registry  /  @dsiloed/silo-link  /  1.16.3

@dsiloed/silo-link@1.16.3

Claude Code Remote Bridge — connects Claude Code sessions to DSiloed via MCP + ActionCable

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 31 file(s), 462 KB of source, external domains: 127.0.0.1, registry.npmjs.org, www.dsiloed.com

Source & flagged code

3 flagged · loading source
dist/core/base-tmux-launcher.jsView file
1import { spawn, execFileSync } from 'node:child_process'; L2: import { createHash } from 'node:crypto'; ... L268: let out = ''; L269: ls.stdout.on('data', (d) => { out += d.toString(); }); L270: ls.on('exit', () => { ... L664: resolveCommandPath(cmd) { L665: if (process.platform === 'win32') L666: return cmd; // POSIX-only resolution; don't break Windows ... L674: const dirs = [ L675: join(homedir(), '.local', 'bin'), L676: join(homedir(), 'bin'), ... L846: env: {
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/base-tmux-launcher.jsView on unpkg · L1
dist/core/auto-updater.jsView file
1import { execFile, execFileSync, spawn } from 'node:child_process'; L2: import { closeSync, mkdirSync, openSync, statSync, unlinkSync, writeSync } from 'node:fs'; ... L203: registryUrl() { L204: const def = 'https://registry.npmjs.org'; L205: const configured = this.config.npm[redacted]; ... L235: return null; L236: const json = (await res.json()); L237: return json.dist?.integrity ?? null; ... L298: // malicious. Bin-linking still happens (it's core npm, not a script). L299: const { stdout } = await execFileAsync('npm', ['install', '-g', spec, '--ignore-scripts', '--no-fund', '--no-audit'], { timeout: 300_000, maxBuffer: 16 * 1024 * 1024 }); L300: const tail = stdout.trim().split('\n').slice(-1)[0] ?? ''; ... L343: scheduleRestart() {
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/core/auto-updater.jsView on unpkg · L1
•matchType = previous_version_dangerous_delta matchedPackage = @dsiloed/silo-link@1.16.2 matchedIdentity = npm:QGRzaWxvZWQvc2lsby1saW5r:1.16.2 similarity = 0.964 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core/auto-updater.jsView on unpkg

Findings

2 High3 Medium6 Low
HighSandbox Evasion Gated Capabilitydist/core/auto-updater.js
HighPrevious Version Dangerous Deltadist/core/auto-updater.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/core/base-tmux-launcher.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings