registry / @juspay/shooter / 1.26.0

@juspay/shooter@1.26.0

⚠ Under review

Bidirectional communication server for Claude Code and iOS — push notifications, remote terminal, session viewing

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 24 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 306 file(s), 2.56 MB of source, external domains: aistudio.google.com, api.anthropic.com, api.mistral.ai, api.openai.com, console.anthropic.com, console.mistral.ai, datatracker.ietf.org, developers.cloudflare.com, fonts.googleapis.com, fonts.gstatic.com, generativelanguage.googleapis.com, github.com, my.site, platform.openai.com, shooter.breezehq.dev, svelte.dev, unpkg.com, www.apple.com, www.w3.org

Source & flagged code

13 flagged

package.jsonView file

Lines 44-84json

44 "overrides": {

45 "devalue": ">=5.8.1",

46 "protobufjs": ">=7.5.8 <8",

47 "@protobufjs/utf8": ">=1.1.1",

48 "lodash": ">=4.18.0",

49 "lodash-es": ">=4.18.0",

50 "fast-xml-parser": ">=5.7.0",

51 "fast-xml-builder": ">=1.1.7",

52 "postcss": ">=8.5.10",

53 "cookie": ">=0.7.0 <2",

54 "@tootallnate/once": ">=3.0.1"

55 }

56 },

57 "engines": {

58 "node": ">=20"

59 },

60 "publishConfig": {

61 "access": "public"

62 },

63 "scripts": {

64 "postinstall": "node-gyp rebuild --directory=node_modules/node-pty --loglevel=silent > /dev/null 2>&1 || echo '⚠ node-pty build failed — terminal features will not work. Install build tools: macOS: xcode-select --install | Linux: apt install python3 make g++'; node-gyp rebuild --directory=node_modules/better-sqlite3 --loglevel=silent > /dev/null 2>&1 || echo '⚠ better-sqlite3 build failed — terminal persistence will not work.'",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L64

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L64

65 "build": "vite build",

66 "postbuild": "cp src/lib/modules/server/terminal/pty-holder.cjs build/pty-holder.cjs",

67 "dev": "node scripts/dev.mjs",

68 "preview": "vite preview",

69 "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json && tsc --noEmit --strict",

70 "start": "tsx server.ts",

71 "lint": "eslint .",

72 "lint:fix": "eslint . --fix",

73 "format": "prettier --write .",

74 "format:check": "prettier --check .",

75 "lint:fix:generated": "eslint './src/lib/types/generated/**/*.{js,ts}' --fix",

76 "format:generated": "prettier --write ./src/lib/types/generated/*",

77 "quality:all": "pnpm run lint && pnpm run format:check && pnpm run check",

78 "gen:types": "npx type-crafter generate typescript-with-decoders ./specs/types/index.yaml ./src/lib/types/generated SingleFile SingleFile && bash scripts/postgen-types.sh && pnpm run format:generated",

79 "test": "node tests/terminal-store.test.cjs && node tests/pending-requests.test.cjs && node tests/tunnel-discovery.test.cjs && node tests/service-manager.test.cjs && node tests/plan-mode-routing.test.cjs && node tests/dynamic-options-extraction.test.cjs && node tests/next-step-consensus.test.cjs && node tests/summaries-route.test.cjs && node tests/litellm-client.test.cjs && node tests/decide-injection.test.cjs && node tests/presence-store.test.cjs && node tests/autopilot-context.test.cjs && node tests/apns-payload.test.cjs && node tests/agent-launch.test.cjs && node tests/codex-parser.test ...

80 "setup": "node scripts/setup.cjs",

81 "prepare": "husky || true",

82 "prepublishOnly": "pnpm build"

83 },

84 "devDependencies": {

Long lines were clipped for display.

bin/shooter.cjsView file

Lines 1-29javascript

1#!/usr/bin/env node

3// CLI entry point for the Shooter server.

4// Usage: shooter [command]

6'use strict';

8const os = require('os');

9const path = require('path'

build/server/index.jsView file

Lines 1-21javascript

1import { w as with_request_store, b as base64_decode, r as root, d as decode_pathname, n as normalize_path, a as disable_search, c as decode_params, v as validate_layout_server_exports, e as validate_layout_exports, f as validate_page_server_exports, g as validate_page_exports, t as text_encoder, h as resolve, m as make_trackable, i as get_relative_path, j as base64_encode } from './chunks/root-Ce8FGAoU.js'

scripts/install.shView file

•path = scripts/install.sh kind = build_helper sizeBytes = 25144 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install.shView on unpkg

build/client/manifest.json.gzView file

•path = build/client/manifest.json.gz kind = compressed_blob sizeBytes = 231 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/manifest.json.gzView on unpkg

build/client/_app/immutable/nodes/3.D-wAks1A.js.gzView file

•path = build/client/_app/immutable/nodes/3.D-wAks1A.js.gz kind = high_entropy_blob sizeBytes = 5348 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build/client/_app/immutable/nodes/3.D-wAks1A.js.gzView on unpkg

