registry / @ltgiang/9router / 0.5.32

@ltgiang/9router@0.5.32

9Router CLI - Start and manage 9Router server

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 24 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 35 file(s), 545 KB of source, external domains: 127.0.0.1, api.example.com, registry.npmjs.org, www.apple.com

Source & flagged code

15 flagged

package.jsonView file

Lines 1-41json

2 "name": "@ltgiang/9router",

3 "version": "0.5.32",

4 "description": "9Router CLI - Start and manage 9Router server",

5 "bin": {

6 "9router": "./cli.js"

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node hooks/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node hooks/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

app/.next-cli-build/server/chunks/4306.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

app/.next-cli-build/server/chunks/4306.jsView on unpkg · L1

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in app/.next-cli-build/server/chunks/4306.js

app/.next-cli-build/server/chunks/4306.jsView on unpkg · L1

app/src/mitm/server.jsView file

32`)}catch{}}var ld=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t++){let a=t;for(let r=0;r<8;r++)a=a&1?3988292384^a>>>1:a>>>1;e[t]=a}return e})();function Do(e){let t=42949672... L33: `);t.push({role:"tool",tool_call_id:n.toolUseId||"",content:s})}let r=(e.content||"").trim();return(r||a.length===0)&&t.push({role:"user",content:r}),t}function dd(e){let t=e.toolU... L34: $proc = Start-Process powershell -ArgumentList @(

High

Child Process

Package source references child process execution.

app/src/mitm/server.jsView on unpkg · L32

24Private-MAC: `+B.digest().toHex()+`\r L25: `,s};ma.publicKeyToOpenSSH=function(e,t){var a="ssh-rsa";t=t||"";var r=Ce.util.createBuffer();return mr(r,a),Et(r,e.e),Et(r,e.n),a+" "+Ce.util.encode64(r.bytes())+" "+t};ma.private... L26: `);u=c.pop()||"";for(let g of c){let v=g.trim();if(!v||!v.startsWith("data:"))continue;let y=v.slice(5).trim();if(y!=="[DONE]"){process.env.DEBUG_MITM&&Ea(`[SSE in] ${y.slice(0,200... ... L32: `)}catch{}}var ld=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t++){let a=t;for(let r=0;r<8;r++)a=a&1?3988292384^a>>>1:a>>>1;e[t]=a}return e})();function Do(e){let t=42949672... L33: `);t.push({role:"tool",tool_call_id:n.toolUseId||"",content:s})}let r=(e.content||"").trim();return(r||a.length===0)&&t.push({role:"user",content:r}),t}function dd(e){let t=e.toolU... L34: $proc = Start-Process powershell -ArgumentList @(

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

app/src/mitm/server.jsView on unpkg · L24

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

app/src/mitm/server.jsView on unpkg · L24

cli.jsView file

187if (process.platform === "win32") { L188: const psCmd = `powershell -NonInteractive -WindowStyle Hidden -Command "Get-WmiObject Win32_Process -Filter 'Name=\\"cloudflared.exe\\"' | Select-Object ProcessId,CommandLine | Con... L189: const output = execSync(psCmd, { encoding: "utf8", windowsHide: true, timeout: 5000 });

High

Shell

Package source references shell execution.

cli.jsView on unpkg · L187

2Cross-file remote execution chain: cli.js spawns app/src/mitm/server.js; helper contains network access plus dynamic code execution. L2: L3: const { spawn, exec, execSync } = require("child_process"); L4: const path = require("path"); L5: const fs = require("fs"); L6: const https = require("https"); L7: const os = require("os"); ... L16: start() { L17: if (process.stdout.isTTY) { L18: process.stdout.write(`\r${frames[0]} ${currentText}`); L19: interval = setInterval(() => { ... L44: L45: const pkg = require("./package.json");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli.jsView on unpkg · L2

app/server.jsView file

1const path = require('path') L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L1

src/cli/tray/autostart.jsView file

3const os = require("os"); L4: const { execSync } = require("child_process"); L5: ... L36: } L37: const computed = path.resolve(__dirname, "..", "..", "..", "cli.js"); L38: if (fs.existsSync(computed)) return computed; ... L47: function enableAutoStart(cliPath) { L48: const platform = process.platform; L49: L50: if (!["darwin", "win32", "linux"].includes(platform)) return false; L51: if (platform === "linux" && !process.env.DISPLAY) return false; L52:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli/tray/autostart.jsView on unpkg · L3

app/src/lib/updater/updater.jsView file

1// Standalone detached updater process. L2: // Spawns `npm i -g <pkg>@latest`, exposes progress via tiny HTTP server. L3: // Survives after parent Next server exits (detached + unref by spawner). L4: L5: const { spawn } = require("child_process"); L6: const http = require("http");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/src/lib/updater/updater.jsView on unpkg · L1

src/cli/tray/tray.ps1View file

•path = src/cli/tray/tray.ps1 kind = build_helper sizeBytes = 4001 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/cli/tray/tray.ps1View on unpkg

app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2View file

•path = app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2 kind = high_entropy_blob sizeBytes = 3962536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2View on unpkg

app/.next-cli-build/server/chunks/8971.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in app/.next-cli-build/server/chunks/8971.js

app/.next-cli-build/server/chunks/8971.jsView on unpkg · L1

Findings

3 Critical8 High7 Medium6 Low

CriticalCritical Secretapp/.next-cli-build/server/chunks/4306.js

CriticalSecret Patternapp/.next-cli-build/server/chunks/4306.js

CriticalSecret Patternapp/.next-cli-build/server/chunks/8971.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processapp/src/mitm/server.js

HighShellcli.js

HighSame File Env Network Executionapp/src/mitm/server.js

HighCommand Output Exfiltrationapp/src/mitm/server.js

HighCross File Remote Execution Contextcli.js

HighRuntime Package Installapp/src/lib/updater/updater.js

HighShips High Entropy Blobapp/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requireapp/server.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/cli/tray/autostart.js

MediumShips Build Helpersrc/cli/tray/tray.ps1

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

app/src/mitm/server.jsView file

Lines 4-52javascript

4${c}`;Gt.writeFileSync(n,v)}catch{}},file:n}}jn.exports={log:Lu,err:ku,dumpRequest:Ou,createResponseDumper:Vu,clearDumpDir:Du}});var $=F((ch,Wn)=>{Wn.exports={options:{usePureJavaScript:!1}}});var Zn=F((dh,Jn)=>{var Ba={};Jn.exports=Ba;var Xn={};Ba.encode=function(e,t,a){if(typeof t!="string")throw new TypeError('"alphabet" must be a string.');if(a!==void 0&&typeof a!="number")throw new TypeError('"maxline" must be a number.');var r="";if(!(e instanceof Uint8Array))r=Fu(e,t);else{var n=0,s=t.length,i=t.charAt(0),o=[0];for(n=0;n<e.length;++n){for(var u=0,l=e[n];u<o.length;++u)l+=o[u]<<8,o[u]=l% ...

5`)}return r};Ba.decode=function(e,t){if(typeof e!="string")throw new TypeError('"input" must be a string.');if(typeof t!="string")throw new TypeError('"alphabet" must be a string.');var a=Xn[t];if(!a){a=Xn[t]=[];for(var r=0;r<t.length;++r)a[t.charCodeAt(r)]=r}e=e.replace(/\s/g,"");for(var n=t.length,s=t.charAt(0),i=[0],r=0;r<e.length;r++){var o=a[e.charCodeAt(r)];if(o===void 0)return;for(var u=0,l=o;u<i.length;++u)l+=i[u]*n,i[u]=l&255,l>>=8;for(;l>0;)i.push(l&255),l>>=8}for(var f=0;e[f]===s&&f<e.length-1;++f)i.push(0);return typeof Buffer<"u"?Buffer.from(i.reverse()):new Uint8Array(i.reverse() ...

