registry / @gigaflow/gmux / 0.15.0
@gigaflow/gmux@0.15.0
gmux — an LLM-native layer over your tmux workspace: browse, search and resume your AI coding agent sessions across Claude Code, Codex, and any other harness.
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/cli/picker.jsView file
13*/
L14: import { spawn, spawnSync } from "node:child_process";
L15: import { randomBytes } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/cli/picker.jsView on unpkg · L13144*
L145: * `execArgv` MUST be forwarded, for the same reason `spawnWorker` forwards it:
L146: * under `npm run dev` the entry point is `src/cli/main.ts` and execArgv carries
High
dist/services/sensors.jsView file
1/**
L2: * Sensors: the two ways gmux learns what a pane is doing, unified behind one
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/services/sensors.jsView on unpkg · L1Findings
3 High3 Medium6 Low
HighChild Processdist/cli/picker.js
HighShelldist/cli/picker.js
HighRuntime Package Installdist/services/providers.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/services/sensors.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @gigaflow/gmux@0.15.0.
See all versions of @gigaflow/gmux for other recorded verdicts.
- Review the evidence and your use of @gigaflow/gmux@0.15.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.