aws-runtime-bridge@1.9.117: Suspicious npm security report (Warn) | LPM Firewall
Flagged as agent extension risk
Allowed by default with warning: install-time first-party agent extension setup was detected.
aws-runtime-bridge@1.9.117 Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
AgentsWorkStudio runtime bridge service for machine-level agent runtime integration
scanned 26d ago · by lpm-firewall-ai LPM treats this as warn-only first-party agent extension lifecycle risk. This is a privileged machine-runtime bridge with terminal, browser, and agent-configuration capabilities. Install-time behavior is limited to its CLI permission and Playwright browser provisioning; no confirmed malicious chain was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm install activates postinstall; `awsb service install` activates persistence; authenticated runtime use activates bridge features.
Impact
The package is dual-use and can establish a persistent local bridge when its documented CLI command is invoked.
Mechanism
Playwright provisioning plus explicit runtime/service and agent-integration management.
Rationale
No concrete malicious behavior was established, but the package ships high-impact machine and AI-agent integration capabilities plus an install-time browser download/system-dependency action. Warn rather than block because persistence is explicitly user-invoked and no covert attack chain was found.
Evidence
package.json scripts/ensure-playwright-browser.mjs scripts/ensure-bin-executable.mjs dist/services/cli-commands.js dist/config.js README.md dist/index.js
Network endpoints1
npmmirror.com /mirrors/playwright
public snapshot
AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
package.json postinstall runs browser setup automatically. scripts/ensure-playwright-browser.mjs downloads Chromium and, as root on Linux, invokes Playwright --with-deps. dist/services/cli-commands.js can create systemd, launchd, or Windows services only through `awsb service install`. dist/config.js and cc-switch SDK support runtime configuration for Claude, Codex, OpenCode, and Acode. Evidence against
Postinstall only chmods its own dist/index.js and prepares Playwright; it does not write agent-control configs. Persistence paths are gated behind an explicit CLI subcommand, documented in README.md. Network callback targets are configuration-derived; no hard-coded exfiltration host was found. No credential harvesting, covert payload execution, or foreign agent-control mutation during install was found. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Filesystem Network Shell WebSocket
Supply chain HighEntropyStrings Minified Obfuscated UrlStrings
scanned 229 file(s), 1.44 MB of source, external domains: 127.0.0.1, example.com, npmmirror.com, registry.npmjs.org, secure.example.com, www.apple.com
11 flagged · loading source • scripts.postinstall = node scripts/ensure-bin-executable.mjs && node scripts/ensure-playwright-browser.mjs
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg • scripts.postinstall = node scripts/ensure-bin-executable.mjs && node scripts/ensure-playwright-browser.mjs
Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg 1 #!/usr/bin/env node
L2: import{existsSync as D,readFileSync as B}from"node:fs";import E from"node:os";import x from"node:path";import M from"cors";import I from"express";import{adapterRegistry as O}from"....
L3:
High Child Process
Package source references child process execution.
dist/index.js View on unpkg · L1 1 #!/usr/bin/env node
L2: import{existsSync as D,readFileSync as B}from"node:fs";import E from"node:os";import x from"node:path";import M from"cors";import I from"express";import{adapterRegistry as O}from"....
L3:
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/index.js View on unpkg · L1 1 import{Router as X}from"express";import _ from"axios";import{spawn as x}from"node:child_process";import{createHash as H,timingSafeEqual as V}from"node:crypto";import{fileURLToPath ...
L2:
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/routes/instance.js View on unpkg · L1 1 Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/services/cli-commands.js
L1: import{spawnSync as g}from"node:child_process";import{createInterface as X}from"node:readline/promises";import{existsSync as h,mkdirSync as I,readFileSync as Z,rmSync as ee,unlinkS...
L2: `)}function le(e){process.stderr.write(`${e}
...
L5: `)}function b(e,r){return e("systemctl",r)}function C(e,r){return r.error?`[runtime-bridge] ${e}\u5931\u8D25: ${r.error.message}`:`[runtime-bridge] ${e}\u5931\u8D25\uFF0Csystemctl ...
L6: npm install -g aws-runtime-bridge`),{handled:!0,exitCode:1}}async function M(e){const r=e.windowsServiceManager;if(!r&&!se())return ve(e.stderr);const t=e.windowsServiceLogPath||B,...
