registry / Remote code execution / @crossberryweb/nx / 1.0.1

@crossberryweb/nx@1.0.1

nx — Noxs command line, portable edition: browse the Noxs plugin registry, sha256-verified plugin downloads, package info, URL opening. Runs on Windows, macOS and Linux shells.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The source exposes a command injection risk in the Windows URL-opening path, although activation requires an explicit command invocation and crafted input. This supports a warning for a dangerous capability, not a finding of publisher-directed malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

A caller invokes nx open or nx ow on Windows with a crafted URL.

Impact

A crafted argument can cause local command execution when the URL is opened.

Mechanism

The URL checks do not reject shell metacharacters, and the Windows path passes the URL to cmd /c start.

AI rationale

Evidence

bin/nx.js

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package publishes bin/nx.js as its nx command entrypoint.
URL validation requires an HTTP or HTTPS prefix and rejects whitespace and control characters, but permits other characters such as ampersands.
The open command passes its caller-supplied URL through that validation before choosing how to launch it.
On Windows, the URL is passed to cmd with /c start, and the child process is spawned.
The shell launch is reachable through the explicit open or ow command with a supplied URL.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 13.6 KB of source, external domains: github.com, raw.githubusercontent.com, www.npmjs.com

Source & flagged code

7 flagged

bin/nx.jsView file

Lines 1-44javascript

1#!/usr/bin/env node

2/**

3 * nx — Noxs command line, portable edition.

4 * npm package: @crossberryweb/nx

5 *

6 * Mirrors the Noxs terminal `nx` dispatcher (linux-runtime/nx) for every

7 * platform that runs Node.js: Windows (cmd/PowerShell), macOS, Linux.

8 * Zero runtime dependencies — Node built-ins only.

9 *

10 * Commands:

11 * nx plugins list the Noxs plugin registry

12 * nx info <plugin-id> show one plugin's metadata + checksum

13 * nx install <id> [dir] download + sha256-verify a .noxs-plugin

14 * nx pkg info <spec> inspect a noxs-pkg style package registry

15 * nx ow <url> open a URL (Noxs browser on device; default

16 * browser elsewhere)

17 * nx version | help

18 */

19'use strict';

21const https = require('https');

22const crypto = require('crypto');

23const fs = require('fs');

24const path = require('path');

25const { spawn } = require('child_process');

High

Child Process

Package source references child process execution.

bin/nx.jsView on unpkg · L24

27const VERSION = '1.0.1';

28const PLUGIN_OWNER = process.env.NX_PLUGINS_OWNER || 'crossberry-in';

29const PLUGIN_REPO = process.env.NX_PLUGINS_REPO || 'nx-pkg';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/nx.jsView on unpkg · L20

30const PKG_OFFICIAL_ORG = process.env.NX_OFFICIAL_ORG || 'noxs-pkg';

31const RAW_BASE = 'https://raw.githubusercontent.com';

32const UA = 'nx-cli/' + VERSION + ' (noxs portable; +https://github.com/' + PLUGIN_OWNER + '/' + PLUGIN_REPO + ')';

34const RE_NAME = /^[a-z0-9][a-z0-9._-]*$/;

35const RE_REPO = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;

36const RE_SHA = /^[0-9a-fA-F]{64}$/;

38function msg(s) { process.stdout.write('nx: ' + s + '\n'); }

39function err(s) { process.stderr.write('nx: ' + s + '\n'); }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/nx.jsView on unpkg · L24

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/nx.jsView on unpkg · L24

40function die(s) { err(s); process.exit(1); }

41function stage(s) { process.stdout.write('\x1b[1;36mnx:\x1b[0m ' + s + '\n'); }

43function usage(code) {

44 const t = [

Lines 231-271javascript

231 const latest = reg.latest || reg.versions[0].version;

232 const vers = reg.versions.map((v) => v.version).join(', ');

233 const

Lines 284-324javascript

284 const first = (lines[0] || '').trim();

285 try { fs.unlinkSync(request); } catch (_) {}

286 try { fs.unlinkSync(response); } catch (_) {}

package.jsonView file

Lines 1-25json

2 "name": "@crossberryweb/nx",

3 "version": "1.0.1",

4 "description": "nx — Noxs command line, portable edition: browse the Noxs plugin registry, sha256-verified plugin downloads, package info, URL opening. Runs on Windows, macOS and Linux shells.",

5 "bin": {

Source & flagged code

7 flagged · loading source

bin/nx.jsView file

24const path = require('path'); L25: const { spawn } = require('child_process'); L26:

High

Child Process

Package source references child process execution.

bin/nx.jsView on unpkg · L24

20L21: const https = require('https'); L22: const crypto = require('crypto'); ... L24: const path = require('path'); L25: const { spawn } = require('child_process'); L26: L27: const VERSION = '1.0.1'; L28: const PLUGIN_OWNER = process.env.NX_PLUGINS_OWNER || 'crossberry-in'; L29: const PLUGIN_REPO = process.env.NX_PLUGINS_REPO || 'nx-pkg';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/nx.jsView on unpkg · L20

24const path = require('path'); L25: const { spawn } = require('child_process'); L26: ... L30: const PKG_OFFICIAL_ORG = process.env.NX_OFFICIAL_ORG || 'noxs-pkg'; L31: const RAW_BASE = 'https://raw.githubusercontent.com'; L32: const UA = 'nx-cli/' + VERSION + ' (noxs portable; +https://github.com/' + PLUGIN_OWNER + '/' + PLUGIN_REPO + ')'; ... L37: L38: function msg(s) { process.stdout.write('nx: ' + s + '\n'); } L39: function err(s) { process.stderr.write('nx: ' + s + '\n'); }

High

Command Output Exfiltration

Findings

4 High5 Medium3 Low

HighChild Processbin/nx.js

HighSame File Env Network Executionbin/nx.js

HighCommand Output Exfiltrationbin/nx.js

HighTrigger Reachable Command Output Exfiltrationbin/nx.js

MediumNetwork

MediumEnvironment Vars

MediumAi Review Evidencepackage.json

MediumAi Review Evidencebin/nx.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @crossberryweb/nx@1.0.1.

See all versions of @crossberryweb/nx for other recorded verdicts.

Review the evidence and your use of @crossberryweb/nx@1.0.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-13 21:17:21.120Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.