PkgRadar

PyPI · pypi.org

agent-airlock

Python Bun Js Exec: Python file references the Bun JavaScript runtime — cross-language execution

Why PkgRadar flagged 0.8.26

SeveritySignalEvidence
highPython Bun Js ExecPython file references the Bun JavaScript runtime — cross-language execution · agent_airlock-0.8.26/src/agent_airlock/policy_presets.py
highPy Runtime Dynamic Dangerous ImportDynamic __import__('sys') — reflection bypass for static checks. · agent_airlock-0.8.26/src/agent_airlock/cli/pack.py

Scanned versions

VersionVerdictScoreScanned (UTC)
0.8.26High risk882026-06-13
0.8.25High risk882026-06-13
0.8.24High risk882026-06-13
0.8.23High risk882026-06-11
0.8.22High risk882026-06-11
0.8.21High risk882026-06-09
0.8.20High risk482026-06-08
0.8.19High risk482026-06-07
0.8.10High risk482026-06-06
0.8.6High risk482026-06-06
0.8.12High risk482026-06-06
0.8.11High risk482026-06-06
0.8.13High risk482026-06-06
0.8.15High risk482026-06-06
0.8.16High risk482026-06-06
0.8.17High risk482026-06-06
0.8.14High risk482026-06-06
0.8.18High risk482026-06-06
0.8.9High risk482026-05-30

Campaign attribution

Part of the Shai-Hulud (PyPI) campaign.

Block this in CI

PkgRadar gates agent-airlock (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi agent-airlock==0.8.26
Start free — 25 scans / moView full evidence