registry / @brrew/projectbridge / 0.3.4
@brrew/projectbridge@0.3.4
⚠ Under reviewProjectBridge remote host agent CLI
Static Scan Results
scanned 22d ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flaggedbin/projectbridge.jsView file
6const path = require('node:path');
L7: const { spawn } = require('node:child_process');
L8: const { setTimeout: sleep } = require('node:timers/promises');
High
Child Process
Package source references child process execution.
bin/projectbridge.jsView on unpkg · L66const path = require('node:path');
L7: const { spawn } = require('node:child_process');
L8: const { setTimeout: sleep } = require('node:timers/promises');
...
L11: const VERSION = '0.3.4';
L12: const ENV_SERVER = process.env.PROJECTBRIDGE_SERVER ? process.env.PROJECTBRIDGE_SERVER.replace(/\/$/, '') : null;
L13: function cliServer() {
...
L16: if (i < 0) return null;
L17: if (!args[i + 1] || args[i + 1].startsWith('--') || args.indexOf('--server', i + 1) >= 0) throw new Error('Use --server <https://your-bridge.example> with exactly one server URL.')...
L18: return args[i + 1].replace(/\/$/, '');
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/projectbridge.jsView on unpkg · L6lib/lifecycle.jsView file
Findings
4 High2 Medium5 Low
HighChild Processbin/projectbridge.js
HighShelllib/lifecycle.js
HighSame File Env Network Executionbin/projectbridge.js
HighSemantic Analysis Limitedbin/projectbridge.js#virtual:string-array:round1
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @brrew/projectbridge@0.3.4.
See all versions of @brrew/projectbridge for other recorded verdicts.
- Review the evidence and your use of @brrew/projectbridge@0.3.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.