6`,a=a.substr(t));return r+=a,r};E.decode64=function(e){e=e.replace(/[^A-Za-z0-9\+\/\=]/g,"");for(var t="",a,r,n,s,i=0;i<e.length;)a=wt[e.charCodeAt(i++)-43],r=wt[e.charCodeAt(i++)-43],n=wt[e.charCodeAt(i++)-43],s=wt[e.charCodeAt(i++)-43],t+=String.fromCharCode(a<<2|r>>4),n!==64&&(t+=String.fromCharCode((r&15)<<4|n>>2),s!==64&&(t+=String.fromCharCode((n&3)<<6|s)));return t};E.encodeUtf8=function(e){return unescape(encodeURIComponent(e))};E.decodeUtf8=function(e){return decodeURIComponent(escape(e))};E.binary={raw:{},hex:{},base64:{},base58:{},baseN:{encode:ti.encode,decode:ti.decode}};E.binary. ...

7`,a=a.substr(t));return r+=a,r};E.binary.base64.decode=function(e,t,a){var r=t;r||(r=new Uint8Array(Math.ceil(e.length/4)

8`);for(var n="",s=0;s<t*a;++s)n+=" ";switch(r+=n+"Tag: ",e.tagClass){case U.Class.UNIVERSAL:r+="Universal:";break;case U.Class.APPLICATION:r+="Application:";break;case U.Class.CONTEXT_SPECIFIC:r+="Context-Specific:";break;case U.Class.PRIVATE:r+="Private:";break}if(e.tagClass===U.Class.UNIVERSAL)switch(r+=e.type,e.type){case U.Type.NONE:r+=" (None)";break;case U.Type.BOOLEAN:r+=" (Boolean)";break;case U.Type.INTEGER:r+=" (Integer)";break;case U.Type.BITSTRING:r+=" (Bit string)";break;case U.Type.OCTETSTRING:r+=" (Octet string)";break;case U.Type.NULL:r+=" (Null)";break;case U.Type.OID:r+=" (Ob ...

9`,r+=n+"Constructed: "+e.constructed+`

10`,e.composed){for(var i=0,o="",s=0;s<e.value.length;++s)e.value[s]!==void 0&&(i+=1,o+=U.prettyPrint(e.value[s],t+1,a),s+1<e.value.length&&(o+=","));r+=n

11`,r;if(e.procType&&(r={name:"Proc-Type",values:[String(e.procType.version),e.procType.type]},a+=Wr(r)),e.contentDomain&&(r={name:"Content-Domain",values:[e.contentDomain]},a+=Wr(r)),e.dekInfo&&(r={name:"DEK-Info",values:[e.dekInfo.algorithm]},e.dekInfo.parameters&&r.values.push(e.dekInfo.parameters),a+=Wr(r)),

12`),a+=Xr.util.encode64(e.body,t.maxline||64)+`\r

13`,a+="-----END "+e.type+`-----\r

14`,a};Ci.decode=function(e){for(var t=[],a=/\s*-----BEGIN ([A-Z0-9- ]+)-----\r?\n?([\x21-\x7e\s]+?(?:\r?\n\r?\n))?([:A-Za-z0-9+\/=\s]+?)-----END \1-----/

15`;for(var s=0,i=-1,n=0;n<t.length;++n,++s)if(s>65&&i!==-1){var o=t[i];o===","?(++i,t=t.substr(0,i)+`\r

16 `+t.substr(i)):t=t.substr(0,i)+`\r

17`+o+t.substr(i+1),s=n-i-1,i=-1,++n}else(t[n]===" "||t[n]===" "||t[n]===",")&&(i=n);return t}function ju(e){return e.replace(/^\s+/,"")}});var Ar=F((Th,Si)=>{var pe=$();qr();La();re();Si.exports=pe.des=pe.des||{};pe.des.startEncrypting=function(e,t,a,r){var n=Jr({key:e,output:a,decrypt:!1,mode:r||(t===null?"ECB":"CBC")});return n.start(t),n};pe.des.createEncryptionCipher=function(e,t){return Jr({key:e,output:null,decrypt:!1,mode:t})};pe.des.startDecrypting=function(e,t,a,r){var n=Jr({key:e,output:a,decrypt:!0,mode:r||(t===null?"ECB":"CBC")});return n.start(t),n};pe.des.createDecryptionCipher=fu ...

