registry / machinaos / 0.0.93

machinaos@0.0.93

Open source workflow automation platform with AI agents, React Flow, and n8n-inspired architecture

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 21 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 217 file(s), 3.58 MB of source, external domains: docs.astral.sh, docs.zeenie.xyz, example.com, github.com, json-schema.org, maps.googleapis.com, python.org, radix-ui.com, react.dev, reactflow.dev, whatsapp.com, www.w3.org

Source & flagged code

11 flagged

package.jsonView file

Lines 72-113json

72 "temporal:start": "temporal api",

73 "temporal:stop": "temporal stop",

74 "temporal:status": "temporal status",

75 "temporal:worker": "cd server && uv run python -m services.temporal.worker",

76 "build": "python -m cli build",

77 "clean": "python -m cli clean",

78 "stop": "python -m cli stop",

79 "test": "npm run test:backend && npm run test:frontend",

80 "test:backend": "cd server && uv run pytest tests/ -v",

81 "test:frontend": "cd client && npm run test",

82 "test:nodes": "cd server && uv run pytest tests/nodes/ -v --cov=services.handlers --cov-report=term-missing",

83 "docs:nodes": "python -m cli docs nodes",

84 "docs:nodes:check": "python -m cli docs nodes --check",

85 "deploy": "python -m cli deploy",

86 "daemon:start": "python -m cli daemon start",

87 "daemon:stop": "python -m cli daemon stop",

88 "daemon:status": "python -m cli daemon status",

89 "daemon:restart": "python -m cli daemon restart",

90 "version:sync": "python -m cli version sync",

91 "prepublishOnly": "python -m cli version sync && node -e \"const p=require('./package.json'); if(!p.bin||!p.version){process.exit(1)}\"",

92 "preinstall": "node scripts/preinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L92

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L92

93 "postinstall": "node scripts/postinstall.js",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L93

94 "preuninstall": "node scripts/preinstall.js"

95 },

96 "dependencies": {

97 "@react-three/drei": "^10.7.7",

98 "@react-three/fiber": "^9.6.1",

99 "@types/three": "^0.184.1",

100 "cross-env": "^7.0.3",

101 "framer-motion": "^12.40.0",

102 "lucide-react": "^1.14.0",

103 "three": "^0.184.0"

104 },

105 "pnpm": {

106 "peerDependencyRules": {

107 "allowedVersions": {

108 "@emoji-mart/react>react": "19",

109 "react-avatar-editor>react": "19",

110 "react-avatar-editor>react-dom": "19"

111 }

112 },

113 "overrides": {

bin/cli.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { spawn, execSync } from 'child_process';

4import { dirname, resolve } from 'path';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

5import { fileURLToPath } from 'url';

6import { readFileSync, existsSync } from

server/nodejs/dist/index.jsView file

Lines 1-23javascript

1// src/index.ts

2import express from "express";

3import vm from "node:vm";

4import { execFileSync } from "node:child_process";

5import path from "node:path";

6import { fileURLToPath } from "node:url"

install.shView file

•path = install.sh kind = build_helper sizeBytes = 8744 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

client/dist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View file

•path = client/dist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2 kind = high_entropy_blob sizeBytes = 15308 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

client/dist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View on unpkg

server/tests/test_workflow_ops.pyView file

•path = server/tests/test_workflow_ops.py kind = payload_in_excluded_dir sizeBytes = 6845 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

server/tests/test_workflow_ops.pyView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/preinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node scripts/preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cli.jsView file

2L3: import { spawn, execSync } from 'child_process'; L4: import { dirname, resolve } from 'path';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

111execSync('npx envinfo --system --binaries --npmPackages edgymeow,agent-browser,cross-env', { L112: cwd: ROOT, stdio: 'inherit', shell: true, L113: });

High

Shell

Package source references shell execution.

bin/cli.jsView on unpkg · L111

2L3: import { spawn, execSync } from 'child_process'; L4: import { dirname, resolve } from 'path'; ... L8: const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..'); L9: const PKG = JSON.parse(readFileSync(resolve(ROOT, 'package.json'), 'utf-8')); L10: ... L42: machina build # Build for production L43: Documentation: https://docs.zeenie.xyz/ L44: `); ... L56: function expandPath() { L57: const home = process.env.HOME || process.env.USERPROFILE; L58: if (home) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/cli.jsView on unpkg · L2

