registry / quay-ai-factory / 0.6.0

quay-ai-factory@0.6.0

Quay — Autonomous AI Software Factory. Self-hosted AI agents, MCP integration, customizable pipelines, real-time Mission Control dashboard, cost transparency, and full audit trails.

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 52 file(s), 275 KB of source, external domains: api.anthropic.com, api.cerebras.ai, api.groq.com, api.openai.com, api.together.xyz, generativelanguage.googleapis.com, github.com, openrouter.ai

Source & flagged code

3 flagged

src/lib/memory.tsView file

Lines 437-473typescript

437 /**

438 * Clear all memories for an agent

439 */

440 clear(agentId: string): void {

441 this.memories.delete(agentId);

442 this.trajectories.delete(agentId);

443 }

444

445 /**

446 * Export memories as JSON

447 */

448 export(agentId: string): { memories: MemoryBlock[]; trajectories: Trajectory[] } {

449 return {

450 memories: this.getMemories(agentId),

451 trajectories: this.getTrajectories(agentId),

452 };

453 }

454

455 /**

456 * Import memories from JSON

457 */

458 import(agentId: string, data: { memories?: MemoryBlock[]; trajectories?: Trajectory[] }): void {

459 if (data.memories) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/lib/memory.tsView on unpkg · L457

460 this.memories.set(agentId, data.memories);

461 }

462 if (data.trajectories) {

463 this.trajectories.set(agentId, data.trajectories);

464 }

465 }

466}

467

468// ============================================================

469// Convenience export

470// ============================================================

471

472export const persistentMemory = new PersistentMemory();

473

scripts/test-quay.shView file

•path = scripts/test-quay.sh kind = build_helper sizeBytes = 27475 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/test-quay.shView on unpkg

src/server/agents/agentRunner.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = quay-ai-factory@0.5.0 matchedIdentity = npm:cXVheS1haS1mYWN0b3J5:0.5.0 similarity = 0.980 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/server/agents/agentRunner.tsView on unpkg

Source & flagged code

3 flagged · loading source

src/lib/memory.tsView file

457*/ L458: import(agentId: string, data: { memories?: MemoryBlock[]; trajectories?: Trajectory[] }): void { L459: if (data.memories) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/lib/memory.tsView on unpkg · L457

scripts/test-quay.shView file

•path = scripts/test-quay.sh kind = build_helper sizeBytes = 27475 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/test-quay.shView on unpkg

src/server/agents/agentRunner.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/server/agents/agentRunner.tsView on unpkg

Findings

1 High5 Medium5 Low

HighPrevious Version Dangerous Deltasrc/server/agents/agentRunner.ts

MediumDynamic Requiresrc/lib/memory.ts

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/test-quay.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

src/lib/memory.tsView file

Lines 437-473typescript

437 /**

438 * Clear all memories for an agent

439 */

440 clear(agentId: string): void {

441 this.memories.delete(agentId);

442 this.trajectories.delete(agentId);

443 }

444

445 /**

446 * Export memories as JSON

447 */

448 export(agentId: string): { memories: MemoryBlock[]; trajectories: Trajectory[] } {

449 return {

450 memories: this.getMemories(agentId),

451 trajectories: this.getTrajectories(agentId),

452 };

453 }

454

455 /**

456 * Import memories from JSON

457 */

458 import(agentId: string, data: { memories?: MemoryBlock[]; trajectories?: Trajectory[] }): void {

459 if (data.memories) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/lib/memory.tsView on unpkg · L457

460 this.memories.set(agentId, data.memories);

461 }

462 if (data.trajectories) {

463 this.trajectories.set(agentId, data.trajectories);

464 }

465 }

466}

467

468// ============================================================

469// Convenience export

470// ============================================================

471

472export const persistentMemory = new PersistentMemory();

473

scripts/test-quay.shView file

•path = scripts/test-quay.sh kind = build_helper sizeBytes = 27475 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/test-quay.shView on unpkg

src/server/agents/agentRunner.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/server/agents/agentRunner.tsView on unpkg