registry  /  @generativereality/cctabs  /  0.4.6

@generativereality/cctabs@0.4.6

Claude Code tab manager. Terminal tabs as the UI, no tmux.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 130 KB of source, external domains: cctabs.com, github.com, registry.npmjs.org, waveterm.dev

Source & flagged code

3 flagged · loading source
dist/index.jsView file
4import { createConnection } from "net"; L5: import { execFileSync, spawn, spawnSync } from "child_process"; L6: import { randomUUID } from "crypto";
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L4
3118detail: `${host}:${port} unreachable (${health.error ?? "unknown"})`, L3119: hint: "Run `cctabs install-tabby-plugin` from inside a Tabby tab — it npm-installs the plugin and reopens Tabby. Or do it by hand: `npm install --legacy-peer-deps --prefix \"$HOME/... L3120: }; ... L3132: function checkSpawnedShellPath() { L3133: const r = spawnSync("zsh", [ L3134: "-l",
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L3118
3import { cli, define } from "gunshi"; L4: import { createConnection } from "net"; L5: import { execFileSync, spawn, spawnSync } from "child_process"; L6: import { randomUUID } from "crypto"; ... L11: import * as p from "@clack/prompts"; L12: //#region package.json L13: var name = "@generativereality/cctabs"; ... L34: "check": "npm run typecheck && npm run test && npm run build", L35: "release": "bumpp && npm publish", L36: "sync-plugin": "bash scripts/sync-plugin.sh", ... L78: function detectTerminal() { L79: const prog = process.env.TERM_PROGRAM ?? "";
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L3

Findings

3 High4 Medium4 Low
HighChild Processdist/index.js
HighShell
HighRuntime Package Installdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings