registry / @ccpocket/bridge / 1.66.0

@ccpocket/bridge@1.66.0

Bridge server that connects Claude Agent SDK and Codex CLI sessions to mobile devices via WebSocket

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 41 file(s), 810 KB of source, external domains: chatgpt.com, console.anthropic.com, docs.anthropic.com, git-scm.com, github.com, identitytoolkit.googleapis.com, nodejs.org, securetoken.googleapis.com, tailscale.com, us-central1-ccpocket-ca33b.cloudfunctions.net, www.apple.com

Source & flagged code

5 flagged

dist/firebase-auth.jsView file

Lines 1-38javascript

1/**

2 * Firebase Anonymous Auth client for Bridge Server.

3 *

4 * Uses the Firebase Auth REST API directly instead of the client SDK

5 * to avoid Node.js compatibility issues with the browser-oriented SDK.

6 *

7 * Each Bridge instance signs in anonymously and obtains:

8 * - A unique UID (used as bridgeId)

9 * - An ID token (used as Bearer token for Cloud Functions)

10 *

11 * Credentials are persisted to ~/.ccpocket/firebase-credentials.json

12 * so that Bridge restarts reuse the same UID instead of creating

13 * a new anonymous account each time.

14 */

15import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

16import { homedir } from "node:os";

17import { dirname, join } from "node:path";

18const FIREBASE_API_KEY = "AIzaSyAptNnokWPqJIgv2Lr3I8ETN6bqZb5BGvc";

High

High Secret

Package contains a high-severity secret pattern.

dist/firebase-auth.jsView on unpkg · L18

High

Secret Pattern

Google API key in dist/firebase-auth.js

dist/firebase-auth.jsView on unpkg · L18

19const SIGN_UP_URL = `https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=${FIREBASE_API_KEY}`;

20const REFRESH_URL = `https://securetoken.googleapis.com/v1/token?key=${FIREBASE_API_KEY}`;

21const CREDENTIALS_DIR = join(homedir(), ".ccpocket");

22const CREDENTIALS_FILE = join(CREDENTIALS_DIR, "firebase-credentials.json");

23class FirebaseTokenRefreshError extends Error {

24 status;

25 responseText;

26 constructor(status, responseText) {

27 super(`Firebase token refresh failed (${status}): ${responseText}`);

28 this.status = status;

29 this.responseText = responseText;

30 }

31}

32function isRecoverableRefreshError(err) {

33 return err instanceof FirebaseTokenRefreshError && err.status === 400;

34}

35function loadCredentials(credentialsFile) {

36 try {

37 if (!existsSync(credentialsFile))

38 return null;

dist/setup-launchd.jsView file

Lines 1-21javascript

1import { execSync } from "node:child_process";

2import { existsSync, mkdirSync, writeFileSync, unlinkSync } from "node:fs";

3import { homedir } from "node:os";

4import { join } from "node:path";

5import { defaultCodexSharedAppServerUrl, readCodexSharedAppServerUrl, } from "./codex-app-server-config.js";

dist/websocket.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ccpocket/bridge@1.64.0 matchedIdentity = npm:QGNjcG9ja2V0L2JyaWRnZQ:1.64.0 similarity = 0.850 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/websocket.jsView on unpkg

dist/doctor.jsView file

Lines 268-308javascript

268 // Extract the Tailscale IP (first IPv4 in output)

269 const ipMatch = out.match(/(\d+\.\d+\.\d+\.\d+)/);

270 const ip = ipMatch ? ipMatch[1]

Source & flagged code

5 flagged · loading source

dist/firebase-auth.jsView file

18patternName = google_api_key severity = high line = 18 matchedText = const FI...vc";

High

High Secret

Package contains a high-severity secret pattern.

dist/firebase-auth.jsView on unpkg · L18

18patternName = google_api_key severity = high line = 18 matchedText = const FI...vc";

