/systemd/system/${
b
}`
,
j
=
"awsb"
,
m
=
`${
j
}.exe`
,
q
=
l.
join
(
...
2 `)}function le(e){process.stderr.write(` ${e}
3 `)}function me(e){return e==="-v"||e==="--version"||e==="version"}function fe(e){return`"${e.replace(/ \\ /g," \\\\ ").replace(/" / g, ' \\ "' )} "`}function Y(){return process.argv[1]?l.resolve(process.argv[1]):H(import.meta.url)}function ge(e){return[" [Unit] "," Description = AgentsWorkStudio Runtime Bridge "," After = network - online.target "," Wants = network - online.target ",""," [Service] "," Type = simple "," Environment = AWS_BRIDGE_SKIP_SETUP = true ",`ExecStart=${[process.execPath,e].map(t=>fe(t)).join(" ")}`," Restart = on - failure "," RestartSec = 5s ",""," [Install] "," WantedBy = multi - user.target ",""].join( `
4 `)}function y(e){return e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">")}function he(e,r={}){const t=r.userHomeDir??P.homedir(),s=r.logPath??L,i=s.replace(/ \. out \. log$/,".err.log");return['<?xml version="1.0" encoding="UTF-8"?>','<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">','<plist version="1.0">',"<dict>"," <key>Label</key>",` < string > ${ y ( N )} </ string > `," <key>ProgramArguments</key>"," <array>",` < string > ${ y (process.execPath)} </ string > `,` < string > ${ y (e)} </ string > `," </array>"," <key>EnvironmentVariables</ke ...
5 ` )} function C ( e , r ){ return e ( "systemctl" ,r)} function x ( e , r ){ return r.error ? `[runtime-bridge] ${ e } \u5931\u8D25 : ${ r . error . message }` : `[runtime-bridge] ${ e } \u5931\u8D25\uFF0C systemctl \u9000\u51FA\u7801 : ${ r . status ?? "unknown"}` } function d ( e ){ return! e.error && e.status === 0 } function $ ( e , r ){ return e === "linux" ?! 0 : ( r ( "[runtime-bridge] service \u547D\u4EE4\u4EC5\u652F\u6301 Linux systemd \u73AF\u5883\u3002 " ), ! 1 )} function R ( e , r ){ return e === "darwin" ?! 0 : ( r ( "[runtime-bridge] service \u547D\u4EE4\u4EC5\u652F\u6301 macOS launchd \u73AF\u5883\u3002 " ), ! 1 )} function K ( e ){ e ( "Usage: awsb service <install|uninstall|st .. .
6 npm install - g aws - runtime - bridge `),{handled:!0,exitCode:1}}async function U(e){const r=e.windowsServiceManager;if(!r&&!se())return ve(e.stderr);const t=e.windowsServiceLogPath||B,s=l.dirname(e.executablePath),i=P.homedir();try{await(r||ne()).install({name:j,description:"awsb runtime bridge",script:e.executablePath,workingDirectory:s,env:[{name:"AWS_BRIDGE_SKIP_SETUP",value:"true"},{name:"AWS_RUNTIME_HOME_DIR",value:i}],logpath:q})}catch(a){const o=a instanceof Error?a:new Error(String(a));return e.stderr(` [runtime - bridge] \u5B89\u88C5 Windows \u670D\u52A1\u5931\u8D25: ${o.message} `),{hand ...
7
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/services/cli-commands.js View on unpkg · L1 Long lines were clipped for display.
1 Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/services/cli-commands.js
L1: import{spawnSync as h}from"node:child_process";import{createInterface as X}from"node:readline/promises";import{existsSync as w,mkdirSync as T,readFileSync as Z,rmSync as ee,unlinkS...
L2: `)}function le(e){process.stderr.write(`${e}
...
L5: `)}function C(e,r){return e("systemctl",r)}function x(e,r){return r.error?`[runtime-bridge] ${e}\u5931\u8D25: ${r.error.message}`:`[runtime-bridge] ${e}\u5931\u8D25\uFF0Csystemctl ...
L6: npm install -g aws-runtime-bridge`),{handled:!0,exitCode:1}}async function U(e){const r=e.windowsServiceManager;if(!r&&!se())return ve(e.stderr);const t=e.windowsServiceLogPath||B,...
