registry / rea-agents / 2.0.0

rea-agents@2.0.0

Reverse engineer anything from your terminal or agent with one CLI and MCP server.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 376 file(s), 2.30 MB of source, external domains: 127.0.0.1, app.example.test, rea.invalid, registry.npmjs.org, www.hopperapp.com

Source & flagged code

4 flagged

package.jsonView file

Lines 49-89json

49 "README.md",

50 "LICENSE"

51 ],

52 "scripts": {

53 "deps:check": "node scripts/check-dependency-install.mjs",

54 "prebuild": "npm run deps:check && node scripts/generate-package-metadata.mjs",

55 "build": "tsc -p tsconfig.build.json",

56 "postbuild": "node scripts/record-build-cache.mjs",

57 "precheck": "npm run deps:check",

58 "check": "npm run typecheck && npm run lint && npm run format:check && npm run docs:check && npm test",

59 "format": "prettier --write .",

60 "format:check": "prettier --check .",

61 "lint": "oxlint",

62 "lint:fix": "oxlint --fix",

63 "knip": "knip",

64 "lint:dead": "knip",

65 "jscpd": "jscpd src/ tests/",

66 "scan:todos": "node scripts/scan-todos.mjs",

67 "start": "node scripts/rea.mjs mcp",

68 "pretest": "npm run build",

69 "postinstall": "node scripts/prepare-node-pty.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L69

70 "test": "vitest run",

71 "pretest:coverage": "npm run build",

72 "test:coverage": "vitest run --coverage.enabled --coverage.provider=v8",

73 "test:verbose": "vitest run --reporter=verbose",

74 "test:watch": "vitest",

75 "typecheck": "tsc --noEmit",

76 "verify:hopper": "npm run build && node scripts/verify-real-hopper.mjs",

77 "verify:ghidra": "npm run build && node scripts/verify-real-ghidra.mjs",

78 "verify:browser": "npm run build && node scripts/verify-real-browser.mjs",

79 "verify:javascript-runtime": "npm run build && node scripts/verify-local-javascript-runtime.mjs",

80 "verify:application-workflows": "npm run build && node scripts/verify-local-application-workflows.mjs",

81 "verify:managed": "npm run build && node scripts/verify-managed-conformance.mjs",

82 "verify:replay": "npm run build && node scripts/verify-real-javascript-replay.mjs",

83 "verify:hopper:linux": "npm run build && node scripts/verify-real-hopper-linux.mjs",

84 "verify:setup:linux": "npm run build && node scripts/verify-linux-setup-e2e.mjs",

85 "build:fixtures": "node scripts/build-conformance-fixtures.mjs",

86 "verify:fixtures": "npm run build:fixtures && node scripts/verify-conformance-fixtures.mjs",

87 "verify:package": "npm run build && node scripts/verify-package.mjs",

88 "verify:published": "node scripts/verify-published-package.mjs",

89 "config:print": "node scripts/print-mcp-config.mjs",

dist/dotnet/ManagedMetadataHeaps.jsView file

Lines 4-44javascript

4 if (offset < 0 || length < 0 || offset > bytes.length - length)

5 throw managedFailure("invalid-row", scope, `${scope} leaves the artifact byte range`, offset >= 0 ? offset

bridge/hopper_bridge.pyView file

•path = bridge/hopper_bridge.py kind = build_helper sizeBytes = 38096 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bridge/hopper_bridge.pyView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/prepare-node-pty.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/dotnet/ManagedMetadataHeaps.jsView file

24readUInt16() { L25: this.require(2); L26: const value = this.bytes.readUInt16LE(this.#offset);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/dotnet/ManagedMetadataHeaps.jsView on unpkg · L24

81try { L82: return new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(start, end)); L83: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/dotnet/ManagedMetadataHeaps.jsView on unpkg · L81

bridge/hopper_bridge.pyView file

•path = bridge/hopper_bridge.py kind = build_helper sizeBytes = 38096 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bridge/hopper_bridge.pyView on unpkg

Findings

1 High5 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumDynamic Requiredist/dotnet/ManagedMetadataHeaps.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbridge/hopper_bridge.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/dotnet/ManagedMetadataHeaps.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings