registry / @generativereality/cctabs / 0.4.8

@generativereality/cctabs@0.4.8

Claude Code tab manager. Terminal tabs as the UI, no tmux.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 133 KB of source, external domains: cctabs.com, github.com, registry.npmjs.org, waveterm.dev

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import updateNotifier from "update-notifier";

3import { cli, define } from "gunshi";

4import { execFileSync, spawn, spawnSync } from "child_process";

5import { createConnection } from "net";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L3

6import { randomUUID } from "crypto";

7import { homedir, hostname, platform, tmpdir } from "os";

8import { basename, dirname, extname, join, resolve } from "path";

9import { chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "fs";

10import { consola } from "consola";

11import * as p from "@clack/prompts";

12//#region package.json

13var name = "@generativereality/cctabs";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L3

14var version = "0.4.8";

15var description = "Claude Code tab manager. Terminal tabs as the UI, no tmux.";

16var package_default = {

17 name,

18 version,

19 description,

20 type: "module",

21 bin: { "cctabs": "dist/index.js" },

22 files: [

23 "dist",

Lines 109-149javascript

109 return ALL_TERMINALS.includes(v);

110}

111/**

112* Like {@link detectTerminal} but, when env sniffing yields 'unknown', probes

113* the Tabby cctabs plugin on this host and resolves to 'tabby' if it answers.

114*

115* The probe only fires in the unknown case — a session with a recognised

116* TERM_PROGRAM (or an explicit CCTABS_TERMINAL override) never pays for the

Lines 3178-3218javascript

3178 } catch {

3179 return {

3180 ok: false,

3181 error: "non-JSON response",

3182 raw: r.stdout

3183 };

3184 }

3185}

3186function checkTabbyPlugin() {

Source & flagged code

4 flagged · loading source

dist/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code