registry / @dadigua/codexhub / 0.4.15

@dadigua/codexhub@0.4.15

⚠ Under review

Local-first Codex control plane for local, SSH, and registered machines.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 140 file(s), 3.63 MB of source, external domains: 127.0.0.1, codexhub.local, github.com, react.dev, www.w3.org

Source & flagged code

5 flagged

dist/assets/SyntaxCodeBlock-Bq3TE26T.jsView file

Lines 1-8javascript

1import{a as $,j as Xe}from"./react-vendor-g1pQGgus.js";import{c as Ke,_ as Le,d as Ve,e as ne}from"./antd-vendor-DVeZuwwl.js";import{c as We,f as Ze,p as Ee,b as Se,n as ke,h as qe,s as Qe,d as ve}from"./markdown-vendor-CS_92ng1.js";function Ae(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);t&&(a=a.filter(function(o){return Object.getOwnPropertyDescriptor(e,o).enumerable})),n.push.apply(n,a)}return n}function B(e){for(var t=1;t<arguments.length;t++){var n=arguments[t]!=null?arguments[t]:{};t%2?Ae(Object(n),!0).forEach(function(a){Le(e,a,n[a])}) ...

2`))})}function lt(e){var t=e.codeString,n=e.codeStyle,a=e.containerStyle,o=a===void 0?{float:"left",paddingRight:"10px"}:a,r=e.numberStyle,l=r===void 0?{}:r,i=e.startingLineNumber;return $.createElement("code",{style:Object.assign({},n,o)},st({lines:t.replace(/\n$/,"").split(`

3`),style:l,startingLineNumber:i}))}function ct(e){return"".concat(e.toString().length,".25em")}function Fe(e,t){return{type:"element",tagName:"span",properties:{key:"line-number--".concat(e),className:["comment","linenumber","react-syntax-highlighter-line-number"],style:t},children:[{type:"text",value:e}]}}function De(e,t,n){var a={display:"inline-block",minWidth:ct(n),paddingRight:"1em",textAlign:"right",userSelect:"none"},o=typeof e=="function"?e(t):e,r=_(_({},a),o);return r}function W(e){var t=e.children,n=e.lineNumber,a=e.lineNumberStyle,o=e.largestLineNumber,r=e.showInlineLineNumbers,l=e. ...

4`);F.forEach(function(L,T){var I=a&&d.length+r,h={type:"text",value:"".concat(L,`

5`)};if(T===0){var C=u.slice(g+1,p).concat(W({children:[h],className:E.properties.className})),D=y(C,I);d.push(D)}else if(T===F.length-1){var Y=

6?|

High

Child Process

Package source references child process execution.

dist/assets/SyntaxCodeBlock-Bq3TE26T.jsView on unpkg · L4

7|(?![\\s\\S])))+`,"m"),alias:r,inside:{line:{pattern:/(.)(?=[\s\S]).*(?:\r\n?|\n)?/,lookbehind:!0},prefix:{pattern:/[\s\S]/,alias:/\w+/.exec(a)[0]}}}}),Object.defineProperty(t.languages.diff,"PREFIXES",{value:n})})(e)}ge.displayName="json";ge.aliases=["webmanifest"];function ge(e){e.languages.json={property:{pattern:/(^|[^\\])"(?:\\.|[^\\"\r\n])*"(?=\s*:)/,lookbehind:!0,greedy:!0},string:{pattern:/(^|[^\\])"(?:\\.|[^\\"\r\n])*"(?!\s*:)/,lookbehind:!0,greedy:!0},comment:{pattern:/\/\/.*|\/\*[\s\S]*?(?:\*\/|$)/,greedy:!0},number:/-?