18`;s+="Encryption: "+n+`\r

19`,s+="Comment: "+a+`\r

20`;var i=Ce.util.createBuffer();mr(i,r),Et(i,e.e),Et(i,e.n);var o=Ce.util.encode64(i.bytes(),64),u=Math.floor(o.length/66)+1;s+="Public-Lines: "+u+`\r

21`,s+=o;var l=Ce.util.createBuffer();Et(l,e.d),Et(l,e.p),Et(l,e.q),Et(l,e.qInv);var f;if(!t)f=Ce.util.encode64(l.bytes(),64);else{var c=l.length()+16-1;c-=c%16;var g=va(l.bytes());g.truncate(g.length()-c+l.length()),l.putBuffer(g);var v=Ce.util.createBuffer();v.putBuffer(va("\0\0\0\0",t)),v.putBuffer(va("

22Private-Lines: `+u+`\r

23`,s+=f;var S=va("putty-private-key-file-mac-key",t),I=Ce.util.createBuffer();mr(I,r),mr(I,n),mr(I,a),I.putInt32(i.length()),I.putBuffer(i),I.putInt32(l.length()),I.putBuffer(l);var

24Private-MAC: `+B.digest().toHex()+`\r

25`,s};ma.publicKeyToOpenSSH=function(e,t){var a="ssh-rsa";t=t||"";var r=Ce.util.createBuffer();return mr(r,a),Et(r,e.e),Et(r,e.n),a+" "+Ce.util.encode64(r.bytes())+" "+t};ma.privateKeyToOpenSSH=function(e,

26`);u=c.pop()||"";for(let g of c){let v=g.trim();if(!v||!v.startsWith("data:"))continue;let y=v.slice(5).trim();if(y!=="[DONE]"){process.env.DEBUG_MITM&&Ea(`[SSE in] ${y.slice(0,200)}`);try{let x=JSON.parse(y),S=a(x,r);if(S!=null){let I=Array.isArray(S)?S:[S];for(let B of I){if(process.env.DEBUG_MITM){let b=B.length||B.byteLength||0;Ea(`[write binary frame] (${b}B) first 20B: ${Array.from(B.slice(0,20)).join(",")}`)}t.write(Buffer.from(B))}}}catch{}}}}try{let l=a(null,r);if(l!=null){let f=Array.isArray(l)?l:[l];for(let c of f)t.write(c)}}catch{}t.end()}async function Hc(e,t,a,r){let n={"Content ...

27`);o=f.pop()||"";for(let c of f){let g=c.trim();if(!g||!g.startsWith("data:"))continue;let v=g.slice(5).trim();if(v!=="[DONE]"){process.env.DEBUG_MITM&&Ea

28[ERROR] ${i.message}

29`),n.end()),s?(t.headersSent||t.writeHead(200,{"Content-Type":"text/event-stream"}),t.end(`data: ${JSON.stringify({error:{message:i.message}})}\r

30\r

31`)):(t.headersSent||t.writeHead(500,{"Content-Type":"application/json"}),t.end(JSON.stringify({error:{message:i.message,type:"mitm_error"}})))}}No.exports={intercept:jc}});var Lo=F((lp,Ro)=>{var{err:Wc}=_t(),{fetchRouter:Xc,pipeSSE:Jc}=xa(),Zc={"/chat/completions":"/v1/chat/completions","/v1/messages":"/v1/messages","/responses":"/v1/responses"};function ed(e){for(let[t,a]of Object.entries(Zc))if(e.includes(t))return a;return"/v1/chat/completions"}async function td(e,t,a,r){try{let n=JSON.parse(a.toString());n.model=r;let s=ed(e.url),i=await Xc(n,s,e.headers);await Jc(i,t)}catch(n){Wc(`[copilo ...

