registry / run402 / 4.104.2

run402@4.104.2

⚠ Under review

CLI for Run402 — full-stack backend infrastructure for AI agents: Postgres, auth, storage, serverless functions and atomic deploys. Paid with x402/MPP. Includes $0.03 image generation.

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 19 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 277 file(s), 4.21 MB of source, external domains: 127.0.0.1, 1rpc.io, acme.communities.buzz.xyz, api.github.com, api.run402.com, api.run402.test, app.run402.com, base-rpc.publicnode.com, base-sepolia-rpc.publicnode.com, base-sepolia.drpc.org, church.run402.com, console.run402.com, docs.run402.com, eagles.kychon.com, example.com, github.com, hooks.example.com, mainnet.base.org, myapp.run402.com, new.example.com, registry.example.test, registry.npmjs.org, rpc.moderato.tempo.xyz, run402.com, s.example, seller.example, sepolia.base.org, token.actions.githubusercontent.com

Source & flagged code

12 flagged

git-remote-run402.mjsView file

Lines 14-54javascript

14 * - The daemon is never load-bearing: any failure to use it — absent,

15 * busy, stale, mismatched, dying mid-handshake — falls back silently to

16 * the in-process path. The handshake completes BEFORE this client

17 * commits to the daemon (before one byte of stdin is consumed), so

18 * fallback never replays a half-consumed session.

19 * - The fast path stays THIN, mechanically: its import graph is node

20 * builtins + `./lib/daemon-path.mjs` only, pinned by a source-level

21 * gate test (design D7). The heavy graph loads only on fallback.

22 * - `RUN402_DAEMON=0` disables the daemon entirely (dev/CI toggle,

23 * positively named, default on, only "0" disables); any other value

24 * behaves as unset.

25 *

26 * The remote-helper doctrine (fail-closed repository resolution, wallet

27 * selection, protocol semantics) lives with the session implementation in

28 * `cli/lib/remote-helper-session.mjs` — ONE implementation, two hosts.

29 */

31import { realpathSync } from "node:fs";

32import { pathToFileURL } from "node:url";

33import * as nodeModule from "node:module";

34import net from "node:net";

35import { spawn } from "node:child_process";

36import { daemonSocketPath, daemonRunnerPath, DAEMON_PROTOCOL_VERSION, cliVersion, forwardableEnv } from "./lib/daemon-path.mjs";

High

Child Process

Package source references child process execution.

git-remote-run402.mjsView on unpkg · L34

38// vault-startup-amortization (D2): on-disk V8 compile cache for every

39// module loaded from here on. Feature-guarded (Node 22.8+) and try/caught

40// (a read-only install dir degrades silently).

41try {

42 nodeModule.enableCompileCache?.();

43} catch {

44 /* silent by contract */

45}

47const CONNECT_TIMEOUT_MS = 250;

48const HANDSHAKE_TIMEOUT_MS = 750;

50/** Frame codec: newline-delimited JSON; binary rides base64. */

51function frame(obj) {

52 return `${JSON.stringify(obj)}\n`;

53}

•matchType = normalized_sha256 matchedPackage = run402@4.71.0 matchedPath = git-remote-run402.mjs matchedIdentity = npm:cnVuNDAy:4.71.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

git-remote-run402.mjsView on unpkg

sdk/dist/node/deploy-manifest.jsView file

Lines 821-861javascript

821 const requireRole = rawRecord.requireRole ?? rawRecord.require_role;

822 if (requireAuth !== undefined)

823 out.requireAuth = requireAuth;

824 if (requireRole !==

lib/buzz-doctor.test.mjsView file

Lines 4-44javascript

4import { join } from "node:path";

5import { describe, it } from "node:test";

6import { bech32 } from "@scure/base";

7import {

8 BUZZ_DOCTOR_CHECK_ORDER,

lib/dev.mjsView file

Lines 89-129javascript

89 });

90 }

91 if (!process.env.RUN402_SERVICE_KEY) {

92 fail({

93 code: "BAD_USAGE",

94 message: "Missing RUN402_SERVICE_KEY.",

95 hint: "Add it to .env.local. Get the service key from 'run402 projects list' or your Run402 dashboard."

lib/doctor-source-scan.test.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/doctor-source-scan.test.mjs#virtual:normalized:round1View on unpkg

lib/diagnostic-telemetry.mjsView file

•matchType = normalized_sha256 matchedPackage = run402@4.71.0 matchedPath = lib/diagnostic-telemetry.mjs matchedIdentity = npm:cnVuNDAy:4.71.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/diagnostic-telemetry.mjsView on unpkg

sdk/dist/node/vault-restore.jsView file

•matchType = normalized_sha256 matchedPackage = run402@4.71.0 matchedPath = sdk/dist/node/gitvault-restore.js matchedIdentity = npm:cnVuNDAy:4.71.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

sdk/dist/node/vault-restore.jsView on unpkg

lib/update-check.test.mjsView file

•matchType = normalized_sha256 matchedPackage = run402@4.71.0 matchedPath = lib/update-check.test.mjs matchedIdentity = npm:cnVuNDAy:4.71.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/update-check.test.mjsView on unpkg

lib/pay.mjsView file

•matchType = normalized_sha256 matchedPackage = run402@4.71.0 matchedPath = lib/pay.mjs matchedIdentity = npm:cnVuNDAy:4.71.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/pay.mjsView on unpkg

sdk/dist/node/actions-node.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = run402@4.75.1 matchedIdentity = npm:cnVuNDAy:4.75.1 similarity = 0.450 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

sdk/dist/node/actions-node.jsView on unpkg

run402@4.104.2

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code