registry / runline / 0.12.0

runline@0.12.0

Code mode for agents — turn any API or command into a callable action

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 282 file(s), 2.51 MB of source, external domains: 127.0.0.1, accounts.google.com, actionnetwork.org, adb-12345.azuredatabricks.net, adc.example.com, api-b2b.backenster.com, api-eu.customer.io, api-eu.dhl.com, api-free.deepl.com, api-m.paypal.com, api-m.sandbox.paypal.com, api-ssl.bitly.com, api.adalo.com, api.affinity.co, api.airtable.com, api.airtop.ai, api.apitemplate.io, api.bamboohr.com, api.bannerbear.com, api.baserow.io, api.bitwarden.com, api.box.com, api.brandfetch.io, api.brevo.com, api.clickup.com, api.clockify.me, api.cloudflare.com, api.coingecko.com, api.convertkit.com, api.copper.com, api.currents.dev, api.customer.io, api.deepl.com, api.dropboxapi.com, api.dropcontact.io, api.egoiapp.com, api.getgo.com, api.getresponse.com, api.getvero.com, api.github.com, api.gong.io, api.harvestapp.com, api.helpscout.net, api.hubapi.com, api.humantic.ai, api.hunter.io, api.infusionsoft.com, api.intercom.io, api.iterable.com, api.lemlist.com

Source & flagged code

5 flagged

dist/core/oauth.jsView file

Lines 4-44javascript

4 * Two surfaces:

5 *

6 * 1. `runOAuth(config, {clientId, clientSecret})` — end-to-end CLI

7 * flow. Opens the browser, captures the redirect on a pinned

8 * localhost port, exchanges the code, returns tokens. Used by

9 * `runline auth <plugin>`.

10 *

11 * 2. Primitives for callers that can't run a local callback server

12 * (hosted apps, GUIs, anywhere the user's browser doesn't talk

13 * back to the process driving the flow):

14 *

15 * - `generatePKCE()` — S256 verifier + challenge

16 * - `buildAuthUrl(config, opts)` — assemble the consent URL

17 * - `exchangeAuthCode(config, opts)` — POST to the token

18 * endpoint, get back tokens

19 *

20 * The caller orchestrates: generates state + PKCE, builds the

21 * URL, shows it to the user, receives the code back however it

22 * wants (redirect-URI paste, browser popup with postMessage,

23 * public HTTPS callback, …), calls exchangeAuthCode.

24 */

25import { spawn } from "node:child_process";

26import { createHash, randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/core/oauth.jsView on unpkg · L24

27import { createServer, } from "node:http";

28/**

29 * Fixed callback port for OAuth redirects. Pinned so users can

30 * register `http://127.0.0.1:<PORT>/callback` once with the

31 * provider and have it keep working across every `runline auth`

32 * invocation. Override via `RUNLINE_OAUTH_CALLBACK_PORT` if you

33 * need a different port (you'll have to re-register the redirect

34 * URI with the provider after changing it).

35 */

36export const OAUTH_CALLBACK_PORT = (() => {

37 const raw = process.env.RUNLINE_OAUTH_CALLBACK_PORT;

38 if (raw) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/core/oauth.jsView on unpkg · L24

39 const n = Number(raw);

40 if (Number.isInteger(n) && n > 0 && n < 65536)

41 return n;

42 }

43 return 47823;

44})();

dist/plugins/steel/src/browser.jsView file

Lines 149-183javascript

149 catch (_error) {

150 throw new Error("steel.browser.run requires the host project to install playwright. Install playwright or use session.create + session.cdpUrl instead.");

151 }

152 const session = await api(ctx, "/v1/sessions", { method: "POST", body: compactRecord(sessionOptions) });

dist/plugin/loader.jsView file

Lines 30-70javascript

30 try {

31 const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));

32 if (pkg.main)

33 candidates.unshift(join(absPath, pkg.main));

34 }

35 catch

dist/plugin/installer.jsView file

Lines 86-126javascript

86}

87function readPluginsJson() {

88 const path = getPluginsJsonPath();

89 if (!existsSync(path))

90 return { plugins: [] };

91 return JSON.parse(

Source & flagged code

5 flagged · loading source

dist/core/oauth.jsView file

24*/ L25: import { spawn } from "node:child_process"; L26: import { createHash, randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/core/oauth.jsView on unpkg · L24

24*/ L25: import { spawn } from "node:child_process"; L26: import { createHash, randomBytes } from "node:crypto"; L27: import { createServer, } from "node:http"; L28: /** ... L36: export const OAUTH_CALLBACK_PORT = (() => { L37: const raw = process.env.RUNLINE_OAUTH_CALLBACK_PORT; L38: if (raw) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/core/oauth.jsView on unpkg · L24

dist/plugins/steel/src/browser.jsView file

169} L170: const fn = new Function("page", "browser", "context", "session", `return (async () => {\n${script}\n})();`); L171: const result = await fn(page, browser, context, session);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/plugins/steel/src/browser.jsView on unpkg · L169

dist/plugin/loader.jsView file

50// to the plugin file. L51: const mod = (await jiti.import(absPath)); L52: const pluginId = absPath.replace(/.*\//, "").replace(/\.(ts|js)$/, "");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugin/loader.jsView on unpkg · L50

dist/plugin/installer.jsView file

106const spec = parsed.ref ? `${parsed.name}@${parsed.ref}` : parsed.name; L107: execSync(`npm install ${spec}`, { cwd: npmDir, stdio: "pipe" }); L108: installPath = join(npmDir, "node_modules", parsed.name);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/plugin/installer.jsView on unpkg · L106

Findings

4 High4 Medium7 Low

HighChild Processdist/core/oauth.js

HighShell

HighSame File Env Network Executiondist/core/oauth.js

HighRuntime Package Installdist/plugin/installer.js

MediumDynamic Requiredist/plugin/loader.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/plugins/steel/src/browser.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

5 flagged

dist/core/oauth.jsView file

Lines 4-44javascript

4 * Two surfaces:

5 *

6 * 1. `runOAuth(config, {clientId, clientSecret})` — end-to-end CLI

7 * flow. Opens the browser, captures the redirect on a pinned

8 * localhost port, exchanges the code, returns tokens. Used by

9 * `runline auth <plugin>`.

10 *

11 * 2. Primitives for callers that can't run a local callback server

12 * (hosted apps, GUIs, anywhere the user's browser doesn't talk

13 * back to the process driving the flow):

14 *

15 * - `generatePKCE()` — S256 verifier + challenge

16 * - `buildAuthUrl(config, opts)` — assemble the consent URL

17 * - `exchangeAuthCode(config, opts)` — POST to the token

18 * endpoint, get back tokens

19 *

20 * The caller orchestrates: generates state + PKCE, builds the

21 * URL, shows it to the user, receives the code back however it

22 * wants (redirect-URI paste, browser popup with postMessage,

23 * public HTTPS callback, …), calls exchangeAuthCode.

24 */

25import { spawn } from "node:child_process";

26import { createHash, randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/core/oauth.jsView on unpkg · L24

27import { createServer, } from "node:http";

28/**

29 * Fixed callback port for OAuth redirects. Pinned so users can

30 * register `http://127.0.0.1:<PORT>/callback` once with the

31 * provider and have it keep working across every `runline auth`

32 * invocation. Override via `RUNLINE_OAUTH_CALLBACK_PORT` if you

33 * need a different port (you'll have to re-register the redirect

34 * URI with the provider after changing it).

35 */

36export const OAUTH_CALLBACK_PORT = (() => {

37 const raw = process.env.RUNLINE_OAUTH_CALLBACK_PORT;

38 if (raw) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/core/oauth.jsView on unpkg · L24

39 const n = Number(raw);

40 if (Number.isInteger(n) && n > 0 && n < 65536)

41 return n;

42 }

43 return 47823;

44})();

dist/plugins/steel/src/browser.jsView file

Lines 149-183javascript

149 catch (_error) {

150 throw new Error("steel.browser.run requires the host project to install playwright. Install playwright or use session.create + session.cdpUrl instead.");

151 }

152 const session = await api(ctx, "/v1/sessions", { method: "POST", body: compactRecord(sessionOptions) });

dist/plugin/loader.jsView file

Lines 30-70javascript

30 try {

31 const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));

32 if (pkg.main)

33 candidates.unshift(join(absPath, pkg.main));

34 }

35 catch

dist/plugin/installer.jsView file

Lines 86-126javascript

86}

87function readPluginsJson() {

88 const path = getPluginsJsonPath();

89 if (!existsSync(path))

90 return { plugins: [] };

91 return JSON.parse(