registry / @easypush/plush / 0.1.2

@easypush/plush@0.1.2

SDK, CLI, and MCP server for the Plush push notification API.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 86.6 KB of source, external domains: api.easypush.app, chatgpt.com, status.example.com

Source & flagged code

3 flagged

dist/codex-stop-hook.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { createHash, randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/codex-stop-hook.jsView on unpkg · L1

4import { mkdir, open as openFile, readFile, rm, unlink, writeFile } from "node:fs/promises";

5import { dirname, join } from "node:path";

6import { homedir, tmpdir } from "node:os";

7import { fileURLToPath } from "node:url";

8import net from "node:net";

9import { PlushAPIError, PlushClient } from "./index.js";

10import { readSavedCredentials } from "./auth.js";

11const defaultAppName = "Codex";

12const defaultAppIconUrl = "https://chatgpt.com/favicon.ico";

13const maxBodyChars = Number(process.env.PLUSH_CODEX_MAX_BODY_CHARS ?? "3000");

14const bodyLimitChars = Number.isFinite(maxBodyChars) ? Math.max(512, Math.min(maxBodyChars, 3600)) : 3000;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/codex-stop-hook.jsView on unpkg · L1

15const communicationEnabled = process.env.PLUSH_CODEX_COMMUNICATION !== "0";

16const replyEnabled = process.env.PLUSH_CODEX_REPLY === "1";

17const followupSyncEnabled = process.env.PLUSH_CODEX_FOLLOWUP_SYNC === "1";

18const replyTimeoutMs = numberEnv("PLUSH_CODEX_REPLY_TIMEOUT_MS", 60 * 60 * 1000);

19const queuePollIntervalMs = numberEnv("PLUSH_CODEX_QUEUE_POLL_INTERVAL_MS", 2500);

20const ipcTurnTimeoutMs = numberEnv("PLUSH_CODEX_IPC_TIMEOUT_MS", 15_000);

21const genericCodexTitles = new Set(["codex", "codex finished", "new chat", "untitled", "untitled chat"]);

dist/templates.jsView file

Lines 1-29javascript

1import { build } from "esbuild";

2import { readFile } from "node:fs/promises";

3import { extname, isAbsolute, resolve } from "node:path";

4import { fileURLToPath } from "node:url";

5import { renderLiveActivity, renderWidget } from "./jsx.js";

Source & flagged code

3 flagged · loading source

dist/codex-stop-hook.jsView file

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { createHash, randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/codex-stop-hook.jsView on unpkg · L1

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { createHash, randomUUID } from "node:crypto"; ... L7: import { fileURLToPath } from "node:url"; L8: import net from "node:net"; L9: import { PlushAPIError, PlushClient } from "./index.js"; ... L12: const defaultAppIconUrl = "https://chatgpt.com/favicon.ico"; L13: const maxBodyChars = Number(process.env.PLUSH_CODEX_MAX_BODY_CHARS ?? "3000"); L14: const bodyLimitChars = Number.isFinite(maxBodyChars) ? Math.max(512, Math.min(maxBodyChars, 3600)) : 3000;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/codex-stop-hook.jsView on unpkg · L1

dist/templates.jsView file

9const moduleUrl = `data:text/javascript;base64,${Buffer.from(source).toString("base64")}#${Date.now()}`; L10: const module = await import(moduleUrl); L11: if (module.default === undefined) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/templates.jsView on unpkg · L9

Findings

3 High3 Medium4 Low

HighChild Processdist/codex-stop-hook.js

HighShell

HighSame File Env Network Executiondist/codex-stop-hook.js

MediumDynamic Requiredist/templates.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/codex-stop-hook.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { createHash, randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/codex-stop-hook.jsView on unpkg · L1

4import { mkdir, open as openFile, readFile, rm, unlink, writeFile } from "node:fs/promises";

5import { dirname, join } from "node:path";

6import { homedir, tmpdir } from "node:os";

7import { fileURLToPath } from "node:url";

8import net from "node:net";

9import { PlushAPIError, PlushClient } from "./index.js";

10import { readSavedCredentials } from "./auth.js";

11const defaultAppName = "Codex";

12const defaultAppIconUrl = "https://chatgpt.com/favicon.ico";

13const maxBodyChars = Number(process.env.PLUSH_CODEX_MAX_BODY_CHARS ?? "3000");

14const bodyLimitChars = Number.isFinite(maxBodyChars) ? Math.max(512, Math.min(maxBodyChars, 3600)) : 3000;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/codex-stop-hook.jsView on unpkg · L1

15const communicationEnabled = process.env.PLUSH_CODEX_COMMUNICATION !== "0";

16const replyEnabled = process.env.PLUSH_CODEX_REPLY === "1";

17const followupSyncEnabled = process.env.PLUSH_CODEX_FOLLOWUP_SYNC === "1";

18const replyTimeoutMs = numberEnv("PLUSH_CODEX_REPLY_TIMEOUT_MS", 60 * 60 * 1000);

19const queuePollIntervalMs = numberEnv("PLUSH_CODEX_QUEUE_POLL_INTERVAL_MS", 2500);

20const ipcTurnTimeoutMs = numberEnv("PLUSH_CODEX_IPC_TIMEOUT_MS", 15_000);

21const genericCodexTitles = new Set(["codex", "codex finished", "new chat", "untitled", "untitled chat"]);

dist/templates.jsView file

Lines 1-29javascript

1import { build } from "esbuild";

2import { readFile } from "node:fs/promises";

3import { extname, isAbsolute, resolve } from "node:path";

4import { fileURLToPath } from "node:url";

5import { renderLiveActivity, renderWidget } from "./jsx.js";