Skills/npm/rea-agents

rea-agents@6.8.0

CAUTION

Publisher claims: "Reverse engineer anything from your terminal or agent with one CLI and MCP server." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher morluto · joined 0 days agoInstalls 634KLast detonated 2 h ago
Dispute verdict

Behavior trace

Honeypot run · 4 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
3.5sprocessdependency install exit 1
3.7sprocessexec /usr/bin/timeout
3.7sprocessexited 1: Node.js v22.23.4
3.7sclaimedno tools/list reply (exit 1)
3.7sprocessscript backend runs setup only

Static findings

CRITICAL
Access to sensitive file pathsdist/composition/adb.js:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/composition/evm.js:6 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/composition/jeb.js:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/cli.js:68 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/adb/AdbProvider.js:523 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/composition/pcap.js:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/doctorRuntime.js:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/mcp/main.js:467 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/mcp/main.js:511 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/main.js:120 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/composition/wasm.js:6 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/mcpDoctor.js:246 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/main.js:15 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/mcp/main.js:560 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/main.js:66 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsscripts/rea.mjs:140 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
npx invocation of non-well-known packageREADME.md:81 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageREADME.md:113 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Access to sensitive file pathsscripts/prepare.mjs:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/serverIdentity.js:34 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsscripts/prepack.mjs:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsscripts/rea.mjs:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
npx invocation of non-well-known packageREADME.md:25 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Access to sensitive file pathsscripts/rea.mjs:27 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsscripts/rea.mjs:109 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
npx invocation of non-well-known packageREADME.md:158 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packagedist/identity.js:13 · npx invocation of non-well-known package — may execute untrusted code
AST06
MEDIUM
MCP server using network transport (SSE/HTTP)dist/mcp/main.js:489 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
HIGH
npx invocation of non-well-known packageREADME.md:162 · npx invocation of non-well-known package — may execute untrusted code
AST06