L7:
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/services/cli-commands.js View on unpkg · L1 • matchType = previous_version_dangerous_delta
matchedPackage = aws-runtime-bridge@1.9.116
matchedIdentity = npm:YXdzLXJ1bnRpbWUtYnJpZGdl:1.9.116
similarity = 0.992
summary = stored previous version shares package body but lacks this dangerous source file
High Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/services/cli-commands.js View on unpkg 1 import{spawnSync as g}from"node:child_process";import{createInterface as X}from"node:readline/promises";import{existsSync as h,mkdirSync as I,readFileSync as Z,rmSync as ee,unlinkS...
L2: `)}function le(e){process.stderr.write(`${e}
...
L5: `)}function b(e,r){return e("systemctl",r)}function C(e,r){return r.error?`[runtime-bridge] ${e}\u5931\u8D25: ${r.error.message}`:`[runtime-bridge] ${e}\u5931\u8D25\uFF0Csystemctl ...
L6: npm install -g aws-runtime-bridge`),{handled:!0,exitCode:1}}async function M(e){const r=e.windowsServiceManager;if(!r&&!se())return ve(e.stderr);const t=e.windowsServiceLogPath||B,...
L7:
1 import{spawn as E}from"node:child_process";import{EventEmitter as x}from"node:events";import*as w from"node:fs";import*as T from"node:net";import*as O from"node:os";import*as h fro...
L2: `)):t}return this.sdkModule}async waitForServer(t,e,o,r){const i=Date.now()+o;for(;Date.now()<i;){try{if((await t.session.list({query:{directory:e}})).data!==void 0)return}catch{}a...
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/adapter/OpencodeSdkAdapter.js View on unpkg · L1 scripts/ensure-playwright-browser.mjs View file 20 */
L21: import { execFile, spawnSync } from "node:child_process";
L22: import { createRequire } from "node:module";
...
L34: try {
L35: const packageJsonPath = require.resolve("playwright/package.json");
L36: return join(dirname(packageJsonPath), "cli.js");
...
L49: encoding: "utf-8",
L50: shell: process.platform === "win32",
L51: stdio: ["ignore", "pipe", "ignore"],
L52: });
L53: if (result.status === 0 && result.stdout) {
L54: const url = result.stdout.trim();
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
scripts/ensure-playwright-browser.mjs View on unpkg · L20 package/acode/dist/grammars/grammars/tree-sitter-go.wasm View file • path = [redacted]-sitter-go.wasm
kind = wasm_module
sizeBytes = 217182
magicHex = [redacted]
Medium Ships Wasm Module
Package ships WebAssembly modules.
package/acode/dist/grammars/grammars/tree-sitter-go.wasm View on unpkg 7 High 7 Medium 8 Low
High Install Time Lifecycle Scripts package.json
High Child Process dist/index.js
High Shell
High Same File Env Network Execution dist/adapter/OpencodeSdkAdapter.js
High Sandbox Evasion Gated Capability scripts/ensure-playwright-browser.mjs
High Trigger Reachable Persistence dist/services/cli-commands.js
High Previous Version Dangerous Delta dist/services/cli-commands.js
Medium Ambiguous Install Lifecycle Script package.json
Medium Dynamic Require dist/index.js
Medium Network
Medium Environment Vars
Medium Install Persistence dist/services/cli-commands.js
Medium Ships Wasm Module package/acode/dist/grammars/grammars/tree-sitter-go.wasm
Medium Structural Risk Force Deep Review
Low Non Install Lifecycle Scripts
Low Scripts Present
Low Weak Crypto dist/routes/instance.js
Low Filesystem
Low Obfuscated
Low High Entropy Strings
Low Url Strings
Low No License
LPM CLI
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/services/cli-commands.js View on unpkg · L1 11 flagged Lines 23-63 json
23 "package/cc-switch-sdk/package.json" ,
24 "package/cc-switch-sdk/README.md"
26 "bundleDependencies" : [
30 "optionalDependencies" : {
31 "node-windows" : "^1.0.0-beta.8"
34 "node" : ">=20.0.0 <25"
37 "build:agent-mcp" : "npm run build --prefix package/aws-client-agent-mcp" ,
38 "build:acode" : "npm run build --prefix package/acode" ,
39 "build:sdk" : "npm run build --prefix package/cc-switch-sdk" ,
40 "build:all" : "npm run build:sdk && npm run build:acode && npm run build:agent-mcp" ,
