npm JavaScript analyzed 5.222.2

agent-afk

v5.222.2

Open-source coding-agent harness you can actually change — own the loop (prompts, gates, routing, skills, terminal states), use any model, run long tasks while you're away.

maintainer: griffinwork40
licence: Apache-2.0
first seen: 2026-06-08
last seen: 2026-09-19
releases · 30d: 418
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v5.222.2 · analyzer v33 · 1h ago

skills & prompt files 19

danger signals2

suspicious endpoint api.telegram.org expected for this server's purpose package/dist/cli.mjs :423 =y(()=>{"use strict";zf();RI();F();hAe="https://api.telegram.org"});function yAe(e=Lu){return async(t,n)=>{if(!t||typeof t!="object")return{content:"Invalid input: expected an object",isError:!0};let
suspicious endpoint api.telegram.org expected for this server's purpose package/dist/index.mjs :267 c=m(()=>{"use strict";xm();fe();P();VK="https://api.telegram.org"});function QK(e=Js){return async(t,n)=>{if(!t||typeof t!="object")return{content:"Invalid input: expected an object",isError:!0};let r

code evidence v5.222.2 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1463

filesystem 2

fs package/dist/postinstall.mjs :14 import { existsSync, readFileSync } from 'node:fs';
fs (weak) package/scripts/postinstall.mjs :14 import { existsSync, readFileSync } from 'node:fs';

shell / exec 9

shell package/dist/cli.mjs :288 `)}`}function jw(e,t){try{let n=t??Intl.DateTimeFormat().resolvedOptions().timeZone??"UTC",r=new Intl.DateTimeFormat("en-CA",{timeZone:n,year:"numeric",month:"2-digit",day:"2-digit"}).formatToParts(e)
shell package/dist/index.mjs :178 `)}`}function pc(e,t){try{let n=t??Intl.DateTimeFormat().resolvedOptions().timeZone??"UTC",r=new Intl.DateTimeFormat("en-CA",{timeZone:n,year:"numeric",month:"2-digit",day:"2-digit"}).formatToParts(e)
shell package/dist/postinstall.mjs :13 import { execSync, execFileSync } from 'node:child_process';
shell package/dist/telegram.mjs :324 `)}`}function Ql(t,e){try{let n=e??Intl.DateTimeFormat().resolvedOptions().timeZone??"UTC",r=new Intl.DateTimeFormat("en-CA",{timeZone:n,year:"numeric",month:"2-digit",day:"2-digit"}).formatToParts(t)
shell package/dist/web-ui-assets/assets/blade-2xfisSek.js :1 es|procedurecolumns|prepare|error(msg)?|exec(ute)?|field_(scale|num|name|type|precision|len)|foreignkeys|free_result|fetch_(into|object|array|row)|longreadlen|autocommit|rollback|result(_all)?|gettype
shell package/dist/web-ui-assets/assets/cobol-nBiQ_Alo.js :1 nguage.figurative.cobol"},{"begin":"(?i:exec(?:\\\\s+sqlims|\\\\s+sql))","contentName":"meta.embedded.block.openesql","end":"(?i:end-exec)","name":"keyword.verb.cobol","patterns":[{"match":"^(\\\\s*\\
shell package/dist/web-ui-assets/assets/index-DpEHdhDh.js :153 }get source(){return $(this,he)||"(?:)"}exec(r){if(!$(this,Y)){const{lazyCompile:s,...o}=this.rawOptions;W(this,Y,new ae($(this,he),this.flags,o))}const n=this.global||this.sticky,i=this.lastIndex;if(
shell package/dist/web-ui-assets/assets/php-Csjmro_R.js :1 es|procedurecolumns|prepare|error(msg)?|exec(ute)?|field_(scale|num|name|type|precision|len)|foreignkeys|free_result|fetch_(into|object|array|row)|longreadlen|autocommit|rollback|result(_all)?|gettype
shell (weak) package/scripts/postinstall.mjs :13 import { execSync, execFileSync } from 'node:child_process';

