registry / saros-proxy / 0.7.0

saros-proxy@0.7.0

Saros — predictive multi-account proxy for the OpenCode-Go API. Cycles between accounts before they exhaust.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 22 file(s), 203 KB of source, external domains: 127.0.0.1, models.dev, opencode.ai, registry.npmjs.org

Source & flagged code

4 flagged

dist/cli/autostart.jsView file

Lines 1-34javascript

1/**

2 * autostart.ts — Register/unregister the daemon to start on user login.

3 *

4 * Methods:

5 * registry — HKCU\Software\Microsoft\Windows\CurrentVersion\Run (default)

6 * vbs — VBScript in Windows Startup folder (legacy, may trigger AV)

7 * auto — detect third-party AV → registry, else vbs

8 *

9 * macOS: creates a launchd agent plist (TODO)

10 * Linux: creates a systemd --user service (TODO)

11 */

12import { existsSync, writeFileSync, rmSync, readFileSync } from 'node:fs';

13import { join } from 'node:path';

14import { homedir } from 'node:os';

15import { execFileSync } from 'node:child_process';

16import * as ui from './ui.js';

High

Child Process

Package source references child process execution.

dist/cli/autostart.jsView on unpkg · L14

17// ---------------------------------------------------------------------------

18// Constants

19// ---------------------------------------------------------------------------

20const REG_RUN_KEY = 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run';

21const REG_VALUE_NAME = 'Saros Proxy';

22/** Known third-party antivirus process names (lowercase, without .exe). */

23const AV_PROCESS_NAMES = new Set([

24 'bdagent', // Bitdefender

25 'bdservicehost', // Bitdefender

26 'vsserv', // Bitdefender

27 'ccsvchst', // Norton

28 'ns', // Norton

29 'avp', // Kaspersky

30 'avastui', // Avast

31 'aswidsagenta', // Avast

32 'mctray', // McAfee

33 'masvc', // McAfee

34 'ekrn', // ESET

dist/cli/setup.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/**

3 * setup.ts — Interactive CLI setup wizard for Saros.

4 *

5 * Usage:

6 * npx tsx src/cli/setup.ts

7 * npm run setup

8 *

9 * Prompts for configuration values, writes config.yaml, and runs a quick

10 * smoke test to verify the proxy starts and responds to health checks.

11 */

12import { existsSync, writeFileSync, readFileSync, mkdirSync }

Source & flagged code

4 flagged · loading source

dist/cli/autostart.jsView file

14import { homedir } from 'node:os'; L15: import { execFileSync } from 'node:child_process'; L16: import * as ui from './ui.js';

High

Child Process

Package source references child process execution.

dist/cli/autostart.jsView on unpkg · L14

dist/cli/setup.jsView file

248stdio: ['ignore', 'pipe', 'pipe'], L249: shell: true, L250: detached: false, // killProcessTree() handles cleanup on both platforms

High

Shell

Package source references shell execution.

dist/cli/setup.jsView on unpkg · L248

5* Usage: L6: * npx tsx src/cli/setup.ts L7: * npm run setup ... L13: import { stringify as stringifyYaml } from 'yaml'; L14: import { spawn, exec, execFileSync } from 'node:child_process'; L15: import { resolve as pathResolve, join as pathJoin, dirname } from 'node:path';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/setup.jsView on unpkg · L5

13import { stringify as stringifyYaml } from 'yaml'; L14: import { spawn, exec, execFileSync } from 'node:child_process'; L15: import { resolve as pathResolve, join as pathJoin, dirname } from 'node:path'; ... L153: * - Windows: `setx <name> <value>` (user-level, persists across reboots) L154: * - Linux/macOS: append `export <name>=<value>` to ~/.bashrc or ~/.zshrc L155: * ... L159: try { L160: if (process.platform === 'win32') { L161: // Use execFileSync to avoid shell injection (setx PATH "foo & calc & ") ... L165: // Linux/macOS — append to shell profile L166: const home = process.env.HOME || process.env.USERPROFILE; L167: if (!home)

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/setup.jsView on unpkg · L13

Findings

3 High4 Medium5 Low

HighChild Processdist/cli/autostart.js

HighShelldist/cli/setup.js

HighRuntime Package Installdist/cli/setup.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli/setup.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/cli/autostart.jsView file

Lines 1-34javascript

1/**

2 * autostart.ts — Register/unregister the daemon to start on user login.