High

Secret Pattern

Google API key in dist/firebase-auth.js

dist/firebase-auth.jsView on unpkg · L18

dist/setup-launchd.jsView file

1import { execSync } from "node:child_process"; L2: import { existsSync, mkdirSync, writeFileSync, unlinkSync } from "node:fs"; ... L8: function getPlistPath() { L9: const dir = join(homedir(), "Library", "LaunchAgents"); L10: if (!existsSync(dir)) ... L17: try { L18: execSync(`launchctl stop "${PLIST_LABEL}"`, { stdio: "ignore" }); L19: } ... L30: export function setupLaunchd(opts) { L31: const port = parseBridgePort(opts.port ?? process.env.BRIDGE_PORT); L32: const host = opts.host ?? process.env.BRIDGE_HOST ?? "0.0.0.0";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/setup-launchd.jsView on unpkg · L1

dist/websocket.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/websocket.jsView on unpkg

dist/doctor.jsView file

288patternName = google_api_key severity = high line = 288 matchedText = const FI...vc";

High

Secret Pattern

Google API key in dist/doctor.js

dist/doctor.jsView on unpkg · L288

Findings

4 High3 Medium5 Low

HighHigh Secretdist/firebase-auth.js

HighPrevious Version Dangerous Deltadist/websocket.js

HighSecret Patterndist/firebase-auth.js

HighSecret Patterndist/doctor.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/setup-launchd.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/firebase-auth.jsView file

Lines 1-38javascript

1/**

2 * Firebase Anonymous Auth client for Bridge Server.

3 *

4 * Uses the Firebase Auth REST API directly instead of the client SDK

5 * to avoid Node.js compatibility issues with the browser-oriented SDK.

6 *

7 * Each Bridge instance signs in anonymously and obtains:

8 * - A unique UID (used as bridgeId)

9 * - An ID token (used as Bearer token for Cloud Functions)

10 *

11 * Credentials are persisted to ~/.ccpocket/firebase-credentials.json

12 * so that Bridge restarts reuse the same UID instead of creating

13 * a new anonymous account each time.

14 */

15import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

16import { homedir } from "node:os";

17import { dirname, join } from "node:path";

18const FIREBASE_API_KEY = "AIzaSyAptNnokWPqJIgv2Lr3I8ETN6bqZb5BGvc";

High

High Secret

Package contains a high-severity secret pattern.

dist/firebase-auth.jsView on unpkg · L18

High

Secret Pattern

Google API key in dist/firebase-auth.js

dist/firebase-auth.jsView on unpkg · L18

19const SIGN_UP_URL = `https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=${FIREBASE_API_KEY}`;

20const REFRESH_URL = `https://securetoken.googleapis.com/v1/token?key=${FIREBASE_API_KEY}`;

21const CREDENTIALS_DIR = join(homedir(), ".ccpocket");

22const CREDENTIALS_FILE = join(CREDENTIALS_DIR, "firebase-credentials.json");

23class FirebaseTokenRefreshError extends Error {

24 status;

25 responseText;

26 constructor(status, responseText) {

27 super(`Firebase token refresh failed (${status}): ${responseText}`);

28 this.status = status;

29 this.responseText = responseText;

30 }

31}

32function isRecoverableRefreshError(err) {

33 return err instanceof FirebaseTokenRefreshError && err.status === 400;

34}

35function loadCredentials(credentialsFile) {

36 try {

37 if (!existsSync(credentialsFile))

38 return null;

dist/setup-launchd.jsView file

Lines 1-21javascript

1import { execSync } from "node:child_process";

2import { existsSync, mkdirSync, writeFileSync, unlinkSync } from "node:fs";

3import { homedir } from "node:os";

4import { join } from "node:path";

5import { defaultCodexSharedAppServerUrl, readCodexSharedAppServerUrl, } from "./codex-app-server-config.js";

dist/websocket.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/websocket.jsView on unpkg

dist/doctor.jsView file

Lines 268-308javascript

268 // Extract the Tailscale IP (first IPv4 in output)

269 const ipMatch = out.match(/(\d+\.\d+\.\d+\.\d+)/);

270 const ip = ipMatch ? ipMatch[1]