32`)}catch{}}var ld=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t++){let a=t;for(let r=0;r<8;r++)a=a&1?3988292384^a>>>1:a>>>1;e[t]=a}return e})();function Do(e){let t=4294967295;for(let a=0;a<e.length;a++)t=t>>>8^ld[(t^e[a])&255];return(t^4294967295)>>>0}function fd(e){return{modelId:e||null,toolCallInit:{},hasToolCalls:!1,finishSent:!1,usage:null,inThink:!1,thinkBuf:""}}function Po(e,t){if(!e)return{thinking:null,text:null};let a=e;t.inThink&&t.thinkBuf&&(a=t.thinkBuf+a,t.thinkBuf="",t.inThink=!1);let r=/<thinking>|<think>/i,n=a.match(r);if(!n)return{thinking:null,text:a};let s=n[0].toLo ...

33`);t.push({role:"tool",tool_call_id:n.toolUseId||"",content:s})}let r=(e.content||"").trim();return(r||a.length===0)&&t.push({role:"user",content:r}),t}function dd(e){let t=e.toolUses||[];return t.length>0?{role:"assistant"

34 $proc = Start-Process powershell -ArgumentList @(

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

app/src/mitm/server.jsView on unpkg · L24

High

Child Process

Package source references child process execution.

app/src/mitm/server.jsView on unpkg · L32

35 '-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass',

36 '-WindowStyle','Hidden','-EncodedCommand','${t}'

37 ) -Verb RunAs -Wait -PassThru -WindowStyle Hidden;

38 if ($proc.ExitCode -ne 0) { throw "Elevated command exited with code $($proc.ExitCode)" }

39 `;return new Promise((r,n)=>{zo(`powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command ${Yo(a)}`,{windowsHide:!0},(s,i,o)=>{if(s){let u=o||s.message;u.includes("canceled by the user")||u.includes("operation was canceled")?n(new Error("User canceled UAC prompt")):n(new Error(u))}else r(i)})})}jo.exports={isAdmin:$o,runElevatedPowerShell:Ad,quotePs:Yo}});var iu=F((Cp,nu)=>{var{exec:yp,spawn:Xo,execSync:Or}=require("child_process"),_e=require("fs"),Bd=require("path"),vp=require("os"),{log:Sa,err:bd}=_t(),{TOOL_HOSTS:Mt}=Go(),{runElevatedPowerShell:Jo,isAdmin:mp}=Wo();function Z ...

40`),s.stdin.end())})}async function ru(e){bt||(eu?await Vr("dscacheutil -flushcache && killall -HUP mDNSResponder",e):await Vr("resolvectl flush-caches 2>/dev/null || true",e))}function wn(e=null){try{let t=_e.readFileSync(Ze,"utf8");return e?t.includes

41`),o=`${s}\r

42${i}\r

43`;Zo(Ze,n,o),await Jo("ipconfig /flushdns | Out-Null")}else{let s=_e.readFileSync(Ze,"utf8").replace(/[\r\n\s]+$/g,""),i=r.map(l=>`127.0.0.1 ${l}`).join(`

44`),u=`${s}

45${i}

46`.replace(/'/g,"'\\''");await Vr(`printf '%s' '${u}' | tee ${Ze} > /dev/null`,t),await ru(t)}Sa(`\u{1F310} DNS ${e}: \u2705 added ${r.join(", ")}`)}catch(n){let s=n.message?.includes("incorrect password")?"Wrong sudo password":`Failed to add DNS entry: ${n.message}`;throw new Error(s)}}async function au(e,t){let a=Mt[e];if(!a)throw new Error(`Unknown tool: ${e}`);let r=a.filter(n=>wn(n));if(r.length===0){Sa(`\u{1F310} DNS ${e}: already inactive`);return}try{if(bt){let n=_e.readFileSync(Ze,"utf8"),i=n.split(/\r?\n/).filter(o=>!r.some(u=>o.includes(u))).join(`\r

47`).replace(/[\r\n\s]+$/g,"")+`\r

48`;Zo(Ze,n,i),await Jo("ipconfig /flushdns | Out-Null")}else{let o=(_e.readFileSync(Ze,"utf8").split(/\r?\n/).filter(u=>!r.some(l=>u.includes(l))).join(`

