registry  /  @dotobokuri/fleet-console  /  1.21.0

@dotobokuri/fleet-console@1.21.0

Fleet Console - standalone web surface for observing Fleet CLI workspaces, carrier jobs, live output streams, and terminals.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 61 file(s), 7.52 MB of source, external domains: 127.0.0.1, api.github.com, chevrotain.io, en.wikipedia.org, github.com, img.shields.io, json-schema.org, langium.org, mcp.grep.app, raw.githubusercontent.com, react.dev, registry.npmjs.org, skills.sh, www.w3.org

Source & flagged code

7 flagged · loading source
package.jsonView file
•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node postinstall.mjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/client/assets/index-UoTD8YUw.jsView file
157Please report this to https://github.com/markedjs/marked.`,e){let s="<p>An error occurred:</p><pre>"+ar(i.message+"",!0)+"</pre>";return t?Promise.resolve(s):s}if(t)return Promise.... L158: `+en),Re&&Al([G,I,Y],tn=>{en=Ka(en,tn," ")}),k&&cn?k.createHTML(en):en},t.setConfig=function(){let De=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{};Te(De),_t=!0},t.clea... L159: https://github.com/highlightjs/highlight.js/issues/2277`),Vt=xe,ft=Oe),Ie===void 0&&(Ie=!0);const Pn={code:ft,language:Vt};en("before:highlight",Pn);const ci=Pn.result?Pn.result:yn...
High
Child Process

Package source references child process execution.

dist/client/assets/index-UoTD8YUw.jsView on unpkg · L157
10L11: Please change the parent <Route path="${m}"> to <Route path="${m==="/"?"*":`${m}/*`}">.`)}let v=$i(),g;if(t){let m=typeof t=="string"?So(t):t;Xt(h==="/"||m.pathname?.startsWith(h),... L12:
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/index-UoTD8YUw.jsView on unpkg · L10
dist/fleet-plugins/terminal/routes.mjsView file
17444return { L17445: bin: env.ComSpec ?? "cmd.exe", L17446: prefixArgs: ["/d", "/s", "/c", "call", forceWindowsArgQuoting(resolved)]
High
Shell

Package source references shell execution.

dist/fleet-plugins/terminal/routes.mjsView on unpkg · L17444
dist/fleet-plugins/skills/routes.mjsView file
2Cross-file remote execution chain: dist/fleet-plugins/skills/routes.mjs spawns dist/cli.mjs; helper contains network access plus dynamic code execution. L2: import path from 'path'; L3: import { execFile } from 'child_process'; L4: import fs3 from 'fs/promises'; ... L38: ZodArray: () => ZodArray, L39: ZodBase64: () => ZodBase64, L40: ZodBase64URL: () => ZodBase64URL, ... L1495: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L1496: } : { success: true, data: result.value }; L1497: }; ... L2579: try { L2580: new URL(`http://[${payload.value}]`); L2581: } catch {
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/fleet-plugins/skills/routes.mjsView on unpkg · L2
dist/client/assets/cascadia-code-latin-ext-wght-normal-CeKCfnVW.woff2View file
•path = dist/client/assets/cascadia-code-latin-ext-wght-normal-CeKCfnVW.woff2 kind = high_entropy_blob sizeBytes = 33872 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/cascadia-code-latin-ext-wght-normal-CeKCfnVW.woff2View on unpkg

Findings

5 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/client/assets/index-UoTD8YUw.js
HighShelldist/fleet-plugins/terminal/routes.mjs
HighCross File Remote Execution Contextdist/fleet-plugins/skills/routes.mjs
HighShips High Entropy Blobdist/client/assets/cascadia-code-latin-ext-wght-normal-CeKCfnVW.woff2
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/client/assets/index-UoTD8YUw.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License