registry / factory-ai / 1.6.0

factory-ai@1.6.0

Deploy a private autonomous coding-agent factory on Azure: isolated builders, testers, security reviewers, durable orchestration, multi-model routing, memory, cost controls, and gated GitHub pull requests.

AI Security Review

scanned 47m ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

Explicit `factory` deployment/workspace commands or installed package-owned systemd services

Impact

A trusted operator can authorize autonomous coding-agent actions and runtime persistence on the deployment VM; this is a meaningful dual-use capability, not a confirmed malicious chain.

Mechanism

Operator-controlled Azure deployment, workspace templating, and credentialed agent-container execution

Rationale

Source inspection finds no concrete malicious behavior, but the package deliberately provides high-impact autonomous-agent deployment and execution capabilities. Flag as a warning for dangerous dual-use operation rather than block as malware.

Evidence

package.jsonbin/factorysrc/container-runner.jssrc/project-init.jssrc/workspace-catalog.jssrc/extension-manifest.jssrc/updater.jsbootstrap/setup.shbootstrap/auto-update.sh

Network endpoints4

registry.npmjs.org/factory-ai/latestapi.telegram.org/bot${token}/${method}management.azure.com${scope}/providers/Microsoft.CostManagement/query?api-version=2025-03-01api.ipify.org

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`bin/factory` explicitly invokes remote Azure VM commands and deployment actions.
`src/container-runner.js` starts task containers and passes configured cloud-model credentials via stdin.
`src/project-init.js` writes `AGENTS.md` and `.agent-factory/` only during explicit workspace import/init.
`bootstrap/setup.sh` installs package-owned systemd services when explicitly run as deployment bootstrap.

Evidence against

`package.json` has no preinstall, install, postinstall, prepare, or uninstall lifecycle hook.
No import-time entrypoint performs installation, persistence, or network activity without a CLI/service trigger.
`src/project-init.js` restricts template writes to the chosen project and rejects symlink traversal.
`src/extension-manifest.js` requires signed artifacts and explicit HTTPS destinations.
`bootstrap/auto-update.sh` checks matching git commit, release state, CI, provenance, tests, audit, Bicep, shell syntax, and secret scanning before deployment.
No source evidence of credential harvesting or exfiltration to an attacker-controlled endpoint.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 59 file(s), 198 KB of source, external domains: 127.0.0.1, api.ipify.org, api.telegram.org, github.com, management.azure.com, registry.npmjs.org

Source & flagged code

2 flagged

src/workspace-catalog.jsView file

Lines 45-85javascript

45 try { return await operation(); } finally { await rm(lock, { recursive: true, force: true }); }

46 } catch (error) {

47 if (error.code !== "EEXIST") throw error;

48 const metadata = await stat(lock).catch(() => null);

49 if (metadata && Date.now() - metadata.mtimeMs > 900_000) { await rm(lock, { recursive: true, force: true }); continue; }

50 await new Promise((resolve) => setTimeout(resolve, 25));

51 }

52 }

53 throw new Error("Timed out acquiring workspace catalog lock");

54 }

56 async list() { return (await this.load()).sort((left, right) => left.name.localeCompare(right.name)); }

58 async resolve(reference) {

59 const workspaces = await this.load();

60 const workspace = workspaces.find((item) => item.name === reference || item.repository === reference);

61 if (workspace) return workspace;

62 if (repositoryPattern.test(reference)) return { name: reference.split("/").at(-1), repository: reference, url: `https://github.com/${reference}.git`, baseBranch: "main" };

63 throw new Error(`Unknown workspace: ${reference}. Run factory workspace list or import.`);

64 }

66 async import(source, options = {}) { return this.withLock(() => this.importUnlocked(source, options)); }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/workspace-catalog.jsView on unpkg · L65

68 async importUnlocked(source, { name } = {}) {

69 let localPath;

70 let repository;

71 if (repositoryPattern.test(source)) {

72 repository = source;

73 await mkdir(this.root, { recursive: true, mode: 0o700 });

74 localPath = path.join(this.root, source.replace("/", "--"));

75 if (!(await exists(localPath))) await this.execute("gh", ["repo", "clone", source, localPath], { timeoutMs: 600_000 });

76 const remote = await this.execute("git", ["-C", localPath, "remote", "get-url", "origin"]);

77 if (repositoryFromRemote(remote.stdout) !== repository) throw new Error("Managed workspace origin does not match requested repository");

78 } else {

79 localPath = await realpath(path.resolve(source));