README.mdView file

176patternName = private_key_rsa severity = critical line = 176 matchedText = APNS_KEY...---"

Critical

Secret Pattern

RSA private key in README.md

README.mdView on unpkg · L176

218patternName = private_key_rsa severity = critical line = 218 matchedText = FCM_PRIV...---"

Critical

Secret Pattern

RSA private key in README.md

README.mdView on unpkg · L218

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node-gyp rebuild --directory=node_modules/node-pty --loglevel=silent > /dev/null 2>&1 || echo '⚠ node-pty build failed — terminal features will not work. Install build tools: macOS...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/shooter.cjsView file

9const path = require('path'); L10: const { spawn, execSync, execFileSync } = require('child_process'); L11: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/shooter.cjsView on unpkg · L9

9Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L9: const path = require('path'); L10: const { spawn, execSync, execFileSync } = require('child_process'); L11: const fs = require('fs'); ... L25: // ── Resolve paths ─────────────────────────────────────────────────── L26: const PKG_ROOT = path.resolve(__dirname, '..'); L27: const SHOOTER_HOME = process.env.SHOOTER_HOME || path.join(os.homedir(), '.shooter'); L28: const PID_FILE = path.join(SHOOTER_HOME, 'shooter.pid'); ... L35: L36: const pkg = require(path.join(PKG_ROOT, 'package.json')); L37: ... L201: L202: const cf = spawn('cloudflared', ['tunnel', '--url', `http://localhost:${port}`], {

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/shooter.cjsView on unpkg · L9

973/** L974: * Perform the actual update: git pull → pnpm install → pnpm build. L975: * Returns true on success. On failure, rolls back and returns false. ... L984: try { L985: savedHead = execSync('git rev-parse HEAD', { L986: cwd: PKG_ROOT,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/shooter.cjsView on unpkg · L973

7L8: const os = require('os'); L9: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/shooter.cjsView on unpkg · L7

9const path = require('path'); L10: const { spawn, execSync, execFileSync } = require('child_process'); L11: const fs = require('fs'); ... L25: // ── Resolve paths ─────────────────────────────────────────────────── L26: const PKG_ROOT = path.resolve(__dirname, '..'); L27: const SHOOTER_HOME = process.env.SHOOTER_HOME || path.join(os.homedir(), '.shooter'); L28: const PID_FILE = path.join(SHOOTER_HOME, 'shooter.pid'); ... L35: L36: const pkg = require(path.join(PKG_ROOT, 'package.json')); L37: ... L201: L202: const cf = spawn('cloudflared', ['tunnel', '--url', `http://localhost:${port}`], {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/shooter.cjsView on unpkg · L9

build/server/index.jsView file

1import { w as with_request_store, b as base64_decode, r as root, d as decode_pathname, n as normalize_path, a as disable_search, c as decode_params, v as validate_layout_server_exp... L2: import { U as UNDEFINED, N as NAN, P as POSITIVE_INFINITY, a as NEGATIVE_INFINITY, b as NEGATIVE_ZERO, S as SPARSE, i as is_valid_array_len, M as MAX_ARRAY_INDEX, c as is_valid_arr... ... L4: import { w as writable, r as readable } from './chunks/index-L-OMOXY-.js'; L5: import { s as set_private_env, a as set_public_env, p as public_env } from './chunks/shared-server-DaWdgxVh.js'; L6: ... L191: } L192: case "URLSearchParams": { L193: const url = new URLSearchParams(value[1]); ... L945: // Svelte also escapes < because the escape function could be called inside a `noscript` there L946: // https://github.[redacted]-8266-84wp-wv5c L947: // However, that doesn't apply in SvelteKit ... L1151: },

Critical

Global Object Hijack Exfiltration

Source reassigns a global/builtin to a Proxy that forwards intercepted runtime data to an external endpoint.

build/server/index.jsView on unpkg · L1

scripts/install.shView file

•path = scripts/install.sh kind = build_helper sizeBytes = 25144 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install.shView on unpkg

build/client/manifest.json.gzView file

•path = build/client/manifest.json.gz kind = compressed_blob sizeBytes = 231 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/manifest.json.gzView on unpkg

build/client/_app/immutable/nodes/3.D-wAks1A.js.gzView file

•path = build/client/_app/immutable/nodes/3.D-wAks1A.js.gz kind = high_entropy_blob sizeBytes = 5348 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build/client/_app/immutable/nodes/3.D-wAks1A.js.gzView on unpkg