49`).replace(/[\r\n\s]+$/g,"")+`

50`).replace(/'/g,"'\\''");await Vr(`printf '%s' '${o}' | tee ${Ze} > /dev/null`,t),await ru(t)}Sa(`\u{1F310} DNS ${e}: \u2705 removed ${r.join(", ")}`)}catch(n){let s=n.message?.includes("incorrect password")?"Wrong sudo password":`Failed to remove DNS entry: ${n.message}`;throw new Error(s)}}async function Rd(e){for(let t of Object.keys(Mt))try{await au(t,e)}catch(a){bd(`DNS ${t}: failed to remove \u2014 ${a.message}`)}}function Ld(){try{if(!_e.existsSync(Ze))return;let e=Object.values(Mt).flat(),t=_e.readFileSync(Ze,"utf8"),a=bt?`\r

51`:`

52`,n=t.split(/\r?\n/).filter(s=>!e.some(i=>s.includes(i))).join(a).replace(/[\r\n\s]+$/g,"")+a;if(n===t)return;if(_e.writeFileSync(Ze,n,"utf8"),bt)try{Or("ipconfig /flushdns",{windowsHide:!0,stdio:"ignore"})}catch{}else if(eu)try{Or("dscacheutil -flushcache && killall -HUP mDNSResponder",{stdio:"ignore"})}catch{}else try{Or("resolvectl flush-caches 2>/dev/null || true",{stdio:"ignore"})}catch{}}catch{}}nu.exports={TOOL_HOSTS:Mt,addDNSEntry:wd,removeDNSEntry:au,removeAllDNSEntries:Rd,removeAllDNSEntriesSync:Ld,execWithPassword:Vr,isSudoAvailable:Ta,canRunSudoWithoutPassword:tu,isSudoPasswordRequ ...

Long lines were clipped for display.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

app/src/mitm/server.jsView on unpkg · L24

cli.jsView file

Lines 167-207javascript

167 process.kill(pid, "SIGKILL");

168 }

169 } catch { }

170 try { fs.unlinkSync(pidFile); } catch { }

171 } catch { }

172}

173

174// Kill tunnel processes (cloudflared/tailscale) by their PID files

175function killTunnelByPidFile() {

176 const tunnelDir = path.join(getAppDataDir(), "tunnel");

177 killByPidFile(path.join(tunnelDir, "cloudflared.pid"));

178 killByPidFile(path.join(tunnelDir, "tailscale.pid"));

179}

180

181// Kill cloudflared whose --url targets this app's port (covers stale PID file case)

182function killCloudflaredByAppPort(appPort) {

183 if (!appPort) return [];

184 const portMatchers = [`localhost:${appPort}`, `127.0.0.1:${appPort}`];

185 const pids = [];

186 try {

187 if (process.platform === "win32") {

188 const psCmd = `powershell -NonInteractive -WindowStyle Hidden -Command "Get-WmiObject Win32_Process -Filter 'Name=\\"cloudflared.exe\\"' | Select-Object ProcessId,CommandLine | ConvertTo-Csv -NoTypeInformation"`;

189 const output = execSync(psCmd, { encoding: "utf8", windowsHide: true, timeout: 5000 });

High

Shell

Package source references shell execution.

cli.jsView on unpkg · L187

190 const lines = output.split("\n").slice(1).filter(l => l.trim());

191 lines.forEach(line => {

192 if (portMatchers.some(m => line.includes(m))) {

193 const match = line.match(/^"(\d+)"/);

194 if (match && match[1]) pids.push(match[1]);

195 }

196 });

197 } else {

198 const output = execSync("ps -eo pid,command 2>/dev/null", { encoding: "utf8", timeout: 5000 });

199 output.split("\n").forEach(line => {

200 if (line.includes("cloudflared") && portMatchers.some(m => line.includes(m))) {

201 const parts = line.trim().split(/\s+/);

202 const pid = parts[0];

203 if (pid && !isNaN(pid)) pids.push(pid);

204 }

205 });

206 }

207 } catch { }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli.jsView on unpkg · L2