registry / @luckydraw/cumulus / 1.1.0

@luckydraw/cumulus@1.1.0

⚠ Under review

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Manifest

NoLicense

scanned 98 file(s), 2.00 MB of source, external domains: 127.0.0.1, api.openai.com, api.search.brave.com, app.texitool.com, plastic.luckydraw.dev, registry.npmjs.org, router.huggingface.co, www.apple.com, www.w3.org

Source & flagged code

7 flagged

dist/tui/hooks/useClaudeProcess.jsView file

3*/ L4: import { spawn } from 'child_process'; L5: import { useCallback, useRef } from 'react';

High

Child Process

Package source references child process execution.

dist/tui/hooks/useClaudeProcess.jsView on unpkg · L3

dist/lib/gateway.jsView file

1834// Windows: spawn() can't directly exec .cmd/.bat shims (CVE-2024-27980). L1835: // Routing through cmd.exe is required for the npm-installed `claude.cmd`. L1836: const isWindowsShim = process.platform === 'win32' && /\.(cmd|bat|ps1)$/i.test(resolvedClaudePath);

High

Shell

Package source references shell execution.

dist/lib/gateway.jsView on unpkg · L1834

dist/gateway/server.jsView file

16*/ L17: import { execFileSync } from 'child_process'; L18: import * as crypto from 'crypto'; L19: import * as fs from 'fs'; L20: import * as http from 'http'; L21: import * as os from 'os'; ... L65: headers: { 'Content-Type': 'application/json' }, L66: body: JSON.stringify({ L67: command: 'records.get', ... L70: }); L71: const record = (await upstream.json()); L72: if (record?.ok) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/gateway/server.jsView on unpkg · L16

dist/gateway/setup.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @luckydraw/cumulus@0.31.66 matchedIdentity = npm:QGx1Y2t5ZHJhdy9jdW11bHVz:0.31.66 similarity = 0.885 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/gateway/setup.jsView on unpkg

7Trigger-reachable persistence chain: manifest.bin -> dist/gateway/daemon.js -> dist/gateway/setup.js L7: */ L8: import { execSync } from 'child_process'; L9: import { randomBytes } from 'crypto'; ... L13: import { DEFAULT_PORT } from './config.js'; L14: const CUMULUS_DIR = process.env.CUMULUS_DIR || path.join(os.homedir(), '.cumulus'); L15: const CONFIG_PATH = path.join(CUMULUS_DIR, 'gateway.config.json'); ... L17: '.git', L18: 'package.json', L19: 'Cargo.toml', ... L70: const readline = await import('readline'); L71: const rl = readline.createInterface({ input: process.stdin, output: process.stdout }); L72: const prompt = defaultValue ? `${question} [${defaultValue}]: ` : `${question}: `;

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/gateway/setup.jsView on unpkg · L7

7*/ L8: import { execSync } from 'child_process'; L9: import { randomBytes } from 'crypto'; ... L13: import { DEFAULT_PORT } from './config.js'; L14: const CUMULUS_DIR = process.env.CUMULUS_DIR || path.join(os.homedir(), '.cumulus'); L15: const CONFIG_PATH = path.join(CUMULUS_DIR, 'gateway.config.json'); ... L17: '.git', L18: 'package.json', L19: 'Cargo.toml', ... L70: const readline = await import('readline'); L71: const rl = readline.createInterface({ input: process.stdin, output: process.stdout }); L72: const prompt = defaultValue ? `${question} [${defaultValue}]: ` : `${question}: `;

dist/lib/version-check.jsView file

179// ─── Perform update ────────────────────────────────────────── L180: /** Check if sudo is needed for global npm install */ L181: export async function needsSudo() { L182: const { execSync } = await import('child_process'); L183: try {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib/version-check.jsView on unpkg · L179

Source & flagged code

7 flagged · loading source

dist/tui/hooks/useClaudeProcess.jsView file

3*/ L4: import { spawn } from 'child_process'; L5: import { useCallback, useRef } from 'react';

High

Child Process

Package source references child process execution.

dist/tui/hooks/useClaudeProcess.jsView on unpkg · L3

dist/lib/gateway.jsView file

High

Shell

Package source references shell execution.

dist/lib/gateway.jsView on unpkg · L1834

dist/gateway/server.jsView file

Findings

1 Critical4 High4 Medium8 Low

CriticalPrevious Version Dangerous Deltadist/gateway/setup.js

HighChild Processdist/tui/hooks/useClaudeProcess.js

HighShelldist/lib/gateway.js

HighTrigger Reachable Persistencedist/gateway/setup.js

HighRuntime Package Installdist/lib/version-check.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/gateway/setup.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/gateway/server.js

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @luckydraw/cumulus@1.1.0.

See all versions of @luckydraw/cumulus for other recorded verdicts.

Review the evidence and your use of @luckydraw/cumulus@1.1.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-08 02:42:39.999Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.