0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
rafaelsene01-agent-flow
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting rafaelsene01-agent-flow, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-6111 | Unknown | Malicious code in @rafaelsene01/agent-flow (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3855afe87d31e428546f226e1da9236cd0e4dc45a477afb9f6ba1c707a4b05ec) The package's main and bin entry, dist/agent-flow.js, is shipped as a heavily obfuscated bundle produced by javascript-obfuscator (declared as a devDependency in package.json). After deobfuscation, the runtime behavior matches the advertised purpose: a local Express server bound to 127.0.0.1:5522 that talks to api.github.com using the user-provided GH_TOKEN/GITHUB_TOKEN environment variable (or the local `gh auth token` output), manages git |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3855afe87d31e428546f226e1da9236cd0e4dc45a477afb9f6ba1c707a4b05ec) The package's main and bin entry, dist/agent-flow.js, is shipped as a heavily obfuscated bundle produced by javascript-obfuscator (declared as a devDependency in package.json). After deobfuscation, the runtime behavior matches the advertised purpose: a local Express server bound to 127.0.0.1:5522 that talks to api.github.com using the user-provided GH_TOKEN/GITHUB_TOKEN environment variable (or the local `gh auth token` output), manages git