Long lines were clipped for display.

scripts/install-vscode-extension.tsView file

Lines 42-82typescript

42 const listed = await installedExtensionLine("code", id);

43 if (!listed) return false;

44 console.error(`installed VSCode extension: ${listed}`);

45 return true;

dist-node/electron/main.jsView file

Lines 1-26javascript

1// targets/electron/src/main.ts

2import { app as electronApp, BrowserWindow, shell } from "electron";

4// src/core/dotenv.ts

5import { readFile } from "node:fs/promises";

6import path from "node:path";

7var loadDotEnv =

scripts/publish-prod.shView file

•path = scripts/publish-prod.sh kind = build_helper sizeBytes = 971 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/publish-prod.shView on unpkg

Source & flagged code

5 flagged · loading source

dist/assets/SyntaxCodeBlock-Bq3TE26T.jsView file

4`);F.forEach(function(L,T){var I=a&&d.length+r,h={type:"text",value:"".concat(L,` L5: `)};if(T===0){var C=u.slice(g+1,p).concat(W({children:[h],className:E.properties.className})),D=y(C,I);d.push(D)}else if(T===F.length-1){var Y=u[p+1]&&u[p+1].children&&u[p+1].child... L6: ?|

High

Child Process

Package source references child process execution.

dist/assets/SyntaxCodeBlock-Bq3TE26T.jsView on unpkg · L4

scripts/install-vscode-extension.tsView file

62L63: const powershell = await powershellPath(); L64: const result = await runCommand(powershell, ["-NoProfile", "-Command", ps]);

High

Shell

Package source references shell execution.

scripts/install-vscode-extension.tsView on unpkg · L62

dist-node/electron/main.jsView file

6import path from "node:path"; L7: var loadDotEnv = async (filePath = path.resolve(process.cwd(), ".env")) => { L8: let contents; ... L17: if (!parsed) continue; L18: if (!(parsed.key in process.env)) process.env[parsed.key] = parsed.value; L19: } ... L71: // src/server/embedded.ts L72: import net2 from "node:net"; L73: ... L375: streamId, L376: send: (frame) => this.send(frame), L377: onClose: () => {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist-node/electron/main.jsView on unpkg · L6

6Detached bundled service listener: dist-node/electron/main.js launches a Node helper and exposes a broad-bound HTTP listener. L6: import path from "node:path"; L7: var loadDotEnv = async (filePath = path.resolve(process.cwd(), ".env")) => { L8: let contents; ... L17: if (!parsed) continue; L18: if (!(parsed.key in process.env)) process.env[parsed.key] = parsed.value; L19: } ... L71: // src/server/embedded.ts L72: import net2 from "node:net"; L73: ... L375: streamId, L376: send: (frame) => this.send(frame), L377: onClose: () => {

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist-node/electron/main.jsView on unpkg · L6

scripts/publish-prod.shView file

•path = scripts/publish-prod.sh kind = build_helper sizeBytes = 971 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/publish-prod.shView on unpkg

Findings

1 Critical3 High4 Medium5 Low

CriticalCredential Exfiltrationdist-node/electron/main.js

HighChild Processdist/assets/SyntaxCodeBlock-Bq3TE26T.js

HighShellscripts/install-vscode-extension.ts

HighSpawned Bundled Service Listenerdist-node/electron/main.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/publish-prod.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/assets/SyntaxCodeBlock-Bq3TE26T.jsView file

Lines 1-8javascript

4`);F.forEach(function(L,T){var I=a&&d.length+r,h={type:"text",value:"".concat(L,`

5`)};if(T===0){var C=u.slice(g+1,p).concat(W({children:[h],className:E.properties.className})),D=y(C,I);d.push(D)}else if(T===F.length-1){var Y=

6?|

High

Child Process

Package source references child process execution.

dist/assets/SyntaxCodeBlock-Bq3TE26T.jsView on unpkg · L4

Long lines were clipped for display.

scripts/install-vscode-extension.tsView file

Lines 42-82typescript

42 const listed = await installedExtensionLine("code", id);

43 if (!listed) return false;

44 console.error(`installed VSCode extension: ${listed}`);

45 return true;

dist-node/electron/main.jsView file

Lines 1-26javascript

1// targets/electron/src/main.ts

2import { app as electronApp, BrowserWindow, shell } from "electron";

4// src/core/dotenv.ts

5import { readFile } from "node:fs/promises";

6import path from "node:path";

7var loadDotEnv =

scripts/publish-prod.shView file

•path = scripts/publish-prod.sh kind = build_helper sizeBytes = 971 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/publish-prod.shView on unpkg