registry  /  relay-companion  /  0.1.46

relay-companion@0.1.46

Relay companion: connects local coding agents to Relay tasks, approvals, and connector tools.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 33 file(s), 456 KB of source, external domains: aia6vj5pgp.us-east-1.awsapprunner.com, registry.npmjs.org, sendrelays.com, www.apple.com, www.w3.org

Source & flagged code

5 flagged · loading source
package.jsonView file
•scripts.postinstall = node src/postinstall.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node src/postinstall.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/relay.jsView file
41try { L42: const require = createRequire(import.meta.url); L43: const pkg = require("../package.json");
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/relay.jsView on unpkg · L41
src/auto-update.jsView file
17import fs from "node:fs"; L18: import { spawn } from "node:child_process"; L19: import { fileURLToPath } from "node:url"; ... L23: const PILL_LABEL = "work.relay.companion.pill"; L24: const DEFAULT_REGISTRY = "https://registry.npmjs.org"; L25: // A production publish should reach an idle machine promptly. The registry request is ... L75: // daemon from accidentally updating Homebrew's copy (or the reverse). L76: export function managedInstallInfo(packageRoot, { home = os.homedir() } = {}) { L77: const root = path.resolve(String(packageRoot || "")); ... L97: L98: export function autoUpdateEnabled(env = process.env) { L99: const raw = String(env.RELAY_AUTO_UPDATE ?? "").trim().toLowerCase();
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/auto-update.jsView on unpkg · L17
overlay/main.cjsView file
•matchType = previous_version_dangerous_delta matchedPackage = relay-companion@0.1.43 matchedIdentity = npm:cmVsYXktY29tcGFuaW9u:0.1.43 similarity = 0.844 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

overlay/main.cjsView on unpkg

Findings

2 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltaoverlay/main.cjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirebin/relay.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/auto-update.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License