registry / aws-runtime-bridge / 1.9.57

aws-runtime-bridge@1.9.57

AgentsWorkStudio runtime bridge service for machine-level agent runtime integration

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 172 file(s), 2.29 MB of source, external domains: 127.0.0.1, example.com, registry.npmjs.org, secure.example.com

Source & flagged code

9 flagged

package.jsonView file

Lines 18-58json

18 "package/acode/dist",

19 "package/acode/package.json",

20 "package/acode/README.md",

21 "package/cc-switch-sdk/dist",

22 "package/cc-switch-sdk/package.json",

23 "package/cc-switch-sdk/README.md"

24 ],

25 "bundleDependencies": [

26 "@cc-switch/sdk"

27 ],

28 "engines": {

29 "node": ">=20.0.0 <25"

30 },

31 "scripts": {

32 "build:agent-mcp": "npm run build --prefix package/aws-client-agent-mcp",

33 "build:acode": "npm run build --prefix package/acode",

34 "build:sdk": "npm run build --prefix package/cc-switch-sdk",

35 "build:all": "npm run build:sdk && npm run build:acode && npm run build:agent-mcp",

36 "prebuild": "npm run build:all",

37 "build": "tsc -p tsconfig.json",

38 "postinstall": "node scripts/ensure-bin-executable.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L38

39 "pretypecheck": "npm run build:all",

40 "typecheck": "tsc -p tsconfig.json --noEmit",

41 "prestart": "npm run build:sdk && npm run build:agent-mcp && npm run build:acode",

42 "start": "node dist/index.js",

43 "predev": "npm run build:all",

44 "dev": "tsc -p tsconfig.json && node scripts/dev-runner.mjs",

45 "prepublishOnly": "npm run build",

46 "lint": "eslint src --max-warnings 0",

47 "lint:fix": "eslint src --fix",

48 "format": "prettier --write \"src/**/*.ts\"",

49 "format:check": "prettier --check \"src/**/*.ts\"",

50 "test": "vitest run",

51 "test:watch": "vitest",

52 "test:coverage": "vitest run --coverage"

53 },

54 "dependencies": {

55 "@agentswork/acode": "file:package/acode",

56 "@cc-switch/sdk": "file:package/cc-switch-sdk",

57 "@modelcontextprotocol/sdk": "^1.27.1",

58 "archiver": "^8.0.0",

dist/index.jsView file

Lines 203-243javascript

203 return;

204 }

205 logger.info(`[runtime-bridge] ★ 已显式启用启动清理，检测 ${persistedSessions.length} 个持久化会话的孤儿进程...`);

206 const orphans = await detectOrphanProcesses(persistedSessions.

dist/utils/file-utils.jsView file

Lines 112-152javascript

112 };

113}

114export async function runCommand(command, args) {

115 await new Promise((resolve, reject

dist/utils/sdk-package-loader.jsView file

Lines 49-79javascript

49/**

50 * 主干流程：从 bridge 自身安装根下的 node_modules 读取包元数据，

51 * 按 package.json 的 exports/module/main 定位真实 ESM 入口，避免猜测根目录 index.js。

52 */

53export async function resolveBridgePackageEntryPath(packageName, packageRoot = BRIDGE_PACKAGE_ROOT) {

dist/routes/instance.jsView file

Lines 1-21javascript

1import { Router } from "express";

2import axios from "axios";

3import { spawn } from "node:child_process";

4import { createHash, timingSafeEqual } from "node:crypto";

dist/services/cli-commands.jsView file

Lines 1-21javascript

1import { spawnSync } from "node:child_process";

2import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync, } from "node:fs";

3import path from "node:path";

4import { fileURLToPath } from "node:url"

dist/adapter/OpencodeSdkAdapter.jsView file

Lines 121-161javascript

121 totalUsage: { inputTokens: 0, outputTokens: 0 },

122 },

123 config,

124 sseActive: false,

125 pendingPermissions:

package/acode/dist/grammars/grammars/tree-sitter-go.wasmView file

•path = [redacted]-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

package/acode/dist/grammars/grammars/tree-sitter-go.wasmView on unpkg

dist/routes/terminal.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = aws-runtime-bridge@1.9.50 matchedIdentity = npm:YXdzLXJ1bnRpbWUtYnJpZGdl:1.9.50 similarity = 0.883 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/routes/terminal.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code