registry / rea-agents / 0.3.0

rea-agents@0.3.0

Reverse engineer anything from your terminal or coding agent with one CLI and MCP server.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 40 file(s), 175 KB of source, external domains: 127.0.0.1, raw.githubusercontent.com

Source & flagged code

2 flagged

dist/application/BinarySession.jsView file

Lines 25-65javascript

25 ? provider

26 : (target) => provider.createClient(target);

27 this.#providerIdentity =

28 typeof provider === "function"

29 ? { id: "unidentified", name: "Unidentified provider", version: null }

30 : provider.identity();

31 }

32 /** Identify the provider producing evidence for this session. */

33 providerIdentity() {

34 return this.#providerIdentity;

35 }

36 /** Add one successful public observation to the session ledger. */

37 recordEvidence(evidence) {

38 this.#evidence.record(evidence);

39 }

40 /** Return a deterministic snapshot without clearing session evidence. */

41 exportEvidenceBundle() {

42 return this.#evidence.export();

43 }

44 /** Atomically merge a validated evidence bundle into this session. */

45 importEvidenceBundle(bundle) {

46 return this.#evidence.import(bundle);

47 }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/application/BinarySession.jsView on unpkg · L45

48 /**

49 * Open or switch targets after draining calls against the current target.

50 * Returns the switch failure even if best-effort restoration also fails.

51 */

52 open(path, options = {}) {

53 return this.#serialize(async () => {

54 if (isAborted(options.signal))

55 return err(new HopperCancelledError());

56 const parsed = await parseBinaryTarget(path, process.cwd(), process.arch, options.targetKind);

57 if (!parsed.ok)

58 return parsed;

59 if (isAborted(options.signal))

60 return err(new HopperCancelledError());

61 if (this.#active?.target.path === parsed.value.path)

62 return ok(parsed.value);

63 await this.#drainCalls();

64 const previous = this.#active;

65 this.#active = undefined;

bridge/hopper_bridge.pyView file

•path = bridge/hopper_bridge.py kind = build_helper sizeBytes = 26195 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bridge/hopper_bridge.pyView on unpkg

Source & flagged code

2 flagged · loading source

dist/application/BinarySession.jsView file

45importEvidenceBundle(bundle) { L46: return this.#evidence.import(bundle); L47: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/application/BinarySession.jsView on unpkg · L45

bridge/hopper_bridge.pyView file

•path = bridge/hopper_bridge.py kind = build_helper sizeBytes = 26195 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bridge/hopper_bridge.pyView on unpkg

Findings

5 Medium5 Low

MediumDynamic Requiredist/application/BinarySession.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbridge/hopper_bridge.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/application/BinarySession.jsView file

Lines 25-65javascript

25 ? provider

26 : (target) => provider.createClient(target);

27 this.#providerIdentity =

28 typeof provider === "function"

29 ? { id: "unidentified", name: "Unidentified provider", version: null }

30 : provider.identity();

31 }

32 /** Identify the provider producing evidence for this session. */

33 providerIdentity() {

34 return this.#providerIdentity;

35 }

36 /** Add one successful public observation to the session ledger. */

37 recordEvidence(evidence) {

38 this.#evidence.record(evidence);

39 }

40 /** Return a deterministic snapshot without clearing session evidence. */

41 exportEvidenceBundle() {

42 return this.#evidence.export();

43 }

44 /** Atomically merge a validated evidence bundle into this session. */

45 importEvidenceBundle(bundle) {

46 return this.#evidence.import(bundle);

47 }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/application/BinarySession.jsView on unpkg · L45

48 /**

49 * Open or switch targets after draining calls against the current target.

50 * Returns the switch failure even if best-effort restoration also fails.

51 */

52 open(path, options = {}) {

53 return this.#serialize(async () => {

54 if (isAborted(options.signal))

55 return err(new HopperCancelledError());

56 const parsed = await parseBinaryTarget(path, process.cwd(), process.arch, options.targetKind);

57 if (!parsed.ok)

58 return parsed;

59 if (isAborted(options.signal))

60 return err(new HopperCancelledError());

61 if (this.#active?.target.path === parsed.value.path)

62 return ok(parsed.value);

63 await this.#drainCalls();

64 const previous = this.#active;

65 this.#active = undefined;

bridge/hopper_bridge.pyView file

•path = bridge/hopper_bridge.py kind = build_helper sizeBytes = 26195 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bridge/hopper_bridge.pyView on unpkg