registry / nexus-agents / 2.165.0

nexus-agents@2.165.0

⚠ Under review

Governance substrate for AI coding agents — adversarial PR review, drift-detected rules, tamper-evident audit, and closed-loop outcome routing for Claude, Codex, Gemini, and OpenCode

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 80 file(s), 6.19 MB of source, external domains: aistudio.google.com, api.github.com, api.openalex.org, api.osv.dev, api.semanticscholar.org, arxiv.org, bsky.app, bsky.social, cdimage.debian.org, console.anthropic.com, developers.openai.com, docs.bsky.app, download.fedoraproject.org, export.arxiv.org, fedoraproject.org, github.com, help.ubuntu.com, img.shields.io, nodejs.org, opencode.ai, paperswithcode.com, platform.openai.com, registry.npmjs.org, releases.ubuntu.com, www.debian.org, www.githubstatus.com, www.w3.org

Source & flagged code

12 flagged

package.jsonView file

Lines 107-129json

107 },

108 "@ai-sdk/openai": {

109 "optional": true

110 },

111 "@ai-sdk/google": {

112 "optional": true

113 }

114 },

115 "scripts": {

116 "build": "tsup",

117 "dev": "tsup --watch",

118 "test": "vitest run",

119 "test:e2e": "vitest run --config vitest.config.e2e.ts",

120 "test:coverage": "vitest run --coverage",

121 "lint": "eslint src/",

122 "lint:fix": "eslint src/ --fix",

123 "typecheck": "tsc --noEmit",

124 "docs": "typedoc",

125 "docs:watch": "typedoc --watch",

126 "docs:api:md": "typedoc --options typedoc.markdown.json",

127 "postinstall": "node scripts/postinstall.js || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L127

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L127

128 }

129}

dist/chunk-ZM4O442V.jsView file

Lines 672-712javascript

672 " - Use cryptographically secure RNG (crypto.randomBytes, /dev/urandom)",

673 " - Minimum entropy: API keys 256-bit, passwords 128-bit",

674 " - Generate secrets in secure environment, not dev machines",

675 "STORAGE:",

676 " - Secrets manager (Vault, AWS Secrets Manager, GCP Secret Manager)",

677 " - Encrypted at rest with managed keys (AES-256-GCM)",

dist/chunk-PKSBCVNJ.jsView file

1567).optional(), L1568: metadata: z4.record(z4.string(), z4.unknown()).optional() L1569: }), ... L7626: const fenced = extractCodeBlock(rawText); L7627: const parsed = JSON.parse(fenced?.[1] ?? rawText); L7628: const subtasks = parsed.map((item) => SubTaskSchema.safeParse(item)).filter((r) => r.success).map((r) => r.data); ... L7857: // -------------------------------------------------------------------------- L7858: // Private Methods L7859: // -------------------------------------------------------------------------- ... L8455: - Rule of Two: no agent may simultaneously process untrusted input + have write access + access secrets L8456: - Subprocess timeouts: always pass { timeout: N } to exec()/execAsync() calls L8457:

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-PKSBCVNJ.jsView on unpkg · L1567

1567Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-PKSBCVNJ.js L1567: ).optional(), L1568: metadata: z4.record(z4.string(), z4.unknown()).optional() L1569: }), ... L7626: const fenced = extractCodeBlock(rawText); L7627: const parsed = JSON.parse(fenced?.[1] ?? rawText); L7628: const subtasks = parsed.map((item) => SubTaskSchema.safeParse(item)).filter((r) => r.success).map((r) => r.data); ... L7857: // -------------------------------------------------------------------------- L7858: // Private Methods L7859: // -------------------------------------------------------------------------- ... L8455: - Rule of Two: no agent may simultaneously process untrusted input + have write access + access secrets L8456: - Subprocess timeouts: always pass { timeout: N } to exec()/execAsy

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-PKSBCVNJ.jsView on unpkg · L1567

dist/cli.jsView file

19143patternName = aws_access_key severity = critical line = 19143 matchedText = code: 'c...";',

Critical

Secret Pattern

AWS access key ID in dist/cli.js

dist/cli.jsView on unpkg · L19143

408const apiKeysConfigured = API_KEY_VARS.filter( L409: (key) => typeof process.env[key] === "string" && process.env[key] !== "" L410: ).length; ... L413: nodeVersion: process.version, L414: platform: process.platform, L415: arch: process.arch, ... L421: const write3 = (text) => { L422: process.stdout.write(text + "\n"); L423: }; ... L447: write3( L448: `${colors.dim}Documentation: https://github.com/nexus-substrate/nexus-agents${colors.reset}` L449: );

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L408

dist/chunk-LKSG75LC.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = nexus-agents@2.151.0 matchedIdentity = npm:bmV4dXMtYWdlbnRz:2.151.0 similarity = 0.863 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-LKSG75LC.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code