registry  /  @dotobokuri/fleet-console  /  1.16.0

@dotobokuri/fleet-console@1.16.0

Fleet Console - standalone web surface for observing Fleet CLI workspaces, carrier jobs, live output streams, and terminals.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 60 file(s), 6.88 MB of source, external domains: 127.0.0.1, api.github.com, api.kimi.com, api.z.ai, chevrotain.io, en.wikipedia.org, github.com, json-schema.org, langium.org, mcp.grep.app, open.bigmodel.cn, raw.githubusercontent.com, react.dev, registry.npmjs.org, www.w3.org

Source & flagged code

7 flagged · loading source
package.jsonView file
•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node postinstall.mjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/client/assets/index-OEz1YKt3.jsView file
155Please report this to https://github.com/markedjs/marked.`,e){let a="<p>An error occurred:</p><pre>"+sr(r.message+"",!0)+"</pre>";return n?Promise.resolve(a):a}if(n)return Promise.... L156: `+Jt),je&&_l([G,B,Y],Qt=>{Jt=Ua(Jt,Qt," ")}),k&&vn?k.createHTML(Jt):Jt},n.setConfig=function(){let Ne=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{};ke(Ne),vt=!0},n.clea... L157: https://github.com/highlightjs/highlight.js/issues/2277`),Ft=be,ft=Me),De===void 0&&(De=!0);const zn={code:ft,language:Ft};Jt("before:highlight",zn);const ci=zn.result?zn.result:Rn...
High
Child Process

Package source references child process execution.

dist/client/assets/index-OEz1YKt3.jsView on unpkg · L155
10L11: Please change the parent <Route path="${f}"> to <Route path="${f==="/"?"*":`${f}/*`}">.`)}let b=$i(),p;if(n){let f=typeof n=="string"?lo(n):n;qt(u==="/"||f.pathname?.startsWith(u),... L12:
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/index-OEz1YKt3.jsView on unpkg · L10
dist/fleet-plugins/terminal/routes.mjsView file
17477const child = isWindows() ? spawn( L17478: this.env.ComSpec ?? "cmd.exe", L17479: buildWindowsCmdArgs(this.command, this.args),
High
Shell

Package source references shell execution.

dist/fleet-plugins/terminal/routes.mjsView on unpkg · L17477
dist/cli.mjsView file
1Cross-file remote execution chain: dist/cli.mjs spawns dist/fleet-plugins/terminal/routes.mjs; helper contains network access plus dynamic code execution. L1: #!/usr/bin/env node L2: import { spawn, execFileSync, execFile, execSync } from 'child_process'; L3: import * as fs11 from 'fs'; ... L14: import crypto5, { createHash, randomUUID } from 'crypto'; L15: import http2 from 'http'; L16: import { builtinModules, createRequire } from 'module'; ... L62: if (!res.ok) return { healthy: false, lock, error: `health failed: ${res.status}` }; L63: return { healthy: true, lock, health: await res.json() }; L64: } catch (err) { ... L134: function resolveColorEnabled(options = {}) { L135: const env = options.env ?? process.env; L136: const isTTY = options.isTTY ?? process.stdout.isTTY;
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L1
dist/client/assets/cascadia-code-latin-ext-wght-normal-CeKCfnVW.woff2View file
•path = dist/client/assets/cascadia-code-latin-ext-wght-normal-CeKCfnVW.woff2 kind = high_entropy_blob sizeBytes = 33872 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/cascadia-code-latin-ext-wght-normal-CeKCfnVW.woff2View on unpkg

Findings

5 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/client/assets/index-OEz1YKt3.js
HighShelldist/fleet-plugins/terminal/routes.mjs
HighCross File Remote Execution Contextdist/cli.mjs
HighShips High Entropy Blobdist/client/assets/cascadia-code-latin-ext-wght-normal-CeKCfnVW.woff2
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/client/assets/index-OEz1YKt3.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License