registry / @annix/claude-swarm / 0.1.36

@annix/claude-swarm@0.1.36

Manage multiple parallel Claude CLI sessions with worktree isolation and dev server lifecycle management

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 127 KB of source

Source & flagged code

5 flagged

dist/bin.jsView file

Lines 1-62javascript

1#!/usr/bin/env node

2import { execSync } from "node:child_process";

3import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L1

4import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";

Source & flagged code

5 flagged · loading source

dist/bin.jsView file

1#!/usr/bin/env node L2: import { execSync } from "node:child_process"; L3: import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L1

42console.error("Installing dependencies..."); L43: execSync("npm install --silent", { cwd: projectRoot, stdio: "inherit" }); L44: writeFileSync(depsHashFile, hashDeps());

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin.jsView on unpkg · L42

127checkClaudeCodeUpdate(process.argv.includes("--check-updates")); L128: await import(pathToFileURL(join(projectRoot, "dist", "index.js")).href); L129: //# sourceMappingURL=bin.js.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin.jsView on unpkg · L127

dist/index.jsView file

211const nativeLnk = join(nativeDesktop, lnkName); L212: const psPath = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"; L213: const createScript = join(tmpdir(), `claude-swarm-mkshortcut-${Date.now()}.ps1`);

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L211

timer.ps1View file

•path = timer.ps1 kind = build_helper sizeBytes = 1957 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

timer.ps1View on unpkg

Findings

3 High5 Medium4 Low

HighChild Processdist/bin.js

HighShelldist/index.js

HighRuntime Package Installdist/bin.js

MediumDynamic Requiredist/bin.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertimer.ps1

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Lines 107-129javascript

107 if (!local || !remote)

108 return;

109 if (local === remote) {

110 writeUpdateStamp();

111 return;

112 }

113 if (minorOf(local) === minorOf(remote)) {

114 console.error(`Auto-updating Claude Code (patch): ${local} -> ${remote}`);

115 try {

116 execSync(`npm i -g ${CLAUDE_CODE_PACKAGE}`, { stdio: "ignore" });

117 writeUpdateStamp();

118 }

119 catch { }

120 return;

121 }

122 console.error("");

123 console.error(`Claude Code update available: ${local} -> ${remote} (minor/major)`);

124 console.error(` npm i -g ${CLAUDE_CODE_PACKAGE}`);

125 console.error("");

126};

127checkClaudeCodeUpdate(process.argv.includes("--check-updates"));

128await import(pathToFileURL(join(projectRoot, "dist", "index.js")).href);

129//# sourceMappingURL=bin.js.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin.jsView on unpkg · L127

dist/index.jsView file

Lines 191-231javascript

191}

192function createDesktopShortcut(project) {

193 if (process.platform !== "win32")

194 return false;

195 try {

196 const nativeDesktop = join(homedir(), "Desktop");

197 const parallelsDesktop = "C:\\Mac\\Home\\Desktop";

198 const isParallels = existsSync(parallelsDesktop);

199 if (!existsSync(nativeDesktop)) {

200 mkdirSync(nativeDesktop, { recursive: true });

201 }

202 const swarmScript = join(project.path, "claude-swarm.ps1");

203 if (!existsSync(swarmScript)) {

204 log.warn(`No claude-swarm.ps1 found in ${project.path}`);

205 return false;

206 }

207 const safeName = project.name.replace(/[^a-zA-Z0-9-_]/g, "");

208 const wrapperPath = join(nativeDesktop, `${safeName}.ps1`);

209 writeFileSync(wrapperPath, `$env:PATH = [System.Environment]::GetEnvironmentVariable("PATH", "Machine") + ";" + [System.Environment]::GetEnvironmentVariable("PATH", "User")\r\n\r\nSet-Location "${project.path}"\r\n& ".\\claude-swarm.ps1"\r\n`, "utf-8");

210 const lnkName = `${project.name}.lnk`;

211 const nativeLnk = join(nativeDesktop, lnkName);

212 const psPath = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe";

213 const createScript = join(tmpdir(), `claude-swarm-mkshortcut-${Date.now()}.ps1`);

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L211

214 writeFileSync(createScript, `$WshShell = New-Object -ComObject WScript.Shell\r\n$s = $WshShell.CreateShortcut('${nativeLnk}')\r\n$s.TargetPath = '${psPath}'\r\n$s.Arguments = '-ExecutionPolicy Bypass -File ${wrapperPath}'\r\n$s.WorkingDirectory = '${project.path}'\r\n$s.IconLocation = '${psPath},0'\r\n$s.Description = 'Claude Swarm - ${project.name}'\r\n$s.Save()\r\n`, "utf-8");

215 execSync(`powershell -NoProfile -ExecutionPolicy Bypass -File "${createScript}"`, {

216 stdio: "pipe",

217 });

218 try {

219 unlinkSync(createScript);

220 }

221 catch { }

222 if (isParallels) {

223 const macLnk = join(parallelsDesktop, lnkName);

224 const data = readFileSync(nativeLnk);

225 writeFileSync(macLnk, data);

226 }

227 return true;

228 }

229 catch (err) {

230 log.error(`Failed to create shortcut: ${err.message}`);

231 return false;