README.mdView file

176patternName = private_key_rsa severity = critical line = 176 matchedText = APNS_KEY...---"

Critical

Secret Pattern

RSA private key in README.md

README.mdView on unpkg · L176

218patternName = private_key_rsa severity = critical line = 218 matchedText = FCM_PRIV...---"

Critical

Secret Pattern

RSA private key in README.md

README.mdView on unpkg · L218

Findings

3 Critical6 High8 Medium7 Low

CriticalGlobal Object Hijack Exfiltrationbuild/server/index.js

CriticalSecret PatternREADME.md

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/shooter.cjs

HighShell

HighEntrypoint Build Divergencebin/shooter.cjs

HighRuntime Package Installbin/shooter.cjs

HighShips High Entropy Blobbuild/client/_app/immutable/nodes/3.D-wAks1A.js.gz

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/shooter.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/shooter.cjs

MediumShips Build Helperscripts/install.sh

MediumShips Compressed Blobbuild/client/manifest.json.gz

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

13 flagged

package.jsonView file

Lines 44-84json

44 "overrides": {

45 "devalue": ">=5.8.1",

46 "protobufjs": ">=7.5.8 <8",

47 "@protobufjs/utf8": ">=1.1.1",

48 "lodash": ">=4.18.0",

49 "lodash-es": ">=4.18.0",

50 "fast-xml-parser": ">=5.7.0",

51 "fast-xml-builder": ">=1.1.7",

52 "postcss": ">=8.5.10",

53 "cookie": ">=0.7.0 <2",

54 "@tootallnate/once": ">=3.0.1"

55 }

56 },

57 "engines": {

58 "node": ">=20"

59 },

60 "publishConfig": {

61 "access": "public"

62 },

63 "scripts": {

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L64

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L64

65 "build": "vite build",

66 "postbuild": "cp src/lib/modules/server/terminal/pty-holder.cjs build/pty-holder.cjs",

67 "dev": "node scripts/dev.mjs",

68 "preview": "vite preview",

69 "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json && tsc --noEmit --strict",

70 "start": "tsx server.ts",

71 "lint": "eslint .",

72 "lint:fix": "eslint . --fix",

73 "format": "prettier --write .",

74 "format:check": "prettier --check .",

75 "lint:fix:generated": "eslint './src/lib/types/generated/**/*.{js,ts}' --fix",

76 "format:generated": "prettier --write ./src/lib/types/generated/*",

77 "quality:all": "pnpm run lint && pnpm run format:check && pnpm run check",

80 "setup": "node scripts/setup.cjs",

81 "prepare": "husky || true",

82 "prepublishOnly": "pnpm build"

83 },

84 "devDependencies": {

Long lines were clipped for display.

bin/shooter.cjsView file

Lines 1-29javascript

1#!/usr/bin/env node

3// CLI entry point for the Shooter server.

4// Usage: shooter [command]

6'use strict';

8const os = require('os');

9const path = require('path'

build/server/index.jsView file

Lines 1-21javascript

1import { w as with_request_store, b as base64_decode, r as root, d as decode_pathname, n as normalize_path, a as disable_search, c as decode_params, v as validate_layout_server_exports, e as validate_layout_exports, f as validate_page_server_exports, g as validate_page_exports, t as text_encoder, h as resolve, m as make_trackable, i as get_relative_path, j as base64_encode } from './chunks/root-Ce8FGAoU.js'

scripts/install.shView file

•path = scripts/install.sh kind = build_helper sizeBytes = 25144 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install.shView on unpkg

build/client/manifest.json.gzView file

•path = build/client/manifest.json.gz kind = compressed_blob sizeBytes = 231 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/manifest.json.gzView on unpkg

build/client/_app/immutable/nodes/3.D-wAks1A.js.gzView file

•path = build/client/_app/immutable/nodes/3.D-wAks1A.js.gz kind = high_entropy_blob sizeBytes = 5348 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build/client/_app/immutable/nodes/3.D-wAks1A.js.gzView on unpkg

README.mdView file

176patternName = private_key_rsa severity = critical line = 176 matchedText = APNS_KEY...---"

Critical

Secret Pattern

RSA private key in README.md

README.mdView on unpkg · L176

218patternName = private_key_rsa severity = critical line = 218 matchedText = FCM_PRIV...---"

Critical

Secret Pattern

RSA private key in README.md

README.mdView on unpkg · L218