registry / mtech-ai-local-runner / 0.1.33
mtech-ai-local-runner@0.1.33
⚠ Under reviewThe upstream source package is `0.1.31`; P0 does not bump or publish a version. Deploy a compatible Gateway receiver before upgrading any runner. Publication, installation, restart, flag activation and live acceptance require their own delivery gates; thi
Static Scan Results
scanned 15d ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flaggeddist/src/adapters/codex/pre-model-gate.jsView file
29reasonCodes.push(code); };
L30: require(actual.model === expected.model && actual.provider === expected.provider && actual.cwd === expected.cwd, 'RUNTIME_IDENTITY_MISMATCH');
L31: require(actual.configFingerprint === expected.configFingerprint, 'CONFIG_FINGERPRINT_MISMATCH');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/src/adapters/codex/pre-model-gate.jsView on unpkg · L29dist/src/publication/git-snapshot.jsView file
1import { execFile, spawn } from 'node:child_process';
L2: import { promisify } from 'node:util';
...
L25: throw denied();
L26: return result.stdout;
L27: }
...
L58: } });
L59: child.stdin.end(unique.join('\n') + '\n');
L60: });
...
L75: const bytes = output.subarray(end + 1, end + 1 + size), type = header[2];
L76: if (createHash('sha1').update(Buffer.concat([Buffer.from(`${type} ${size}\0`), bytes])).digest('hex') !== id)
L77: throw denied();
...
L201: await sealed.assertUnchanged();
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/src/publication/git-snapshot.jsFindings
1 High5 Medium6 Low
HighSemantic Analysis Limiteddist/src/state-store.js
MediumDynamic Requiredist/src/adapters/codex/pre-model-gate.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarynative/bin/codex-observe-darwin-arm64
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/src/publication/git-snapshot.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to mtech-ai-local-runner@0.1.33.
See all versions of mtech-ai-local-runner for other recorded verdicts.
- Review the evidence and your use of mtech-ai-local-runner@0.1.33 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.