github.com/cloudflare/agents marked as hostile #1

imjasonh commented 2026年06月03日 03:10:46 +02:00

https://lab.atomdrift.org/file/0aa17ae1434d2d8f0012d9469048f95058b86f8c17a4afe054f406d0d5365164

It claims 24 findings for supply-chain/trojanized/app - "App package targets credentials for HTTP exfiltration" but all the evidence seems like pretty innocuous mostly JS stuff, and a quick browse through the repo finds no Go code at all. I'm not totally sure why it was in the Go proxy in the first place.

In any case, this seems like a spurious finding, which raised my eyebrow because it was a seemingly widely-depended-upon, hostile package.

edit: first! :)

https://lab.atomdrift.org/file/0aa17ae1434d2d8f0012d9469048f95058b86f8c17a4afe054f406d0d5365164 It claims 24 findings for `supply-chain/trojanized/app` - "App package targets credentials for HTTP exfiltration" but all the evidence seems like pretty innocuous mostly JS stuff, and a quick browse through the repo finds no Go code at all. I'm not totally sure why it was in the Go proxy in the first place. In any case, this seems like a spurious finding, which raised my eyebrow because it was a seemingly widely-depended-upon, hostile package. edit: first! :)

tstromberg commented 2026年06月03日 17:09:44 +02:00

Thanks! I'm taking a look at it now.

Thanks! I'm taking a look at it now.

tstromberg commented 2026年06月03日 20:01:48 +02:00

I've got a local set of trait fixes, but this will need a small engine update to land an updated density-based metric that works better for large samples like this: atomdrift/filefacts@e0ce93cf4c

I've got a local set of trait fixes, but this will need a small engine update to land an updated density-based metric that works better for large samples like this: https://codeberg.org/atomdrift/filefacts/commit/e0ce93cf4c50f3d089fc8c4cee1d5b76b2b93f3c

tstromberg commented 2026年06月03日 20:39:26 +02:00

Will ship later today with cleave/litmus v2.0.0rc4

Will ship later today with cleave/litmus v2.0.0rc4