registry / netcontrol-agent / 1.1.1

netcontrol-agent@1.1.1

A Node agent that collects system metrics like CPU, RAM, disk, network usage, and uptime to a remote server.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 46.5 KB of source, external domains: 192.168.1.100, github.com

Source & flagged code

8 flagged

netcontrol-agent.jsView file

Lines 1-66javascript

1#!/usr/bin/env node

2/**

3 * netcontrol-agent.js v4.0 — Hybrid self-installing agent

4 *

5 * USAGE:

6 * Run manually:

7 * NC_SERVER_URL=http://server:4000 node netcontrol-agent.js

8 *

9 * Install as a permanent service (runs on boot, auto-restarts):

10 * Linux: sudo NC_SERVER_URL=http://server:4000 node netcontrol-agent.js --install

11 * Windows: (run PowerShell as Administrator)

12 * $env:NC_SERVER_URL="http://server:4000"; node netcontrol-agent.js --install

High

Shell

Package source references shell execution.

netcontrol-agent.jsView on unpkg · L10

13 *

14 * Uninstall service:

15 * Linux: sudo node netcontrol-agent.js --uninstall

16 * Windows: node netcontrol-agent.js --uninstall (as Administrator)

17 *

18 * Self-test (used internally by the self-update path — see checkForUpdate()

19 * below — to verify a newly-downloaded build actually boots before it's

20 * promoted to the running service; safe to run manually too):

21 * node netcontrol-agent.js --self-test

22 * Exits 0 if the build can load its dependencies, read the existing

23 * credentials file (if any), and reach NC_SERVER_URL. Exits 1 otherwise.

24 * Does NOT register, run the metrics loop, or touch the installed

25 * service/scheduled task.

26 *

27 * ENV VARS:

28 * NC_SERVER_URL — required: http(s)://host:port of your NetControl server

29 * NC_REG_SECRET — required for first-time registration: must match the

30 * server's AGENT_REGISTRATION_SECRET (see backend .env).

31 * Not needed on subsequent runs once credentials are

32 * cached, unless the agent has to re-register (e.g. the

33 * credentials file was deleted or the key was rejected).

34 * NC_INTERVAL — metrics push interval seconds (default 5, min 3)

35 * NC_CRED_FILE — override credential storage path

36 * NC_AUTO_UPDATE — set to "true" to let the agent replace itself with a

37 * newer build the server advertises (checksum-verified,

38 * off by default). See checkForUpdate() below.

39 */

40'use strict';

42const os = require('os');

43const fs = require('fs');

44const path = require('path');

45const http = require('http');

46const https = require('https');

47const { execSync, spawnSync, spawn } = require('child_process');

48const crypto = require('crypto');

High

Child Process

Package source references child process execution.

netcontrol-agent.jsView on unpkg · L46

50// ── Config ─────────────────────────────────────────────────────────────────────

51const SERVER_URL = (process.env.NC_SERVER_URL || '').replace(/\/$/, '');

52const REG_SECRET = process.env.NC_REG_SECRET || '';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

netcontrol-agent.jsView on unpkg · L44

53const INTERVAL_SEC = Math.max(3, parseInt(process.env.NC_INTERVAL || '5', 10));

54const IS_WINDOWS = os.platform() === 'win32';

55const AGENT_PATH = path.resolve(process.argv[1]);

56// AUTO_UPDATE: opt-in (default off) — when the server reports a newer

57// version (see checkForUpdate() below), the agent downloads the new

58// netcontrol-agent.js from the server, verifies it against the sha256 the

59// server also reports, and atomically replaces itself before triggering a

60// restart through whichever service manager installed it. Off by default

61// because self-modifying a running production agent is exactly the kind of

62// thing an operator should consciously opt into per-fleet, not something

63// that silently turns on.

64const AUTO_UPDATE = /^(1|true|yes)$/i.test(process.env.NC_AUTO_UPDATE || '');

65let AGENT_VERSION = '0.0.0';

66try { AGENT_VERSION = require('./package.json').version || '0.0.0'; } catch { /* package.json not alongside the script — version reporting just says 0.0.0 */ }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

netcontrol-agent.jsView on unpkg · L6

Lines 233-273javascript

233 }

234 } else {

235 try {

236 execSync('systemctl stop netcontrol-agent 2>/dev/null || true');

237 execSync('systemctl disable netcontrol-agent 2>/dev/null || true');

238 try { fs.unlinkSync('/etc/systemd/system/netcontrol-agent.service'); }

netcontrol-agent-1.0.0.tgzView file

•path = netcontrol-agent-1.0.0.tgz kind = high_entropy_blob sizeBytes = 8618 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

netcontrol-agent-1.0.0.tgzView on unpkg

•path = netcontrol-agent-1.0.0.tgz kind = compressed_blob sizeBytes = 8618 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

netcontrol-agent-1.0.0.tgzView on unpkg

•path = netcontrol-agent-1.0.0.tgz kind = nested_archive_needs_inspection sizeBytes = 8618 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

netcontrol-agent-1.0.0.tgzView on unpkg

Source & flagged code

8 flagged · loading source

netcontrol-agent.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code