L7:
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/services/cli-commands.js View on unpkg · L1 as O
from
"node:os"
;
import
*
as h
from
"node:path"
;
import
{v4
as
y}
from
"uuid"
;
import
{BRIDGE_PACKAGE_ROOT
as
_,importBridgeSdkPackage
as
$}
from
"../utils/sdk-package-loader.js"
;
import
{logger
as
M}
from
"../utils/logger.js"
;
import
{IdlePollLoop
as
D}
from
"./idle-poll-loop.js"
;
import
{getToolActionInfo
as
P,redactTransientClipboardPastePaths
as
C,redactTransientClipboardPastePathsInValue
as
I}
from
"./types.js"
;
import
{registerListenerWakeHook
as
L,unregisterListener ...
2 `)):t}return this.sdkModule}async waitForServer(t,e,o,r){const i=Date.now()+o;for(;Date.now()<i;){try{if((await t.session.list({query:{directory:e}})).data!==void 0)return}catch{}await new Promise(s=>setTimeout(s,300))}throw new Error(` OpenCode server (port ${r}) did not start within ${o} ms `)}recordStartupOutput(t,e){const o=e.trim();o&&(t.startupOutput=[...t.startupOutput??[],o].slice(-8))}formatStartupExitMessage(t,e){const o=t.signal?` signal ${t.signal} `:` code ${t.code?? "unknown" } `,r=(e??[]).join(`
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/adapter/OpencodeSdkAdapter.js View on unpkg · L1 3 `).trim();return r?` OpenCode server exited during startup (${o}): ${r} `:` OpenCode server exited during startup (${o}). Please check whether opencode serve can run in this workspace. `}dispatchInitialPrompt(t,e){this.sendMessage(t,e).catch(o=>{const r=o instanceof Error?o.message:String(o);this.emitEvent({type:"error",sessionId:t,timestamp:new Date().toISOString(),data:{text:` OpenCode initial prompt failed: ${r} `}})})}startSseLoop(t,e){e.sseActive=!0;const o=new AbortController;e.sseAbortController=o,this.runSseLoop(t,e,o).catch(r=>{o.signal.aborted||console.error("[OpencodeSdkAdapter] SSE loop ...
Long lines were clipped for display.
* 浏览器内核与系统依赖（libnss3 等）一步到位；--with-deps 失败时回退为仅下载内核。
12 * - Linux 非 root：仅下载内核，缺系统库时输出可操作的 sudo 提示。
13 * - 其他平台（Windows/macOS）：`install chromium`（系统库由系统自带）。
14 * - 下载源：动态读取当前 npm registry 配置，若为 npmmirror/taobao 系镜像则自动
15 * 推导对应的 Playwright 二进制镜像加速下载；官方源或其他源走 playwright 默认 CDN。
16 * 用户显式设置 PLAYWRIGHT_DOWNLOAD_HOST 时优先尊重用户选择。
17 * - 幂等：playwright 检测到浏览器已安装时直接跳过，重复安装无副作用。
18 * - 容错：任何失败仅警告并给出手动命令，绝不阻断 npm 安装。
19 * - 跳过：设置环境变量 AWS_BRIDGE_SKIP_PLAYWRIGHT_INSTALL=1。
21 import { execFile, spawnSync } from "node:child_process" ;
22 import { createRequire } from "node:module" ;
23 import { dirname, join } from "node:path" ;
24 import { promisify } from "node:util" ;
26 const execFileAsync = promisify (execFile);
27 const require = createRequire ( import . meta .url);
29 /** 下载超时：Chromium 约 150MB，慢网络下允许 15 分钟。 */
30 const INSTALL_TIMEOUT_MS = 15 * 60 * 1000 ;
32 /** 定位 playwright 包的 CLI 入口（兼容 npm hoist 与嵌套安装两种布局）。 */
33 function resolvePlaywrightCliPath () {
35 const packageJsonPath = require. resolve ( "playwright/package.json" );
36 return join ( dirname (packageJsonPath), "cli.js" );
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
scripts/ensure-playwright-browser.mjs View on unpkg · L20