registry / rivet-design / 0.12.1

rivet-design@0.12.1

⚠ Under review

Local visual web development tool with AI-powered code modification

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

Manifest

CopyleftLicense

scanned 152 file(s), 3.48 MB of source, external domains: 127.0.0.1, cdn.jsdelivr.net, cdn.skypack.dev, cdnjs.cloudflare.com, claude.ai, cli.github.com, cursor.com, demo.rivet.design, esm.sh, getdesign.md, github.com, gsap.com, reactjs.org, releases.rivet.design, rivet-core-production.up.railway.app, rivet-prototype-host.onrender.com, rivet-proxy.onrender.com, rivet.design, rivet.local, unpkg.com, us.posthog.com, vdonwyzxpnsrihtrrvza.supabase.co, www.are.na, www.gstatic.com, www.pinterest.com, www.w3.org, yandex.com

Source & flagged code

4 flagged

dist/services/agent/AgentCore.jsView file

Lines 81-121javascript

81 *

82 * @effect Streams progress events via onProgress callback

83 * @returns Files modified, reasoning steps, and tool calls

84 */

85 async execute(options) {

86 const { systemPrompt, userPrompt, allowedTools, permissionMode, cwd, onProgress, abortController, resumeSessionId, model = DEFAULT_MODEL, correlation, telemetry, } = options;

87 // Get and validate auth token

88 const tokenValidation = this.getTokenValidationState();

89 log.info(`Token validation status: ${JSON.stringify({

90 state: tokenValidation.state,

91 refreshRequired: tokenValidation.refreshRequired,

92 refreshAvailable: tokenValidation.refreshAvailable,

93 errorMessage: tokenValidation.errorMessage,

94 })}`);

95 const authToken = await this.getValidAuthToken();

96 log.info(`Agent will use ANTHROPIC_BASE_URL: ${this.gatewayUrl}`);

97 log.info('Auth token loaded successfully for agent execution');

98 // Ensure TCC observability key is available before instrumenting

99 (0, telemetry_1.ensureTCCApiKey)();

100 // Dynamically import the ESM SDK

101 // Use eval to prevent TypeScript from transforming to require()

102 const claudeSDK = await eval("import('@anthropic-ai/claude-agent-sdk')");

103 // Wrap with Context Company observability when TCC_API_KEY is configured

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/services/agent/AgentCore.jsView on unpkg · L101

104 const sdk = process.env.TCC_API_KEY

105 ? (0, claude_1.instrumentClaudeAgent)(claudeSDK)

106 : claudeSDK;

107 const { query, tool, createSdkMcpServer } = sdk;

108 // Set up structured-output tool if requested. Captures the validated

109 // input in a closure so we can return it after the agent loop.

110 let capturedResultToolInput;

111 let resultMcpServers;

112 let resultToolFullName;

113 if (options.resultTool) {

114 const resultToolDef = options.resultTool;

115 resultToolFullName = `mcp__${RESULT_MCP_SERVER_NAME}__${resultToolDef.name}`;

116 const submitTool = tool(resultToolDef.name, resultToolDef.description, resultToolDef.inputSchema, async (args) => {

117 capturedResultToolInput = args;

118 return {

119 content: [{ type: 'text', text: 'Result received.' }],

120 };

121 });

bin/rivet.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

3process.noDeprecation = true;

5const fs = require('fs');

6const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/rivet.js

src/ui/dist/favicon.icoView file

•path = src/ui/dist/favicon.ico kind = high_entropy_blob sizeBytes = 4820 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/ui/dist/favicon.icoView on unpkg

dist/mcp/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = rivet-design@0.11.17 matchedIdentity = npm:cml2ZXQtZGVzaWdu:0.11.17 similarity = 0.867 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/mcp/server.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/services/agent/AgentCore.jsView file

101// Use eval to prevent TypeScript from transforming to require() L102: const claudeSDK = await eval("import('@anthropic-ai/claude-agent-sdk')"); L103: // Wrap with Context Company observability when TCC_API_KEY is configured

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/services/agent/AgentCore.jsView on unpkg · L101

bin/rivet.jsView file

4L5: const fs = require('fs'); L6: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/rivet.jsView on unpkg · L4

src/ui/dist/favicon.icoView file

•path = src/ui/dist/favicon.ico kind = high_entropy_blob sizeBytes = 4820 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/ui/dist/favicon.icoView on unpkg

dist/mcp/server.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/mcp/server.jsView on unpkg

Findings

1 Critical1 High4 Medium9 Low

CriticalPrevious Version Dangerous Deltadist/mcp/server.js

HighShips High Entropy Blobsrc/ui/dist/favicon.ico

MediumDynamic Requirebin/rivet.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/services/agent/AgentCore.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowCopyleft License

Source & flagged code

4 flagged

dist/services/agent/AgentCore.jsView file

Lines 81-121javascript

81 *

82 * @effect Streams progress events via onProgress callback

83 * @returns Files modified, reasoning steps, and tool calls

84 */

85 async execute(options) {

86 const { systemPrompt, userPrompt, allowedTools, permissionMode, cwd, onProgress, abortController, resumeSessionId, model = DEFAULT_MODEL, correlation, telemetry, } = options;

87 // Get and validate auth token

88 const tokenValidation = this.getTokenValidationState();

89 log.info(`Token validation status: ${JSON.stringify({

90 state: tokenValidation.state,

91 refreshRequired: tokenValidation.refreshRequired,

92 refreshAvailable: tokenValidation.refreshAvailable,

93 errorMessage: tokenValidation.errorMessage,

94 })}`);

95 const authToken = await this.getValidAuthToken();

96 log.info(`Agent will use ANTHROPIC_BASE_URL: ${this.gatewayUrl}`);

97 log.info('Auth token loaded successfully for agent execution');

98 // Ensure TCC observability key is available before instrumenting

99 (0, telemetry_1.ensureTCCApiKey)();

100 // Dynamically import the ESM SDK

101 // Use eval to prevent TypeScript from transforming to require()

102 const claudeSDK = await eval("import('@anthropic-ai/claude-agent-sdk')");

103 // Wrap with Context Company observability when TCC_API_KEY is configured

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/services/agent/AgentCore.jsView on unpkg · L101

104 const sdk = process.env.TCC_API_KEY

105 ? (0, claude_1.instrumentClaudeAgent)(claudeSDK)

106 : claudeSDK;

107 const { query, tool, createSdkMcpServer } = sdk;

108 // Set up structured-output tool if requested. Captures the validated

109 // input in a closure so we can return it after the agent loop.

110 let capturedResultToolInput;

111 let resultMcpServers;

112 let resultToolFullName;

113 if (options.resultTool) {

114 const resultToolDef = options.resultTool;

115 resultToolFullName = `mcp__${RESULT_MCP_SERVER_NAME}__${resultToolDef.name}`;

116 const submitTool = tool(resultToolDef.name, resultToolDef.description, resultToolDef.inputSchema, async (args) => {

117 capturedResultToolInput = args;

118 return {

119 content: [{ type: 'text', text: 'Result received.' }],

120 };

121 });

bin/rivet.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

3process.noDeprecation = true;

5const fs = require('fs');

6const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/rivet.js

src/ui/dist/favicon.icoView file

•path = src/ui/dist/favicon.ico kind = high_entropy_blob sizeBytes = 4820 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/ui/dist/favicon.icoView on unpkg

dist/mcp/server.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/mcp/server.jsView on unpkg