Static Scan Results
scanned 2h ago · by rust-scannerStatic analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemShellWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcedist/agents/bw-codex.cjsView file
38module.exports = __toCommonJS(bw_codex_exports);
L39: var import_node_child_process2 = require("node:child_process");
L40: var path3 = __toESM(require("node:path"), 1);
High
Child Process
Package source references child process execution.
dist/agents/bw-codex.cjsView on unpkg · L3838Cross-file remote execution chain: dist/agents/bw-codex.cjs spawns dist/bridge/beyondwork-agent.cjs; helper contains network access plus dynamic code execution.
L38: module.exports = __toCommonJS(bw_codex_exports);
L39: var import_node_child_process2 = require("node:child_process");
L40: var path3 = __toESM(require("node:path"), 1);
...
L57: ZodArray: () => ZodArray,
L58: ZodBase64: () => ZodBase64,
L59: ZodBase64URL: () => ZodBase64URL,
...
L1518: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())))
L1519: } : { success: true, data: result.value };
L1520: };
...
L2602: try {
L2603: new URL(`http://[${payload.value}]`);
L2604: } catch {
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/agents/bw-codex.cjsView on unpkg · L38dist/cli/workblock.cjsView file
1797}
L1798: const execArgv = process4.execArgv ?? [];
L1799: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
High
42635// src/health/engine.ts
L42636: var net4 = __toESM(require("node:net"), 1);
L42637:
L42638: // src/docker/exec.ts
L42639: var import_node_child_process6 = require("node:child_process");
L42640: var DEFAULT_EXEC_TIMEOUT_MS = 6e4;
...
L42648: timeout: options.timeoutMs ?? DEFAULT_EXEC_TIMEOUT_MS,
L42649: env: options.env ?? process.env,
L42650: maxBuffer: 16 * 1024 * 1024
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cli/workblock.cjsView on unpkg · L4263547182source: "checkout",
L47183: command: "git pull && pnpm install (local checkout \u2014 not self-upgradable)"
L47184: };
...
L47188: }
L47189: const npmRoot = await exec("npm", ["root", "-g"], { timeoutMs: 2e4 });
L47190: if (npmRoot.code === 0) {
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/cli/workblock.cjsView on unpkg · L47182dist/bridge/beyondwork-agent.cjsView file
2943sourceCode = this.opts.code.process(sourceCode, sch);
L2944: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L2945: const validate = makeValidate(this, this.scope.get());
High
Eval
Package source references dynamic code evaluation.
dist/bridge/beyondwork-agent.cjsView on unpkg · L2943Findings
6 High2 Medium5 Low
HighChild Processdist/agents/bw-codex.cjs
HighShelldist/cli/workblock.cjs
HighEvaldist/bridge/beyondwork-agent.cjs
HighSame File Env Network Executiondist/cli/workblock.cjs
HighCross File Remote Execution Contextdist/agents/bw-codex.cjs
HighRuntime Package Installdist/cli/workblock.cjs
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License