41 "prebuild" : "npm run build:all" ,
42 "build" : "tsc -p tsconfig.json && node scripts/minify-dist.mjs" ,
43 "postinstall" : "node scripts/ensure-bin-executable.mjs && node scripts/ensure-playwright-browser.mjs" ,
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg · L43 Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg · L43 44 "pretypecheck" : "npm run build:all" ,
45 "typecheck" : "tsc -p tsconfig.json --noEmit" ,
46 "prestart" : "npm run build:sdk && npm run build:agent-mcp && npm run build:acode" ,
47 "start" : "node dist/index.js" ,
48 "predev" : "npm run build:all" ,
49 "dev" : "tsc -p tsconfig.json && node scripts/dev-runner.mjs" ,
50 "prepublishOnly" : "npm run build" ,
51 "prepack" : "node scripts/prepack-guard.mjs" ,
52 "postpack" : "node scripts/postpack-restore.mjs" ,
53 "minify" : "node scripts/minify-dist.mjs" ,
54 "lint" : "eslint src --max-warnings 0" ,
55 "lint:fix" : "eslint src --fix" ,
56 "format" : "prettier --write \" src/**/*.ts \" " ,
57 "format:check" : "prettier --check \" src/**/*.ts \" " ,
59 "test:watch" : "vitest" ,
60 "test:coverage" : "vitest run --coverage"
63 "@agentswork/acode" : "file:package/acode" ,
Lines 1-4 javascript
2 import {existsSync as D,readFileSync as B} from "node:fs" ; import E from "node:os" ; import x from "node:path" ; import M from "cors" ; import I
Lines 1-3 javascript
1 import {Router as X} from "express" ; import _ from "axios" ; import {spawn as x} from "node:child_process" ; import {createHash as H,timingSafeEqual as V} from "node:crypto" ;
Lines 1-8 javascript
1 import {spawnSync as g} from "node:child_process" ; import {createInterface as X} from "node:readline/promises" ; import {existsSync as h,mkdirSync as I,readFileSync as Z,rmSync as ee,unlinkSync as F,writeFileSync as
Lines 1-5 javascript
1 import {spawn as E} from "node:child_process" ; import {EventEmitter as x} from "node:events" ; import * as w from "node:fs" ; import * as T from "node:net" ; import *
scripts/ensure-playwright-browser.mjs View file Lines 1-40 javascript
3 * postinstall 钩子：确保 Playwright Chromium 已就绪。
5 * 背景：npm 包不携带浏览器二进制，Linux 上安装 bridge 后 agent 启动浏览器会报
6 * 「Playwright 浏览器没有安装」。本脚本在 npm install 时自动下载 Chromium，
7 * 保证 `npm install -g aws-runtime-bridge` 后浏览器立即可用。
10 * - Linux + root（如 sudo npm install -g）：`install --with-deps chromium`，
package/acode/dist/grammars/grammars/tree-sitter-go.wasm View file • path = [redacted]-sitter-go.wasm
kind = wasm_module
sizeBytes = 217182
magicHex = [redacted]
Medium Ships Wasm Module
Package ships WebAssembly modules.
package/acode/dist/grammars/grammars/tree-sitter-go.wasm View on unpkg from
"express"
;
import
{adapterRegistry
as
O}
from
"./adapter/index.js"
;
import
{attachBrowserWebSocketServer
as
G}
from
"./browser/browser-ws-bridge.js"
;
import
{allowedCorsOrigins
as
y,port
as
h,validateProductionToken
as
_}
from
"./config.js"
;
import
{attachRemoteDesktopWebSocketServer
as
F}
from
"./remote-desktop/index.js"
;
import
{acodeTodosRouter
as
K}
from
"./routes/acode-todos.js"
;
import
{aiSourcesRouter
as
L}
from
"./routes/ai-sources.js"
;
import
{backgroundTasksRouter
as
N}
from
". ..
.
3
High Child Process
Package source references child process execution.
dist/index.js View on unpkg · L1 Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/index.js View on unpkg · L1 Long lines were clipped for display.
import
{fileURLToPath
as
W}
from
"node:url"
;
import
I
from
"node:path"
;
import
{getBridgeVersion
as
R,resolveSchedulerBaseUrlFrom
as
G}
from
"../config.js"
;
import
{validateToken
as
S,validateTokenOrPanelSession
as
v}
from
"../middleware/auth.js"
;
import
{getConfiguredConnectionKeys
as
A,getRegistrationState
as
J,requestRuntimeAccessTokenRefreshForServer
as
Y,resolveSchedulerBaseUrlFromToken
as
Q}
from
"../services/auto-register.js"
;
import
{discoverCcSwit ...
2
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/routes/instance.js View on unpkg · L1 Long lines were clipped for display.