110try { L111: execSync('npx envinfo --system --binaries --npmPackages edgymeow,agent-browser,cross-env', { L112: cwd: ROOT, stdio: 'inherit', shell: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L110

server/nodejs/dist/index.jsView file

3import vm from "node:vm"; L4: import { execFileSync } from "node:child_process"; L5: import path from "node:path"; L6: import { fileURLToPath } from "node:url"; L7: var __dirname = path.dirname(fileURLToPath(import.meta.url)); L8: var PORT = parseInt(process.env.NODEJS_EXECUTOR_PORT ?? "", 10) || 3020; L9: var HOST = process.env.NODEJS_EXECUTOR_HOST ?? "localhost"; ... L12: var app = express(); L13: app.use(express.json({ limit: BODY_LIMIT })); L14: app.get("/health", (_req, res) => { ... L20: }); L21: app.post("/execute", (req, res) => {

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

server/nodejs/dist/index.jsView on unpkg · L3

install.shView file

•path = install.sh kind = build_helper sizeBytes = 8744 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

client/dist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View file

•path = client/dist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2 kind = high_entropy_blob sizeBytes = 15308 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

client/dist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View on unpkg

server/tests/test_workflow_ops.pyView file

•path = server/tests/test_workflow_ops.py kind = payload_in_excluded_dir sizeBytes = 6845 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

server/tests/test_workflow_ops.pyView on unpkg

Findings

7 High8 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/cli.js

HighShellbin/cli.js

HighSandbox Evasion Gated Capabilitybin/cli.js

HighRuntime Package Installbin/cli.js

HighShips High Entropy Blobclient/dist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2

HighPayload In Excluded Dirserver/tests/test_workflow_ops.py

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumUnsafe Vm Contextserver/nodejs/dist/index.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Build Helperinstall.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

11 flagged

package.jsonView file

Lines 72-113json

72 "temporal:start": "temporal api",

73 "temporal:stop": "temporal stop",

74 "temporal:status": "temporal status",

75 "temporal:worker": "cd server && uv run python -m services.temporal.worker",

76 "build": "python -m cli build",

77 "clean": "python -m cli clean",

78 "stop": "python -m cli stop",

79 "test": "npm run test:backend && npm run test:frontend",

80 "test:backend": "cd server && uv run pytest tests/ -v",

81 "test:frontend": "cd client && npm run test",

82 "test:nodes": "cd server && uv run pytest tests/nodes/ -v --cov=services.handlers --cov-report=term-missing",

83 "docs:nodes": "python -m cli docs nodes",

84 "docs:nodes:check": "python -m cli docs nodes --check",

85 "deploy": "python -m cli deploy",

86 "daemon:start": "python -m cli daemon start",

87 "daemon:stop": "python -m cli daemon stop",

88 "daemon:status": "python -m cli daemon status",

89 "daemon:restart": "python -m cli daemon restart",

90 "version:sync": "python -m cli version sync",

91 "prepublishOnly": "python -m cli version sync && node -e \"const p=require('./package.json'); if(!p.bin||!p.version){process.exit(1)}\"",

92 "preinstall": "node scripts/preinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L92

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L92

93 "postinstall": "node scripts/postinstall.js",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L93

94 "preuninstall": "node scripts/preinstall.js"

95 },

96 "dependencies": {

97 "@react-three/drei": "^10.7.7",

98 "@react-three/fiber": "^9.6.1",

99 "@types/three": "^0.184.1",

100 "cross-env": "^7.0.3",

101 "framer-motion": "^12.40.0",

102 "lucide-react": "^1.14.0",

103 "three": "^0.184.0"

104 },

105 "pnpm": {

106 "peerDependencyRules": {

107 "allowedVersions": {

108 "@emoji-mart/react>react": "19",

109 "react-avatar-editor>react": "19",

110 "react-avatar-editor>react-dom": "19"

111 }

112 },

113 "overrides": {

bin/cli.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { spawn, execSync } from 'child_process';

4import { dirname, resolve } from 'path';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

5import { fileURLToPath } from 'url';

6import { readFileSync, existsSync } from

server/nodejs/dist/index.jsView file

Lines 1-23javascript

1// src/index.ts

2import express from "express";

3import vm from "node:vm";

4import { execFileSync } from "node:child_process";

5import path from "node:path";

6import { fileURLToPath } from "node:url"

install.shView file

•path = install.sh kind = build_helper sizeBytes = 8744 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

client/dist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View file

•path = client/dist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2 kind = high_entropy_blob sizeBytes = 15308 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

client/dist/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View on unpkg

server/tests/test_workflow_ops.pyView file

•path = server/tests/test_workflow_ops.py kind = payload_in_excluded_dir sizeBytes = 6845 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

server/tests/test_workflow_ops.pyView on unpkg