registry / dependabot-agent / 0.1.3

dependabot-agent@0.1.3

On-demand CLI agent that reconciles npm/pnpm dependency overrides with GitHub Dependabot alerts

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 17 file(s), 57.9 KB of source, external domains: api.github.com, registry.npmjs.org

Source & flagged code

2 flagged

dist/util.jsView file

Lines 1-21javascript

1import { execSync } from "node:child_process";

2/**

High

Child Process

Package source references child process execution.

dist/util.jsView on unpkg · L1

3 * Run a shell command synchronously and return its stdout as a string.

4 * Defaults to utf-8 encoding; callers may override (e.g. larger maxBuffer).

5 */

6export function shell(cmd, opts = {}) {

7 return execSync(cmd, { encoding: "utf-8", ...opts }).toString();

9export function addUnique(arr, value) {

10 if (!arr.includes(value))

11 arr.push(value);

12}

13export function sortObjectKeys(obj) {

14 return Object.fromEntries(Object.entries(obj).sort(([a], [b]) => a.localeCompare(b)));

15}

16export function log(msg) {

17 console.log(msg);

18}

19export function warn(msg) {

20 console.warn(`⚠️ ${msg}`);

21}

dist/package-manager/npm.jsView file

Lines 54-94javascript

54 update(cwd, alertedPackages) {

55 if (this.ctx.dryRun) {

56 log("⏭️ Skipping npm update (dry run).");

57 return;

58 }

59 if (this.ctx.skipUpdate) {

60 log("⏭️ Skipping npm update (skip-update)."

Source & flagged code

2 flagged · loading source

dist/util.jsView file

1import { execSync } from "node:child_process"; L2: /**

High

Child Process

Package source references child process execution.

dist/util.jsView on unpkg · L1

dist/package-manager/npm.jsView file

74log(`📦 Running npm install ${specs} in ${cwd}...`); L75: execSync(`npm install ${specs}`, { cwd, stdio: "inherit" }); L76: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/package-manager/npm.jsView on unpkg · L74

Findings

3 High3 Medium6 Low

HighChild Processdist/util.js

HighShell

HighRuntime Package Installdist/package-manager/npm.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/util.jsView file

Lines 1-21javascript

1import { execSync } from "node:child_process";

2/**

High

Child Process

Package source references child process execution.

dist/util.jsView on unpkg · L1

3 * Run a shell command synchronously and return its stdout as a string.

4 * Defaults to utf-8 encoding; callers may override (e.g. larger maxBuffer).

5 */

6export function shell(cmd, opts = {}) {

7 return execSync(cmd, { encoding: "utf-8", ...opts }).toString();

9export function addUnique(arr, value) {

10 if (!arr.includes(value))

11 arr.push(value);

12}

13export function sortObjectKeys(obj) {

14 return Object.fromEntries(Object.entries(obj).sort(([a], [b]) => a.localeCompare(b)));

15}

16export function log(msg) {

17 console.log(msg);

18}

19export function warn(msg) {

20 console.warn(`⚠️ ${msg}`);

21}

dist/package-manager/npm.jsView file

Lines 54-94javascript

54 update(cwd, alertedPackages) {

55 if (this.ctx.dryRun) {

56 log("⏭️ Skipping npm update (dry run).");

57 return;

58 }

59 if (this.ctx.skipUpdate) {

60 log("⏭️ Skipping npm update (skip-update)."