registry / @brrew/projectbridge / 0.3.23
@brrew/projectbridge@0.3.23
⚠ Under reviewProjectBridge remote host agent CLI
Static Scan Results
scanned 21d ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
3 flaggedlib/lifecycle.jsView file
4Trigger-reachable persistence chain: manifest.bin -> bin/projectbridge.js -> lib/lifecycle.js
L4: const path = require('node:path');
L5: const { spawn } = require('node:child_process');
L6: const PACKAGE = '@brrew/projectbridge';
...
L8: const LINUX_SERVICE = 'projectbridge-remote.service';
L9: const SOURCE_DIR = path.resolve(__dirname, '..');
L10: function versionParts(value) { const m = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(String(value || '')); return m ? [Number(m[1]), Number(m[2]), Number(m[3]), m[4] || ''] ...
...
L12: function isWindowsMachineMode() {
L13: return process.platform === 'win32' && (process.env.PROJECTBRIDGE_SYSTEM === '1' || process.argv.includes('--persistent') || ['install-service', 'uninstall-service'].includes(proce...
L14: }
...
L33: // Run npm's Java
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
lib/lifecycle.jsView on unpkg · L44const path = require('node:path');
L5: const { spawn } = require('node:child_process');
L6: const PACKAGE = '@brrew/projectbridge';
...
L8: const LINUX_SERVICE = 'projectbridge-remote.service';
L9: const SOURCE_DIR = path.resolve(__dirname, '..');
L10: function versionParts(value) { const m = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(String(value || '')); return m ? [Number(m[1]), Number(m[2]), Number(m[3]), m[4] || ''] ...
...
L12: function isWindowsMachineMode() {
L13: return process.platform === 'win32' && (process.env.PROJECTBRIDGE_SYSTEM === '1' || process.argv.includes('--persistent') || ['install-service', 'uninstall-service'].includes(proce...
L14: }
...
L33: // Run npm's JavaScript entry point directly on Windows. Spawning npm.cmd
L34: // through cmd.exe breaks when N
Findings
2 High3 Medium5 Low
HighTrigger Reachable Persistencelib/lifecycle.js
HighSemantic Analysis Limitedbin/projectbridge.js#virtual:string-array:round1
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencelib/lifecycle.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @brrew/projectbridge@0.3.23.
See all versions of @brrew/projectbridge for other recorded verdicts.
- Review the evidence and your use of @brrew/projectbridge@0.3.23 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.