registry / @annix/claude-swarm / 0.1.36

@annix/claude-swarm@0.1.36

Manage multiple parallel Claude CLI sessions with worktree isolation and dev server lifecycle management

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 127 KB of source

Source & flagged code

5 flagged

dist/bin.jsView file

Lines 1-62javascript

1#!/usr/bin/env node

2import { execSync } from "node:child_process";

3import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L1

4import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";

5import { homedir } from "node:os";

6import { dirname, join } from "node:path";

7import { fileURLToPath, pathToFileURL } from "node:url";

8const projectRoot = join(dirname(fileURLToPath(import.meta.url)), "..");

9const hashFile = (p) => createHash("sha256").update(readFileSync(p)).digest("hex");

10const hashDeps = () => {

11 const lock = join(projectRoot, "package-lock.json");

12 return existsSync(lock) ? hashFile(lock) : "";

13};

14const findTsFiles = (dir, acc = []) => {

15 for (const e of readdirSync(dir, { withFileTypes: true })) {

16 const p = join(dir, e.name);

17 if (e.isDirectory())

18 findTsFiles(p, acc);

19 else if (e.name.endsWith(".ts"))

20 acc.push(p);

21 }

22 return acc.sort();

23};

24const hashSrc = () => {

25 const h = createHash("sha256");

26 for (const f of findTsFiles(join(projectRoot, "src")))

27 h.update(hashFile(f));

28 return h.digest("hex");

29};

30const stored = (p) => {

31 try {

32 return readFileSync(p, "utf8").trim();

33 }

34 catch {

35 return "";

36 }

37};

38const srcDir = join(projectRoot, "src");

39if (existsSync(srcDir)) {

40 const depsHashFile = join(projectRoot, "node_modules", ".install-hash");

41 if (!existsSync(join(projectRoot, "node_modules")) || stored(depsHashFile) !== hashDeps()) {

42 console.error("Installing dependencies...");

43 execSync("npm install --silent", { cwd: projectRoot, stdio: "inherit" });

44 writeFileSync(depsHashFile, hashDeps());

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin.jsView on unpkg · L42

45 }

46 const buildHashFile = join(projectRoot, "dist", ".build-hash");

47 const srcHash = hashSrc();

48 if (!existsSync(join(projectRoot, "dist", "index.js")) || stored(buildHashFile) !== srcHash) {

49 console.error("Building...");

50 execSync("npm run build --silent", { cwd: projectRoot, stdio: "inherit" });

51 writeFileSync(buildHashFile, srcHash);

52 }

53}

54const CLAUDE_CODE_PACKAGE = "@anthropic-ai/claude-code";

55const updateCacheFile = join(homedir(), ".claude", "swarm-update-check");

56const oneDaySeconds = 86400;

57const versionRegex = /(\d+)\.(\d+)\.(\d+)/;

58const localClaudeVersion = () => {

59 try {

60 const out = execSync("claude --version", {

61 encoding: "utf8",

62 stdio: ["ignore", "pipe", "ignore"],

Lines 107-129javascript

107 if (!local || !remote)

108 return;

109 if (local === remote) {

110 writeUpdateStamp();

111 return;

112 }

113 if (minorOf(local) === minorOf(remote)) {

dist/index.jsView file

Lines 191-231javascript

191}

192function createDesktopShortcut(project) {

193 if (process.platform !== "win32")

194 return false;

195 try {

196 const nativeDesktop = join

timer.ps1View file

•path = timer.ps1 kind = build_helper sizeBytes = 1957 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

timer.ps1View on unpkg

Source & flagged code

5 flagged · loading source

dist/bin.jsView file

1#!/usr/bin/env node L2: import { execSync } from "node:child_process"; L3: import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L1

42console.error("Installing dependencies..."); L43: execSync("npm install --silent", { cwd: projectRoot, stdio: "inherit" }); L44: writeFileSync(depsHashFile, hashDeps());