network 7

net package/dist/cli.mjs :347 i}async function HEe(e){try{let t=await fetch(BEe,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({grant_type:"refresh_token",refresh_token:e,client_id:NEe}),signal:Abor
net package/dist/index.mjs :236 ,s}async function eK(e){try{let t=await fetch(Y1,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({grant_type:"refresh_token",refresh_token:e,client_id:V1}),signal:AbortS
net package/dist/telegram.mjs :383 ,s}async function mV(t){try{let e=await fetch(uV,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({grant_type:"refresh_token",refresh_token:t,client_id:dV}),signal:AbortS
net package/dist/web-ui-assets/assets/blade-2xfisSek.js :1 sult|autocommit|rollback|report|refresh|fetch(_(object|fields|field(_direct)?|assoc|all|array|row))?|rpl_(parse_enabled|probe|query_type)|release_savepoint|reap_async_query|real_(connect|escape_string
net package/dist/web-ui-assets/assets/hack-BWmVpMyf.js :1 ode)|8)|id)|ping|e(rrors|xpunge)|qprint|fetch(structure|header|text|_overview|mime|body)|l(sub|ist(s(can|ubscribed)|mailbox)?|ast_error)|a(ppend|lerts)|r(e(name(mailbox)?|open)|fc822_(parse_(headers|a
net package/dist/web-ui-assets/assets/index-C8iQq5Dx.js :1 (o){if(o.ep)return;o.ep=!0;const c=i(o);fetch(o.href,c)}})();function od(t){return t&&t.__esModule&&Object.prototype.hasOwnProperty.call(t,"default")?t.default:t}var Zc={exports:{}},sa={};/**
net package/dist/web-ui-assets/assets/php-Csjmro_R.js :1 sult|autocommit|rollback|report|refresh|fetch(_(object|fields|field(_direct)?|assoc|all|array|row))?|rpl_(parse_enabled|probe|query_type)|release_savepoint|reap_async_query|real_(connect|escape_string

install hooks 1

postinstall package/package.json :104 node dist/postinstall.mjs || node scripts/postinstall.mjs || true

declared dependencies 36

@modelcontextprotocol/sdk@^1.29.0
@anthropic-ai/sdk@^0.74.0
@mozilla/readability@^0.6.0
@vscode/ripgrep@^1.18.0
ansi-escapes@^7.3.0
better-sqlite3@^13.0.0
chalk@^5.3.0
commander@^12.1.0
dotenv@^16.4.7
emphasize@^7.0.0
jsdom@^29.1.1
log-update@^8.0.0

show 24 more

marked@^17.0.5
node-cron@^4.2.1
openai@^6.38.0
ora@^8.1.1
playwright@^1.49.0
string-width@^8.2.0
telegraf@^4.16.3
turndown@^7.2.4
undici@^7.27.0
wrap-ansi@^10.0.0
zod@^4.3.6
@types/better-sqlite3@^9.6.0
@types/jest@^30.0.0
@types/jsdom@^28.0.3
@types/node@^22.19.10
@types/node-cron@^3.0.11
@types/turndown@^5.0.6
@vitest/coverage-v8@^2.1.8
@xterm/headless@^6.0.0
esbuild@^0.28.0
node-pty@^1.1.0
tsx@^4.19.2
typescript@^5.7.3
vitest@^2.1.8

clipboard 3

clipboard shell call package/dist/cli.mjs :169 d. Reuses the platform-detection logic (pbcopy on macOS, clip on Windows, wl-copy / xclip / xsel on Linux) with an OSC 52 fallback for SSH sessions. Returns success or a graceful failure message when
clipboard shell call package/dist/index.mjs :59 d. Reuses the platform-detection logic (pbcopy on macOS, clip on Windows, wl-copy / xclip / xsel on Linux) with an OSC 52 fallback for SSH sessions. Returns success or a graceful failure message when
clipboard shell call package/dist/telegram.mjs :322 d. Reuses the platform-detection logic (pbcopy on macOS, clip on Windows, wl-copy / xclip / xsel on Linux) with an OSC 52 fallback for SSH sessions. Returns success or a graceful failure message when