registry / @buffbirb/unclaude / 1.0.29

@buffbirb/unclaude@1.0.29

An opinionated AI dev tool setup script with a terminal UI. Configure privacy, code intelligence, and tool wrappers for Claude Code and OpenCode.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 142 KB of source, external domains: api.github.com, astral.sh, example.com, github.com, raw.githubusercontent.com

Source & flagged code

4 flagged

dist/sbx.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// Sandbox launcher for `container run`. Self-contained: only node:* builtins,

3// no imports from common.ts/ghapp.ts, so this single compiled file can be

4// copied to ~/.unclaude/share/sbx.js and run standalone by the `sbx`

5// wrapper (see common.ts:sbxWrapperContent). Replaces the old generated bash

6// script (see docs/image-paste.md §10 for why).

7import { spawn, spawnSync, execFileSync } from 'node:child_process';

8import { createServer } from 'node:http';

High

Child Process

Package source references child process execution.

dist/sbx.jsView on unpkg · L6

9import crypto from 'node:crypto';

10import { existsSync, mkdtempSync, writeFileSync, readFileSync, rmSync, unlinkSync, chmodSync, } from 'node:fs';

11import { homedir, tmpdir } from 'node:os';

12import { basename, join } from 'node:path';

13const HOME = homedir();

14const UNCLAUDE_DIR = join(HOME, '.unclaude');

15const SHARE_DIR = join(UNCLAUDE_DIR, 'share');

16const CACHE_DIR = join(HOME, '.cache', 'unclaude');

17const GH_APPS_DIR = join(UNCLAUDE_DIR, 'github-apps');

18function ghAppConfigPath(owner) {

19 const p = join(GH_APPS_DIR, `${owner}.json`);

20 return existsSync(p) ? p : null;

21}

22const GH_APP_KEYCHAIN = 'unclaude-container-github-app';

23const CLIP_BRIDGE_LABEL = 'com.unclaude.clipbridge';

24const CLIP_BRIDGE_PLIST = join(HOME, 'Library', 'LaunchAgents', `${CLIP_BRIDGE_LABEL}.plist`);

25function runOut(cmd, args = []) {

26 const r = spawnSync(cmd, args, { encoding: 'utf8' });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/sbx.jsView on unpkg · L6

dist/common.jsView file

Lines 346-386javascript

346 mkdirSync(dirname(filePath), { recursive: true });

347 writeFileSync(filePath, JSON.stringify(data, null, 2) + '\n');

348}

349export function patchJson(filePath, patch

assets/xclip-shim.shView file

•path = assets/xclip-shim.sh kind = build_helper sizeBytes = 1009 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/xclip-shim.shView on unpkg

Source & flagged code

4 flagged · loading source

dist/sbx.jsView file

6// script (see docs/image-paste.md §10 for why). L7: import { spawn, spawnSync, execFileSync } from 'node:child_process'; L8: import { createServer } from 'node:http';

High

Child Process

Package source references child process execution.

dist/sbx.jsView on unpkg · L6

6// script (see docs/image-paste.md §10 for why). L7: import { spawn, spawnSync, execFileSync } from 'node:child_process'; L8: import { createServer } from 'node:http'; L9: import crypto from 'node:crypto'; ... L12: import { basename, join } from 'node:path'; L13: const HOME = homedir(); L14: const UNCLAUDE_DIR = join(HOME, '.unclaude'); ... L26: const r = spawnSync(cmd, args, { encoding: 'utf8' }); L27: return (r.stdout ?? '').trim(); L28: } ... L40: function teardownLegacyClipBridge() { L41: if (process.platform !== 'darwin')

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/sbx.jsView on unpkg · L6

dist/common.jsView file

366// sudo never blocks waiting for a password the ink TUI can't deliver. L367: export const SUDO_HINT = `Re-run after caching sudo credentials:\n sudo -v && npx @buffbirb/unclaude@latest install`; L368: export async function sudoRun(args) { L369: return new Promise((resolve, reject) => { L370: const proc = spawn('sudo', ['-n', ...args], { stdio: ['ignore', 'ignore', 'pipe'] }); L371: proc.on('close', c => (c === 0 ? resolve() : reject(new Error(`sudo ${args[0]} failed (${c})`))));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/common.jsView on unpkg · L366

assets/xclip-shim.shView file

•path = assets/xclip-shim.sh kind = build_helper sizeBytes = 1009 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/xclip-shim.shView on unpkg

Findings

3 High5 Medium5 Low

HighChild Processdist/sbx.js

HighShell

HighRuntime Package Installdist/common.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/sbx.js

MediumShips Build Helperassets/xclip-shim.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/sbx.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// Sandbox launcher for `container run`. Self-contained: only node:* builtins,

3// no imports from common.ts/ghapp.ts, so this single compiled file can be

4// copied to ~/.unclaude/share/sbx.js and run standalone by the `sbx`

5// wrapper (see common.ts:sbxWrapperContent). Replaces the old generated bash

6// script (see docs/image-paste.md §10 for why).

7import { spawn, spawnSync, execFileSync } from 'node:child_process';

8import { createServer } from 'node:http';

High

Child Process

Package source references child process execution.

dist/sbx.jsView on unpkg · L6

9import crypto from 'node:crypto';

10import { existsSync, mkdtempSync, writeFileSync, readFileSync, rmSync, unlinkSync, chmodSync, } from 'node:fs';

11import { homedir, tmpdir } from 'node:os';

12import { basename, join } from 'node:path';

13const HOME = homedir();

14const UNCLAUDE_DIR = join(HOME, '.unclaude');

15const SHARE_DIR = join(UNCLAUDE_DIR, 'share');

16const CACHE_DIR = join(HOME, '.cache', 'unclaude');

17const GH_APPS_DIR = join(UNCLAUDE_DIR, 'github-apps');

18function ghAppConfigPath(owner) {

19 const p = join(GH_APPS_DIR, `${owner}.json`);

20 return existsSync(p) ? p : null;

21}

22const GH_APP_KEYCHAIN = 'unclaude-container-github-app';

23const CLIP_BRIDGE_LABEL = 'com.unclaude.clipbridge';

24const CLIP_BRIDGE_PLIST = join(HOME, 'Library', 'LaunchAgents', `${CLIP_BRIDGE_LABEL}.plist`);

25function runOut(cmd, args = []) {

26 const r = spawnSync(cmd, args, { encoding: 'utf8' });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/sbx.jsView on unpkg · L6

dist/common.jsView file

Lines 346-386javascript

346 mkdirSync(dirname(filePath), { recursive: true });

347 writeFileSync(filePath, JSON.stringify(data, null, 2) + '\n');

348}

349export function patchJson(filePath, patch

assets/xclip-shim.shView file

•path = assets/xclip-shim.sh kind = build_helper sizeBytes = 1009 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/xclip-shim.shView on unpkg