registry / @devflow-tools/claude-code-plugin / 0.12.6

@devflow-tools/claude-code-plugin@0.12.6

⚠ Under review

DevFlow — Developer Intelligence Platform for Claude Code

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

MinifiedUrlStrings

Manifest

NoLicense

scanned 5 file(s), 30.6 KB of source, external domains: 127.0.0.1

Source & flagged code

4 flagged

dist/hooks/hook-daemon.jsView file

Lines 1-8javascript

1import {createServer}from'net';import {join}from'path';import {homedir}from'os';import {existsSync,unlinkSync,readdirSync,readFileSync,mkdirSync,writeFileSync}from'fs';import {createHash}from'crypto';import {request}from'http';import {spawn}from'child_process';var O=1e4,nt=3e4,rt=300*1e3;function v(a,t,e){return new Promise(s=>{try{let n=new URL(a),r=request({hostname:n.hostname,port:n.port||80,path:n.pathname+n.search,method:"POST",headers:{"Content-Type":"application/json","X-API-Key":e,"Content-Length":Buffer.byteLength(t)},timeout:5e3},o=>{let i=[];o.on("data",c=>i.push(c)),o.on("end",()=> ...

2`).filter(s=>s.trim())),e.push(JSON.stringify(t)),e.length>B&&(e=e.slice(e.length-B)),writeFileSync(p,e.join(`

High

Child Process

Package source references child process execution.

dist/hooks/hook-daemon.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hooks/hook-daemon.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/hooks/hook-daemon.jsView on unpkg · L1

3`)+`

4`);}catch{}}readAll(){try{return existsSync(p)?readFileSync(p,"utf-8").split(`

5`).filter(t=>t.trim()):[]}catch{return []}}clear(){try{existsSync(p)&&writeFileSync(p,"");}catch{}}get size(){return this.readAll().length}};var f=join(homedir(),".devflow","hook-daemon.sock");join(homedir(),".devflow");var Rt=600*1e3,Pt=new Set(["Agent","Bash","Glob","Grep","WebSearch","WebFetch"]);function Dt(a){switch(a){case "Read":case "Glob":return "file_read";case "Write":case "Edit":case "NotebookEdit":return "file_write";case "Bash":return "bash_command";case "Agent":return "subagent";case "Skill":return "skill_invoke";default:return "tool_use"}}function V(a){let t=createHash("sha256" ...

6`);s=r.pop()||"";for(let o of r)if(o.trim())try{let i=JSON.parse(o),c=await this.handleRequest(i);c!==null&&e.write(JSON.stringify(c)+`

7`);}catch(i){e.write(JSON.stringify({error:i.message})+`

8`);}}),e.on("error",()=>{});});t.on("error",e=>{console.error("[devflow-daemon] Server error:",e.message);}),t.listen(f,()=>{console.error("[devflow-daemon] Listening on",f);}),this.flushBuffer(),this.resetIdleTimer();}resetIdleTimer(){this.idleTimer&&clearTimeout(this.idleTimer),this.idleTimer=setTimeout(()=>{console.error("[devflow-daemon] Idle timeout, exiting"),this.

Long lines were clipped for display.

•matchType = previous_version_dangerous_delta matchedPackage = @devflow-tools/claude-code-plugin@0.12.5 matchedIdentity = npm:[redacted]:0.12.5 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/hooks/hook-daemon.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/hooks/hook-daemon.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/hooks/hook-daemon.jsView on unpkg

1import {createServer}from'net';import {join}from'path';import {homedir}from'os';import {existsSync,unlinkSync,readdirSync,readFileSync,mkdirSync,writeFileSync}from'fs';import {crea... L2: `).filter(s=>s.trim())),e.push(JSON.stringify(t)),e.length>B&&(e=e.slice(e.length-B)),writeFileSync(p,e.join(`

High

Child Process

Package source references child process execution.

dist/hooks/hook-daemon.jsView on unpkg · L1

1import {createServer}from'net';import {join}from'path';import {homedir}from'os';import {existsSync,unlinkSync,readdirSync,readFileSync,mkdirSync,writeFileSync}from'fs';import {crea... L2: `).filter(s=>s.trim())),e.push(JSON.stringify(t)),e.length>B&&(e=e.slice(e.length-B)),writeFileSync(p,e.join(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hooks/hook-daemon.jsView on unpkg · L1

1import {createServer}from'net';import {join}from'path';import {homedir}from'os';import {existsSync,unlinkSync,readdirSync,readFileSync,mkdirSync,writeFileSync}from'fs';import {crea... L2: `).filter(s=>s.trim())),e.push(JSON.stringify(t)),e.length>B&&(e=e.slice(e.length-B)),writeFileSync(p,e.join(`

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/hooks/hook-daemon.jsView on unpkg · L1

Findings

1 Critical3 High1 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/hooks/hook-daemon.js

HighChild Processdist/hooks/hook-daemon.js

HighSame File Env Network Executiondist/hooks/hook-daemon.js

HighCommand Output Exfiltrationdist/hooks/hook-daemon.js

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/hooks/hook-daemon.jsView file

Lines 1-8javascript

2`).filter(s=>s.trim())),e.push(JSON.stringify(t)),e.length>B&&(e=e.slice(e.length-B)),writeFileSync(p,e.join(`

High

Child Process

Package source references child process execution.

dist/hooks/hook-daemon.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hooks/hook-daemon.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/hooks/hook-daemon.jsView on unpkg · L1

3`)+`

4`);}catch{}}readAll(){try{return existsSync(p)?readFileSync(p,"utf-8").split(`

6`);s=r.pop()||"";for(let o of r)if(o.trim())try{let i=JSON.parse(o),c=await this.handleRequest(i);c!==null&&e.write(JSON.stringify(c)+`

7`);}catch(i){e.write(JSON.stringify({error:i.message})+`

Long lines were clipped for display.

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/hooks/hook-daemon.jsView on unpkg