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin.jsView on unpkg · L42

127checkClaudeCodeUpdate(process.argv.includes("--check-updates")); L128: await import(pathToFileURL(join(projectRoot, "dist", "index.js")).href); L129: //# sourceMappingURL=bin.js.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin.jsView on unpkg · L127

dist/index.jsView file

211const nativeLnk = join(nativeDesktop, lnkName); L212: const psPath = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"; L213: const createScript = join(tmpdir(), `claude-swarm-mkshortcut-${Date.now()}.ps1`);

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L211

timer.ps1View file

•path = timer.ps1 kind = build_helper sizeBytes = 1957 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

timer.ps1View on unpkg

Findings

3 High5 Medium4 Low

HighChild Processdist/bin.js

HighShelldist/index.js

HighRuntime Package Installdist/bin.js

MediumDynamic Requiredist/bin.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertimer.ps1

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

5 flagged

dist/bin.jsView file

Lines 1-62javascript

1#!/usr/bin/env node

2import { execSync } from "node:child_process";

3import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L1

4import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";

5import { homedir } from "node:os";

6import { dirname, join } from "node:path";

7import { fileURLToPath, pathToFileURL } from "node:url";

8const projectRoot = join(dirname(fileURLToPath(import.meta.url)), "..");

9const hashFile = (p) => createHash("sha256").update(readFileSync(p)).digest("hex");

10const hashDeps = () => {

11 const lock = join(projectRoot, "package-lock.json");

12 return existsSync(lock) ? hashFile(lock) : "";

13};

14const findTsFiles = (dir, acc = []) => {

15 for (const e of readdirSync(dir, { withFileTypes: true })) {

16 const p = join(dir, e.name);

17 if (e.isDirectory())

18 findTsFiles(p, acc);

19 else if (e.name.endsWith(".ts"))

20 acc.push(p);

21 }

22 return acc.sort();

23};

24const hashSrc = () => {

25 const h = createHash("sha256");

26 for (const f of findTsFiles(join(projectRoot, "src")))

27 h.update(hashFile(f));

28 return h.digest("hex");

29};

30const stored = (p) => {

31 try {

32 return readFileSync(p, "utf8").trim();

33 }

34 catch {

35 return "";

36 }

37};

38const srcDir = join(projectRoot, "src");

39if (existsSync(srcDir)) {

40 const depsHashFile = join(projectRoot, "node_modules", ".install-hash");

41 if (!existsSync(join(projectRoot, "node_modules")) || stored(depsHashFile) !== hashDeps()) {

42 console.error("Installing dependencies...");

43 execSync("npm install --silent", { cwd: projectRoot, stdio: "inherit" });

44 writeFileSync(depsHashFile, hashDeps());

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin.jsView on unpkg · L42

45 }

46 const buildHashFile = join(projectRoot, "dist", ".build-hash");

47 const srcHash = hashSrc();

48 if (!existsSync(join(projectRoot, "dist", "index.js")) || stored(buildHashFile) !== srcHash) {

49 console.error("Building...");

50 execSync("npm run build --silent", { cwd: projectRoot, stdio: "inherit" });

51 writeFileSync(buildHashFile, srcHash);

52 }

53}

54const CLAUDE_CODE_PACKAGE = "@anthropic-ai/claude-code";

55const updateCacheFile = join(homedir(), ".claude", "swarm-update-check");

56const oneDaySeconds = 86400;

57const versionRegex = /(\d+)\.(\d+)\.(\d+)/;

58const localClaudeVersion = () => {

59 try {

60 const out = execSync("claude --version", {

61 encoding: "utf8",

62 stdio: ["ignore", "pipe", "ignore"],

Lines 107-129javascript

107 if (!local || !remote)

108 return;

109 if (local === remote) {

110 writeUpdateStamp();

111 return;

112 }

113 if (minorOf(local) === minorOf(remote)) {

dist/index.jsView file

Lines 191-231javascript

191}

192function createDesktopShortcut(project) {

193 if (process.platform !== "win32")

194 return false;

195 try {

196 const nativeDesktop = join

timer.ps1View file

•path = timer.ps1 kind = build_helper sizeBytes = 1957 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

timer.ps1View on unpkg