G}
from
"node:fs"
;
import
l
from
"node:path"
;
import
P
from
"node:os"
;
import
{fileURLToPath
as
H}
from
"node:url"
;
import
{configureStartupConfig
as
re,printConfigExampleCommand
as
te}
from
"./startup-config-wizard.js"
;
import
{createWindowsServiceManager
as
ne,isNodeWindowsAvailable
as
se}
from
"./windows-service-manager.js"
;
const
w
=
"awsb.service"
,
N
=
`/etc/systemd/system/${
w
}`
,
j
=
"awsb"
,
c
=
`${
j
}.exe`
,
q
=
l.
join
(
...
2 `)}function le(e){process.stderr.write(` ${e}
3 `)}function me(e){return e==="-v"||e==="--version"||e==="version"}function fe(e){return`"${e.replace(/ \\ /g," \\\\ ").replace(/" / g, ' \\ "' )} "`}function K(){return process.argv[1]?l.resolve(process.argv[1]):H(import.meta.url)}function ge(e){return[" [Unit] "," Description = AgentsWorkStudio Runtime Bridge "," After = network - online.target "," Wants = network - online.target ",""," [Service] "," Type = simple "," Environment = AWS_BRIDGE_SKIP_SETUP = true ",`ExecStart=${[process.execPath,e].map(t=>fe(t)).join(" ")}`," Restart = on - failure "," RestartSec = 5s ",""," [Install] "," WantedBy = multi - user.target ",""].join( `
4 `)}function y(e){return e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">")}function he(e,r={}){const t=r.userHomeDir??P.homedir(),s=r.logPath??A,i=s.replace(/ \. out \. log$/,".err.log");return['<?xml version="1.0" encoding="UTF-8"?>','<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">','<plist version="1.0">',"<dict>"," <key>Label</key>",` < string > ${ y ( L )} </ string > `," <key>ProgramArguments</key>"," <array>",` < string > ${ y (process.execPath)} </ string > `,` < string > ${ y (e)} </ string > `," </array>"," <key>EnvironmentVariables</ke ...
5 ` )} function b ( e , r ){ return e ( "systemctl" ,r)} function C ( e , r ){ return r.error ? `[runtime-bridge] ${ e } \u5931\u8D25 : ${ r . error . message }` : `[runtime-bridge] ${ e } \u5931\u8D25\uFF0C systemctl \u9000\u51FA\u7801 : ${ r . status ?? "unknown"}` } function o ( e ){ return! e.error && e.status === 0 } function R ( e , r ){ return e === "linux" ?! 0 : ( r ( "[runtime-bridge] service \u547D\u4EE4\u4EC5\u652F\u6301 Linux systemd \u73AF\u5883\u3002 " ), ! 1 )} function W ( e , r ){ return e === "darwin" ?! 0 : ( r ( "[runtime-bridge] service \u547D\u4EE4\u4EC5\u652F\u6301 macOS launchd \u73AF\u5883\u3002 " ), ! 1 )} function Y ( e ){ e ( "Usage: awsb service <install|uninstall|st .. .
6 npm install - g aws - runtime - bridge `),{handled:!0,exitCode:1}}async function M(e){const r=e.windowsServiceManager;if(!r&&!se())return ve(e.stderr);const t=e.windowsServiceLogPath||B,s=l.dirname(e.executablePath),i=P.homedir();try{await(r||ne()).install({name:j,description:"awsb runtime bridge",script:e.executablePath,workingDirectory:s,env:[{name:"AWS_BRIDGE_SKIP_SETUP",value:"true"},{name:"AWS_RUNTIME_HOME_DIR",value:i}],logpath:q})}catch(u){const m=u instanceof Error?u:new Error(String(u));return e.stderr(` [runtime - bridge] \u5B89\u88C5 Windows \u670D\u52A1\u5931\u8D25: ${m.message} `),{hand ...
7
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/services/cli-commands.js View on unpkg · L1 Long lines were clipped for display.
1 Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/services/cli-commands.js
L1: import{spawnSync as g}from"node:child_process";import{createInterface as X}from"node:readline/promises";import{existsSync as h,mkdirSync as I,readFileSync as Z,rmSync as ee,unlinkS...
L2: `)}function le(e){process.stderr.write(`${e}
...
L5: `)}function b(e,r){return e("systemctl",r)}function C(e,r){return r.error?`[runtime-bridge] ${e}\u5931\u8D25: ${r.error.message}`:`[runtime-bridge] ${e}\u5931\u8D25\uFF0Csystemctl ...
L6: npm install -g aws-runtime-bridge`),{handled:!0,exitCode:1}}async function M(e){const r=e.windowsServiceManager;if(!r&&!se())return ve(e.stderr);const t=e.windowsServiceLogPath||B,...
