registry / @0xmmo/crew / 0.4.0

@0xmmo/crew@0.4.0

⚠ Under review

Let Claude Code, Codex, and OpenCode agents talk to each other: live shared context and agent-to-agent messaging across sessions.

Static Scan Results

scanned 25d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 98.3 KB of source

Source & flagged code

4 flagged

package.jsonView file

Lines 4-44json

4 "description": "Let Claude Code, Codex, and OpenCode agents talk to each other: live shared context and agent-to-agent messaging across sessions.",

5 "type": "commonjs",

6 "bin": {

7 "crew": "dist/crew.js"

8 },

9 "files": [

10 "dist",

11 ".claude-plugin",

12 ".codex-plugin",

13 "hooks",

14 "README.md",

15 "LICENSE"

16 ],

17 "engines": {

18 "node": ">=18"

19 },

20 "scripts": {

21 "build": "tsc",

22 "typecheck": "tsc --noEmit",

23 "test": "npm run build && node --test test/*.test.cjs",

24 "postinstall": "node dist/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "version": "npm run sync-manifests && git add .claude-plugin/plugin.json .codex-plugin/plugin.json",

26 "send": "npm run build && npm test && npm version patch --no-git-tag-version && npm run sync-manifests && git add -A && git commit -m \"$(node -p \"'v'+require('./package.json').version\")\" && git tag \"$(node -p \"'v'+require('./package.json').version\")\" && npm login && npm publish && git push origin main --tags",

27 "sync-manifests": "node -e \"const fs=require('fs');const v=JSON.parse(fs.readFileSync('package.json','utf8')).version;for(const p of ['.claude-plugin/plugin.json','.codex-plugin/plugin.json']){const j=JSON.parse(fs.readFileSync(p,'utf8'));j.version=v;fs.writeFileSync(p,JSON.stringify(j,null,2)+'\\n')}console.log('manifests synced to '+v)\""

28 },

29 "keywords": [

30 "claude",

31 "claude-code",

32 "codex",

33 "openai-codex",

34 "hooks",

35 "context",

36 "multi-agent",

37 "cli",

38 "sessions",

39 "agents",

40 "terminal",

41 "ndjson",

42 "opencode",

43 "opencode-plugin"

44 ],

dist/settings.jsView file

Lines 1-30javascript

1"use strict";

2/**

3 * settings.ts — wire crew's context hook into Claude Code, Codex, and OpenCode.

4 *

5 * Claude and Codex use the same hook event/config shape: crew is merged into

6 * each user hook file without touching unrelated settings, and never written

7 * over a file we cannot parse. OpenCode has no hook file; its "install" is a

8 * generated plugin dropped into the global plugins directory (see opencode.ts).

9 */

10Object.defineProperty

dist/crew.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/crew.js#virtual:normalized:round1View on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js || true

High

@0xmmo/crew@0.4.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code