registry / dp-worker / 0.1.11

dp-worker@0.1.11

Dipclaw Worker (worker) — browser automation agent with scheduling, skills, and LLM integration. Connects to dp-center via center mode or runs standalone.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 67 file(s), 937 KB of source, external domains: 127.0.0.1, api.ip.sb, api.telegram.org, freeipapi.com, ip-api.com, ipapi.co, ipinfo.io, ipwho.is, ping0.cc

Source & flagged code

3 flagged

package.jsonView file

Lines 4-44json

4 "description": "Dipclaw Worker (worker) — browser automation agent with scheduling, skills, and LLM integration. Connects to dp-center via center mode or runs standalone.",

5 "type": "module",

6 "bin": {

7 "dp-worker": "dist/index.js"

8 },

9 "files": [

10 "dist",

11 "builtin-skills",

12 "config.example.json",

13 "scripts/install-cloakbrowser.mjs"

14 ],

15 "scripts": {

16 "prebuild": "npm --prefix ../dp-shared run build",

17 "build": "tsc && node scripts/copy-chrome-extension.mjs && chmod +x dist/index.js",

18 "predev": "npm --prefix ../dp-shared run build",

19 "dev": "tsx src/index.ts",

20 "start": "node dist/index.js",

21 "pretest": "npm --prefix ../dp-shared run build",

22 "test": "vitest run",

23 "test:watch": "vitest",

24 "postinstall": "node scripts/install-cloakbrowser.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

25 "prepublishOnly": "npm run build"

26 },

27 "keywords": [

28 "agent",

29 "browser-automation",

30 "playwright",

31 "llm",

32 "telegram",

33 "chrome",

34 "automation"

35 ],

36 "author": "",

37 "license": "MIT",

38 "repository": {

39 "type": "git",

40 "url": "git+https://github.com/dipcoinlab/dipclaw.git"

41 },

42 "homepage": "https://github.com/dipcoinlab/dipclaw",

43 "engines": {

44 "node": ">=18"

dist/browser/dom-helpers.jsView file

Lines 388-428javascript

388 return JSON.stringify(cards, null, 2);

389}

390/**

391 * Quick syntactic sanity check for `evaluate` scripts. We compile via

392 * `new Function` which throws on parse error without ever executing the

393 * code. Catches the most common LLM syntax slips (missing parens, stray

394 * commas, illegal identifiers) before a round-trip to the page.

395 */

396export

dist/agent/tool-loop-detection.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2// --- Thresholds ---

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/agent/tool-loop-detection.jsView on unpkg · L1

3const MAX_HISTORY = 30;

4const GENERIC_REPEAT_WARN = 3;

5const

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-cloakbrowser.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/browser/dom-helpers.jsView file

408try { L409: new Function(wrapped); L410: return { ok: true };

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/browser/dom-helpers.jsView on unpkg · L408

dist/agent/tool-loop-detection.jsView file

1import { createHash } from "node:crypto"; L2: // --- Thresholds ---

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/agent/tool-loop-detection.jsView on unpkg · L1

Findings

1 High3 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/browser/dom-helpers.js

LowWeak Cryptodist/agent/tool-loop-detection.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

package.jsonView file

Lines 4-44json

4 "description": "Dipclaw Worker (worker) — browser automation agent with scheduling, skills, and LLM integration. Connects to dp-center via center mode or runs standalone.",

5 "type": "module",

6 "bin": {

7 "dp-worker": "dist/index.js"

8 },

9 "files": [

10 "dist",

11 "builtin-skills",

12 "config.example.json",

13 "scripts/install-cloakbrowser.mjs"

14 ],

15 "scripts": {

16 "prebuild": "npm --prefix ../dp-shared run build",

17 "build": "tsc && node scripts/copy-chrome-extension.mjs && chmod +x dist/index.js",

18 "predev": "npm --prefix ../dp-shared run build",

19 "dev": "tsx src/index.ts",

20 "start": "node dist/index.js",

21 "pretest": "npm --prefix ../dp-shared run build",

22 "test": "vitest run",

23 "test:watch": "vitest",

24 "postinstall": "node scripts/install-cloakbrowser.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

25 "prepublishOnly": "npm run build"

26 },

27 "keywords": [

28 "agent",

29 "browser-automation",

30 "playwright",

31 "llm",

32 "telegram",

33 "chrome",

34 "automation"

35 ],

36 "author": "",

37 "license": "MIT",

38 "repository": {

39 "type": "git",

40 "url": "git+https://github.com/dipcoinlab/dipclaw.git"

41 },

42 "homepage": "https://github.com/dipcoinlab/dipclaw",

43 "engines": {

44 "node": ">=18"

dist/browser/dom-helpers.jsView file

Lines 388-428javascript

388 return JSON.stringify(cards, null, 2);

389}

390/**

391 * Quick syntactic sanity check for `evaluate` scripts. We compile via

392 * `new Function` which throws on parse error without ever executing the

393 * code. Catches the most common LLM syntax slips (missing parens, stray

394 * commas, illegal identifiers) before a round-trip to the page.

395 */

396export

dist/agent/tool-loop-detection.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2// --- Thresholds ---

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/agent/tool-loop-detection.jsView on unpkg · L1

3const MAX_HISTORY = 30;

4const GENERIC_REPEAT_WARN = 3;

5const