registry / @brrew/projectbridge / 0.3.17
@brrew/projectbridge@0.3.17
⚠ Under reviewProjectBridge remote host agent CLI
Static Scan Results
scanned 21d ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
3 flaggedlib/lifecycle.jsView file
4Trigger-reachable persistence chain: manifest.bin -> bin/projectbridge.js -> lib/lifecycle.js
L4: const path = require('node:path');
L5: const { spawn } = require('node:child_process');
L6: const PACKAGE = '@brrew/projectbridge';
...
L8: const LINUX_SERVICE = 'projectbridge-remote.service';
L9: const SOURCE_DIR = path.resolve(__dirname, '..');
L10: function versionParts(value) { const m = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(String(value || '')); return m ? [Number(m[1]), Number(m[2]), Number(m[3]), m[4] || ''] ...
...
L12: function runtimeDir() {
L13: const root = process.platform === 'win32' ? (process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local')) : (process.env.XDG_DATA_HOME || path.join(os.homedir(), '.loca...
L14: return path.join(root, 'projectbridge'
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
lib/lifecycle.jsView on unpkg · L44const path = require('node:path');
L5: const { spawn } = require('node:child_process');
L6: const PACKAGE = '@brrew/projectbridge';
...
L8: const LINUX_SERVICE = 'projectbridge-remote.service';
L9: const SOURCE_DIR = path.resolve(__dirname, '..');
L10: function versionParts(value) { const m = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(String(value || '')); return m ? [Number(m[1]), Number(m[2]), Number(m[3]), m[4] || ''] ...
...
L12: function runtimeDir() {
L13: const root = process.platform === 'win32' ? (process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local')) : (process.env.XDG_DATA_HOME || path.join(os.homedir(), '.loca...
L14: return path.join(root, 'projectbridge', 'runtime');
...
L21: const child = spawn(command, args, { windowsHide: true, shell: needsWin
Findings
2 High3 Medium5 Low
HighTrigger Reachable Persistencelib/lifecycle.js
HighSemantic Analysis Limitedbin/projectbridge.js#virtual:string-array:round1
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencelib/lifecycle.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @brrew/projectbridge@0.3.17.
See all versions of @brrew/projectbridge for other recorded verdicts.
- Review the evidence and your use of @brrew/projectbridge@0.3.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.