L7:
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/services/cli-commands.js View on unpkg · L1 • matchType = previous_version_dangerous_delta
matchedPackage = aws-runtime-bridge@1.9.116
matchedIdentity = npm:YXdzLXJ1bnRpbWUtYnJpZGdl:1.9.116
similarity = 0.992
summary = stored previous version shares package body but lacks this dangerous source file
High Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/services/cli-commands.js View on unpkg as O
from
"node:os"
;
import
*
as h
from
"node:path"
;
import
{v4
as
y}
from
"uuid"
;
import
{BRIDGE_PACKAGE_ROOT
as
_,importBridgeSdkPackage
as
$}
from
"../utils/sdk-package-loader.js"
;
import
{logger
as
M}
from
"../utils/logger.js"
;
import
{IdlePollLoop
as
D}
from
"./idle-poll-loop.js"
;
import
{getToolActionInfo
as
P,redactTransientClipboardPastePaths
as
C,redactTransientClipboardPastePathsInValue
as
I}
from
"./types.js"
;
import
{registerListenerWakeHook
as
L,unregisterListener ...
2 `)):t}return this.sdkModule}async waitForServer(t,e,o,r){const i=Date.now()+o;for(;Date.now()<i;){try{if((await t.session.list({query:{directory:e}})).data!==void 0)return}catch{}await new Promise(s=>setTimeout(s,300))}throw new Error(` OpenCode server (port ${r}) did not start within ${o} ms `)}recordStartupOutput(t,e){const o=e.trim();o&&(t.startupOutput=[...t.startupOutput??[],o].slice(-8))}formatStartupExitMessage(t,e){const o=t.signal?` signal ${t.signal} `:` code ${t.code?? "unknown" } `,r=(e??[]).join(`
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/adapter/OpencodeSdkAdapter.js View on unpkg · L1 3 `).trim();return r?` OpenCode server exited during startup (${o}): ${r} `:` OpenCode server exited during startup (${o}). Please check whether opencode serve can run in this workspace. `}dispatchInitialPrompt(t,e){this.sendMessage(t,e).catch(o=>{const r=o instanceof Error?o.message:String(o);this.emitEvent({type:"error",sessionId:t,timestamp:new Date().toISOString(),data:{text:` OpenCode initial prompt failed: ${r} `}})})}startSseLoop(t,e){e.sseActive=!0;const o=new AbortController;e.sseAbortController=o,this.runSseLoop(t,e,o).catch(r=>{o.signal.aborted||console.error("[OpencodeSdkAdapter] SSE loop ...
Long lines were clipped for display.
* 浏览器内核与系统依赖（libnss3 等）一步到位；--with-deps 失败时回退为仅下载内核。
12 * - Linux 非 root：仅下载内核，缺系统库时输出可操作的 sudo 提示。
13 * - 其他平台（Windows/macOS）：`install chromium`（系统库由系统自带）。
14 * - 下载源：动态读取当前 npm registry 配置，若为 npmmirror/taobao 系镜像则自动
15 * 推导对应的 Playwright 二进制镜像加速下载；官方源或其他源走 playwright 默认 CDN。
16 * 用户显式设置 PLAYWRIGHT_DOWNLOAD_HOST 时优先尊重用户选择。
17 * - 幂等：playwright 检测到浏览器已安装时直接跳过，重复安装无副作用。
18 * - 容错：任何失败仅警告并给出手动命令，绝不阻断 npm 安装。
19 * - 跳过：设置环境变量 AWS_BRIDGE_SKIP_PLAYWRIGHT_INSTALL=1。
21 import { execFile, spawnSync } from "node:child_process" ;
22 import { createRequire } from "node:module" ;
23 import { dirname, join } from "node:path" ;
24 import { promisify } from "node:util" ;
26 const execFileAsync = promisify (execFile);
27 const require = createRequire ( import . meta .url);
29 /** 下载超时：Chromium 约 150MB，慢网络下允许 15 分钟。 */
30 const INSTALL_TIMEOUT_MS = 15 * 60 * 1000 ;
32 /** 定位 playwright 包的 CLI 入口（兼容 npm hoist 与嵌套安装两种布局）。 */
33 function resolvePlaywrightCliPath () {
35 const packageJsonPath = require. resolve ( "playwright/package.json" );
36 return join ( dirname (packageJsonPath), "cli.js" );
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
scripts/ensure-playwright-browser.mjs View on unpkg · L20