3 *

4 * Methods:

5 * registry — HKCU\Software\Microsoft\Windows\CurrentVersion\Run (default)

6 * vbs — VBScript in Windows Startup folder (legacy, may trigger AV)

7 * auto — detect third-party AV → registry, else vbs

8 *

9 * macOS: creates a launchd agent plist (TODO)

10 * Linux: creates a systemd --user service (TODO)

11 */

12import { existsSync, writeFileSync, rmSync, readFileSync } from 'node:fs';

13import { join } from 'node:path';

14import { homedir } from 'node:os';

15import { execFileSync } from 'node:child_process';

16import * as ui from './ui.js';

High

Child Process

Package source references child process execution.

dist/cli/autostart.jsView on unpkg · L14

17// ---------------------------------------------------------------------------

18// Constants

19// ---------------------------------------------------------------------------

20const REG_RUN_KEY = 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run';

21const REG_VALUE_NAME = 'Saros Proxy';

22/** Known third-party antivirus process names (lowercase, without .exe). */

23const AV_PROCESS_NAMES = new Set([

24 'bdagent', // Bitdefender

25 'bdservicehost', // Bitdefender

26 'vsserv', // Bitdefender

27 'ccsvchst', // Norton

28 'ns', // Norton

29 'avp', // Kaspersky

30 'avastui', // Avast

31 'aswidsagenta', // Avast

32 'mctray', // McAfee

33 'masvc', // McAfee

34 'ekrn', // ESET

dist/cli/setup.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/**

3 * setup.ts — Interactive CLI setup wizard for Saros.

4 *

5 * Usage:

6 * npx tsx src/cli/setup.ts

7 * npm run setup

8 *

9 * Prompts for configuration values, writes config.yaml, and runs a quick

10 * smoke test to verify the proxy starts and responds to health checks.

11 */

12import { existsSync, writeFileSync, readFileSync, mkdirSync }

Lines 228-268javascript

228function killProcessTree(child) {

229 if (!child.pid)

230 return;

231 if (process.platform === 'win32') {

232 exec(`taskkill /T /F /PID ${child.pid}`, { windowsHide: true }, () => { });

233 }

234 else {

235 child.kill('SIGKILL');

236 }

237}

238export async function testProxy(port, timeoutMs = 20_000, cwd = PACKAGE_ROOT, encryptionKey, configPath) {

239 return new Promise((resolve, reject) => {

240 // Resolve the entry point relative to the package root

241 const entryPoint = pathResolve(PACKAGE_ROOT, 'src', 'index.ts');

242 // Use single-command form with shell:true to avoid DEP0190 deprecation

243 // (Node.js deprecates passing both shell:true and separate args)

244 const configFlag = configPath ? ` --config "${configPath}"` : '';

245 const cmd = `npx tsx "${entryPoint}" --port ${port}${configFlag}`;

246 const child = spawn(cmd, [], {

247 cwd,

248 stdio: ['ignore', 'pipe', 'pipe'],

249 shell: true,

250 detached: false, // killProcessTree() handles cleanup on both platforms

High

Shell

Package source references shell execution.

dist/cli/setup.jsView on unpkg · L248

251 env: {

252 ...process.env,

253 LOG_LEVEL: 'silent',

254 NODE_ENV: 'production',

255 ...(encryptionKey ? { OPENCODE_GO_ENCRYPTION_KEY: encryptionKey } : {}),

256 },

257 });

258 let started = false;

259 let timedOut = false;

260 let resolved = false;

261 const timer = setTimeout(() => {

262 timedOut = true;

263 killProcessTree(child);

264 if (!resolved) {

265 resolved = true;

266 reject(new Error('Proxy did not start within the allotted time.'));

267 }

268 }, timeoutMs);