github JavaScript analyzed 2262ef2

emaxe/apiGram

Multi-user Telegram API gateway (MTProto) — REST + WebSocket

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 11 tools

transport stdio · streamable-http · http counts 11 tools · 0 res · 0 prompts permission surface via code analysis

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 2262ef2 · analyzer v33 · 1w ago

suspicious endpoint 1.2.3.4 emaxe-apiGram-2262ef2/test/unit.test.js :1418 assert.equal(parseProxyUrl("http://1.2.3.4").port, 80);

code evidence vv1.2.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 38

fs (weak) emaxe-apiGram-2262ef2/scripts/smoke.mjs :19 import fs from "node:fs";
fs emaxe-apiGram-2262ef2/src/config.js :9 import fs from "node:fs";
fs emaxe-apiGram-2262ef2/src/storage/json.js :1 import fs from "node:fs";
fs emaxe-apiGram-2262ef2/src/storage/jsonl.js :1 import fs from "node:fs";
fs (weak) emaxe-apiGram-2262ef2/test/unit.test.js :5 import fs from "node:fs";

net (weak) emaxe-apiGram-2262ef2/scripts/smoke.mjs :81 const res = await fetch(`${BASE}${url}`, { method, headers, body: payload });
net emaxe-apiGram-2262ef2/src/telegram/proxySocket.js :12 import net from "node:net";
net (weak) emaxe-apiGram-2262ef2/test/unit.test.js :54 import net from "node:net";

secrets (weak) emaxe-apiGram-2262ef2/scripts/smoke.mjs :116 let token = process.env.TOKEN || "";
secrets emaxe-apiGram-2262ef2/src/config.js :81 adminToken: process.env.ADMIN_TOKEN || "",