registry / osai-agent / 4.2.80

osai-agent@4.2.80

OS AI Agent - YOUR AI AGENT

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 89 file(s), 717 KB of source, external domains: agent.osai.dev, api.anthropic.com, api.cerebras.ai, api.cohere.ai, api.deepinfra.com, api.deepseek.com, api.fireworks.ai, api.groq.com, api.hyperbolic.xyz, api.lingyiwanwu.com, api.mistral.ai, api.moonshot.ai, api.novita.ai, api.openai.com, api.perplexity.ai, api.siliconflow.cn, api.studio.nebius.ai, api.together.ai, api.x.ai, codestral.mistral.ai, dashscope.aliyuncs.com, generativelanguage.googleapis.com, html.duckduckgo.com, integrate.api.nvidia.com, models.github.ai, ollama.com, open.bigmodel.cn, openrouter.ai, osaix.vercel.app, qianfan.baidubce.com, registry.npmjs.org, router.huggingface.co

Source & flagged code

6 flagged

src/services/ssh.jsView file

Lines 1-42javascript

1// SSH connection manager

2import { Client } from 'ssh2';

3import { DEFAULTS } from '../utils/constants.js';

4import { logger } from '../utils/logger.js';

6/**

7 * Validate SSH private key format before connection

8 */

9const validateSshPrivateKey = (privateKey) => {

10 if (!privateKey || typeof privateKey !== 'string') {

11 throw new Error('Invalid SSH private key: missing or not a string');

12 }

14 const trimmedKey = privateKey.trim();

16 // Check for common SSH private key headers

17 const validKeyPatterns = [

18 /^-----BEGIN ([A-Z ]+) PRIVATE KEY-----/,

19 /^-----BEGIN OPENSSH PRIVATE KEY-----/,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/services/ssh.jsView on unpkg · L19

Critical

Secret Pattern

OpenSSH private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L19

20 /^-----BEGIN RSA PRIVATE KEY-----/,

Critical

Secret Pattern

RSA private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L20

21 /^-----BEGIN DSA PRIVATE KEY-----/,

22 /^-----BEGIN EC PRIVATE KEY-----/,

Critical

Secret Pattern

EC private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L22

23 /^-----BEGIN ED25519 PRIVATE KEY-----/,

24 /^-----BEGIN ENCRYPTED PRIVATE KEY-----/,

25 ];

27 const isValidFormat = validKeyPatterns.some(pattern => pattern.test(trimmedKey));

29 if (!isValidFormat) {

30 throw new Error('Invalid SSH private key format: must be a valid PEM-formatted private key');

31 }

33 // Check for key footer

34 if (!trimmedKey.includes('-----END')) {

35 throw new Error('Invalid SSH private key: missing END marker');

36 }

38 // Basic length check

39 if (trimmedKey.length < 100) {

40 throw new Error('Invalid SSH private key: too short to be valid');

41 }

src/ui/components/ConfirmationDialog.jsView file

Lines 21-45javascript

21 setValue(v => v + input);

22 }

23 });

25 const isDangerous = details?.isDangerous || details?.tier === 'DANGEROUS';

26 const tool

src/agent/loop/tool-executor.jsView file

Lines 223-263javascript

223

224 // PLAN mode: block any write or dangerous operation

225 if (this.executionMode === EXECUTION_MODES.PLAN) {

226 const planSafety = checkSafety(toolCall, this.mode);

227 if (planSafety.tier !== SAFETY_TIERS

Source & flagged code

6 flagged · loading source

src/services/ssh.jsView file

19patternName = private_key_openssh severity = critical line = 19 matchedText = /^-----B...--/,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/services/ssh.jsView on unpkg · L19

19patternName = private_key_openssh severity = critical line = 19 matchedText = /^-----B...--/,

Critical

Secret Pattern

OpenSSH private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L19

20patternName = private_key_rsa severity = critical line = 20 matchedText = /^-----B...--/,

Critical

Secret Pattern

RSA private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L20

22patternName = private_key_ec severity = critical line = 22 matchedText = /^-----B...--/,

Critical

Secret Pattern

EC private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L22

src/ui/components/ConfirmationDialog.jsView file

41patternName = generic_password severity = medium line = 41 matchedText = h(Text, ...')),

Medium

Secret Pattern

Hardcoded password in src/ui/components/ConfirmationDialog.js

src/ui/components/ConfirmationDialog.jsView on unpkg · L41

src/agent/loop/tool-executor.jsView file

243patternName = generic_password severity = medium line = 243 matchedText = this.rea...)));

Medium

Secret Pattern

Hardcoded password in src/agent/loop/tool-executor.js

src/agent/loop/tool-executor.jsView on unpkg · L243

Findings

4 Critical4 Medium5 Low

CriticalCritical Secretsrc/services/ssh.js

CriticalSecret Patternsrc/services/ssh.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patternsrc/ui/components/ConfirmationDialog.js

MediumSecret Patternsrc/agent/loop/tool-executor.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

src/services/ssh.jsView file

Lines 1-42javascript

1// SSH connection manager

2import { Client } from 'ssh2';

3import { DEFAULTS } from '../utils/constants.js';

4import { logger } from '../utils/logger.js';

6/**

7 * Validate SSH private key format before connection

8 */

9const validateSshPrivateKey = (privateKey) => {

10 if (!privateKey || typeof privateKey !== 'string') {

11 throw new Error('Invalid SSH private key: missing or not a string');

12 }

14 const trimmedKey = privateKey.trim();

16 // Check for common SSH private key headers

17 const validKeyPatterns = [

18 /^-----BEGIN ([A-Z ]+) PRIVATE KEY-----/,

19 /^-----BEGIN OPENSSH PRIVATE KEY-----/,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/services/ssh.jsView on unpkg · L19

Critical

Secret Pattern

OpenSSH private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L19

20 /^-----BEGIN RSA PRIVATE KEY-----/,

Critical

Secret Pattern

RSA private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L20

21 /^-----BEGIN DSA PRIVATE KEY-----/,

22 /^-----BEGIN EC PRIVATE KEY-----/,

Critical

Secret Pattern

EC private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L22

23 /^-----BEGIN ED25519 PRIVATE KEY-----/,

24 /^-----BEGIN ENCRYPTED PRIVATE KEY-----/,

25 ];

27 const isValidFormat = validKeyPatterns.some(pattern => pattern.test(trimmedKey));

29 if (!isValidFormat) {

30 throw new Error('Invalid SSH private key format: must be a valid PEM-formatted private key');

31 }

33 // Check for key footer

34 if (!trimmedKey.includes('-----END')) {

35 throw new Error('Invalid SSH private key: missing END marker');

36 }

38 // Basic length check

39 if (trimmedKey.length < 100) {

40 throw new Error('Invalid SSH private key: too short to be valid');

41 }

src/ui/components/ConfirmationDialog.jsView file

Lines 21-45javascript

21 setValue(v => v + input);

22 }

23 });

25 const isDangerous = details?.isDangerous || details?.tier === 'DANGEROUS';

26 const tool

src/agent/loop/tool-executor.jsView file

Lines 223-263javascript

223

224 // PLAN mode: block any write or dangerous operation

225 if (this.executionMode === EXECUTION_MODES.PLAN) {

226 const planSafety = checkSafety(toolCall, this.mode);

227 if (planSafety.tier !== SAFETY_TIERS