80 const metadata = await stat(localPath);

81 if (!metadata.isDirectory()) throw new Error("Workspace source must be a directory or owner/repo");

82 const remote = await this.execute("git", ["-C", localPath, "remote", "get-url", "origin"]);

83 repository = repositoryFromRemote(remote.stdout);

84 }

85 const defaultResult = await this.execute("git", ["-C", localPath, "symbolic-ref", "--short", "refs/remotes/origin/HEAD"], { allowExitCodes: [0, 1] });

bootstrap/setup.shView file

•path = bootstrap/setup.sh kind = build_helper sizeBytes = 11100 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bootstrap/setup.shView on unpkg

Source & flagged code

2 flagged · loading source

src/workspace-catalog.jsView file

65L66: async import(source, options = {}) { return this.withLock(() => this.importUnlocked(source, options)); } L67:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/workspace-catalog.jsView on unpkg · L65

bootstrap/setup.shView file

•path = bootstrap/setup.sh kind = build_helper sizeBytes = 11100 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bootstrap/setup.shView on unpkg

Findings

5 Medium4 Low

MediumDynamic Requiresrc/workspace-catalog.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbootstrap/setup.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

88%Warn

Verdict confidence

IntentDangerous Capability

TypeAI-agent capability abuse

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only AI-agent capability risk

Package metadata

npm

AuthorVedant Kumar

Maintainersitsvedantkumar

Version1.6.0

PublishedJul 13, 2026

LicenseMIT

Dependencies12

Integrityverified

Package size96.2 KB

Files120

Keywordsai-agentscoding-agentmulti-agentazurebedrockmcpautomationdevtools

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsbin → agent-factory-ceo, agent-factory-control, agent-factory-dashboard +8

Runtimenode >=22 <23

Artifact324 KB · 120 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: check, lint, test

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

2 flagged

src/workspace-catalog.jsView file

Lines 45-85javascript

45 try { return await operation(); } finally { await rm(lock, { recursive: true, force: true }); }

46 } catch (error) {

47 if (error.code !== "EEXIST") throw error;

48 const metadata = await stat(lock).catch(() => null);

49 if (metadata && Date.now() - metadata.mtimeMs > 900_000) { await rm(lock, { recursive: true, force: true }); continue; }

50 await new Promise((resolve) => setTimeout(resolve, 25));

51 }

52 }

53 throw new Error("Timed out acquiring workspace catalog lock");

54 }

56 async list() { return (await this.load()).sort((left, right) => left.name.localeCompare(right.name)); }

58 async resolve(reference) {

59 const workspaces = await this.load();

60 const workspace = workspaces.find((item) => item.name === reference || item.repository === reference);

61 if (workspace) return workspace;

62 if (repositoryPattern.test(reference)) return { name: reference.split("/").at(-1), repository: reference, url: `https://github.com/${reference}.git`, baseBranch: "main" };

63 throw new Error(`Unknown workspace: ${reference}. Run factory workspace list or import.`);

64 }

66 async import(source, options = {}) { return this.withLock(() => this.importUnlocked(source, options)); }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/workspace-catalog.jsView on unpkg · L65

68 async importUnlocked(source, { name } = {}) {

69 let localPath;

70 let repository;

71 if (repositoryPattern.test(source)) {

72 repository = source;

73 await mkdir(this.root, { recursive: true, mode: 0o700 });

74 localPath = path.join(this.root, source.replace("/", "--"));

75 if (!(await exists(localPath))) await this.execute("gh", ["repo", "clone", source, localPath], { timeoutMs: 600_000 });

76 const remote = await this.execute("git", ["-C", localPath, "remote", "get-url", "origin"]);

77 if (repositoryFromRemote(remote.stdout) !== repository) throw new Error("Managed workspace origin does not match requested repository");

78 } else {

79 localPath = await realpath(path.resolve(source));

80 const metadata = await stat(localPath);

81 if (!metadata.isDirectory()) throw new Error("Workspace source must be a directory or owner/repo");

82 const remote = await this.execute("git", ["-C", localPath, "remote", "get-url", "origin"]);

83 repository = repositoryFromRemote(remote.stdout);

84 }

85 const defaultResult = await this.execute("git", ["-C", localPath, "symbolic-ref", "--short", "refs/remotes/origin/HEAD"], { allowExitCodes: [0, 1] });

bootstrap/setup.shView file

•path = bootstrap/setup.sh kind = build_helper sizeBytes = 11100 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bootstrap/setup.shView on unpkg