github.com / PrimeIntellect-ai
PrimeIntellect-ai/ prime-agent
TypeScript·1258 files·commit e260085·scanned 9m ago·cached ✓
15/100
LOW RISK
Minor findings consistent with the project type. Nothing reachable from install hooks.
score capped at 15 — 21,283+ stars — findings likely false positives
verdict accurate?
21,283 stars
Partial architecture graph
threat-state: lowlive
FINDINGS ░▒▓
criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.packages/agent/test/utils/calculate.ts
try {
const result = new Function(`return ${expression}`)();
return { content: [{ type: "text", text: `${expression} = ${result}` }], details: undefined };
} catch (e: any) {+5criticalchild_process / exec usageExecuting shell commands can be used to download and run malware, exfiltrate data, or modify system files.packages/coding-agent/src/cli/npm-native-bridge.ts
try {
child = spawn("sh", [command, version], {
env: environment,
stdio: ["ignore", "pipe", "pipe"],+8warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.prime-agent-runtime/src/rlm/bash.py
if _IS_POSIX:
self._proc = subprocess.Popen(
[_shell(), "-c", script],
cwd=os.getcwd(),+4criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.prime-agent-runtime/src/rlm/repl.py
for code_obj in codes:
value = eval(code_obj, ns) # noqa: S307 - executing the model's cell is the runtime's job
if code_obj.co_flags & inspect.CO_COROUTINE:
value = a...+8criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.prime-agent-runtime/src/rlm/repl.py
if tree.body:
codes.append(compile(tree, filename, "exec", flags=flags, dont_inherit=True))
if trailing is not None:
codes.append(compile(trailing, filename, "eval", flags=flag...+7warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.scripts/benchmarks/worker.py
with log.open("a") as stream:
subprocess.run(
command,
cwd=cwd,+4criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.scripts/evals/short_swe/tests/test_short_swe.py
namespace = {"resolve_env": lambda env: dict(env)}
exec("class Task:\n" + harbor.read_text(), namespace)
task = namespace["Task"]()
task.data = SimpleNamespace(+7criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.packages/coding-agent/examples/extensions/doom-overlay/doom-engine.ts
const nativeRequire = createRequire(doomJsPath);
const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode);
moduleFunc(moduleExports, moduleExports.e...+5criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.packages/coding-agent/test/compiled-artifact.test.ts
`${readFileSync(extensionPath, "utf8")}
const hot = new Function("value", "for (let i = 0; i < 128; i++) value = (Math.imul(value, 1664525) + 1013904223) >>> 0; return value;");
let value = 1;
for ...+5criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.prime-agent-runtime/test/test_repl.py
# priv.__globals__ is the private exec dict pn, not ns: drives backfill. self.repl.execute("fn0", "exec('SECRET = 42\\ndef priv():\\n return SECRET', pn:={'__name__': '__mai...+7
infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.packages/ai/src/utils/oauth/openai-codex.ts
const payload = parts[1] ?? "";
const decoded = atob(payload);
return JSON.parse(decoded) as JwtPayload;
} catch {+2infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.packages/coding-agent/src/core/prime-inference-auth.ts
},
Buffer.from(encryptedResult, "base64"),
);
return decrypted.toString("utf-8");+2warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.packages/coding-agent/src/core/kernel/bootstrap.ts+4
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.packages/coding-agent/src/core/refinement/refinement.ts+4
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.packages/coding-agent/src/modes/interactive/components/daxnuts.ts+4
warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.packages/coding-agent/src/core/export-html/index.ts+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.packages/coding-agent/src/core/export-html/index.ts+3
warningHigh-entropy string literalsFound 5 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.packages/coding-agent/src/main.ts+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.packages/coding-agent/src/main.ts+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.packages/agent/src/agent-loop.ts+3
warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.packages/ai/src/cli.ts+3
warningLarge base64-encoded blobA 6144-character base64 blob was found. May hide a remote payload or encoded executable code.packages/coding-agent/src/modes/interactive/components/daxnuts.ts
bbbab8b9b9b6b9b8b5bcbbb8b8b7b4b7b5b2b6b5b2b8b7b4b7b6b3b6b4b1...+3
warningLarge hex-encoded blobA 6144-character hex blob was found. Often used to hide shellcode or C2 addresses.packages/coding-agent/src/modes/interactive/components/daxnuts.ts
bbbab8b9b9b6b9b8b5bcbbb8b8b7b4b7b5b2b6b5b2b8b7b4b7b6b3b6b4b1...+3
infoSuspicious file in repoVery large source file (547KB) — could contain obfuscated payloadpackages/coding-agent/src/core/agent-session.ts+2
infoNative addon dependency"@typescript/native-preview" includes native compiled code. Native addons can hide behavior that static JS analysis cannot see.package.json+2
Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.
1055 files scanned @ e260085 | 9/25/2026 | heuristic scan — always review manually
risk by category
code execution25
network & exfiltration4
file system access0
obfuscation15
supply chain4
owasp / injection0
telemetry
files 1055/1258rules hit 26engine v6commit e260085
github
PrimeIntellect-ai/prime-agent
A self-improving RLM agent for coding workflows and long-running autonomous tasks.
21283
2329
140d
1258 files
1055 scanned(84%)
e260085
architecture░▒▓
entry (0) flagged (145) pkg (130)
530 nodes · 1765 edgesscroll to zoom · click node to jump to finding