registry / @mmmbuto/nexuscrew / 0.8.5

@mmmbuto/nexuscrew@0.8.5

Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 56 file(s), 1.11 MB of source, external domains: 127.0.0.1, api.example.com, api.openai.com, api.z.ai, ollama.com, reactjs.org, www.apple.com, www.w3.org

Source & flagged code

3 flagged

bin/nexuscrew.jsView file

Lines 1-14javascript

1#!/usr/bin/env node

2'use strict';

3// The normal product surface is the PWA. `nexuscrew` starts it in background;

4// `nexuscrew show` starts it when needed and opens it.

5const { dispatch } = require('../lib/cli/commands.js');

6Promise.resolve(dispatch(process.argv.slice(2)))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/nexuscrew.jsView on unpkg · L4

7 .then((r) => {

8 if (!r || !r.keepAlive) process.exitCode = (r && r.code) || 0;

9 })

10 .catch((e) => {

11 process.stderr.write(`nexuscrew: ${String((e && e.message) || e)}\n`);

12 process.exitCode = 1;

13 });

lib/nodes/commands.jsView file

Lines 1-33javascript

1'use strict';

2// lib/nodes/commands.js — subcomandi CLI `nodes` e `node` (design §3, §4, §4b).

3//

4// nodes add/list/remove/test/up/down/restart/set-token + node on/off.

5// Invarianti:

6// - token per-nodo MAI loggati/stampati (redazione sempre; set-token li legge

7// da stdin/env, mai da argv -> niente segreti in `ps`).

8// - NEXUSCREW_READONLY blocca le MUTAZIONI DI CONFIG (add/remove/set-token/

9// on/off), non list/test/status/up/down/restart (lifecycle tunnel, non config).

10// - niente shell interpolation: ssh-keygen via execFile (argv), tunnel via spawn argv.

lib/fleet/managed.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mmmbuto/nexuscrew@0.8.3 matchedIdentity = npm:QG1tbWJ1dG8vbmV4dXNjcmV3:0.8.3 similarity = 0.855 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/fleet/managed.jsView on unpkg

Source & flagged code

3 flagged · loading source

bin/nexuscrew.jsView file

4// `nexuscrew show` starts it when needed and opens it. L5: const { dispatch } = require('../lib/cli/commands.js'); L6: Promise.resolve(dispatch(process.argv.slice(2)))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/nexuscrew.jsView on unpkg · L4

lib/nodes/commands.jsView file

13const path = require('node:path'); L14: const { execFileSync } = require('node:child_process'); L15: const store = require('./store.js'); ... L21: function isReadonly(opts) { L22: return process.env.NEXUSCREW_READONLY === '1' || !!opts.readonly; L23: } ... L64: let cfg = {}; L65: try { const c = JSON.parse(fs.readFileSync(configPath, 'utf8')); if (c && typeof c === 'object') cfg = c; } catch (_) {} L66: const roles = (cfg.roles && typeof cfg.roles === 'object') ? cfg.roles : {}; ... L139: log(`nodes add: nodo "${name}" aggiunto (ssh ${ssh}${sshPort ? `:${sshPort}` : ''}, nexus remoto ${remotePort} -> locale ${localPort})`); L140: log('Incolla nel ~/.ssh/authorized_keys del NODO (lato forward, chiave dedicata):'); L141: // permitopen vincola i -L alla SOLA porta nexus remota; command=/bin/false + restrict.

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/nodes/commands.jsView on unpkg · L13

lib/fleet/managed.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/fleet/managed.jsView on unpkg

Findings

1 High6 Medium5 Low

HighPrevious Version Dangerous Deltalib/fleet/managed.js

MediumDynamic Requirebin/nexuscrew.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencelib/nodes/commands.js

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

bin/nexuscrew.jsView file

Lines 1-14javascript

1#!/usr/bin/env node

2'use strict';

3// The normal product surface is the PWA. `nexuscrew` starts it in background;

4// `nexuscrew show` starts it when needed and opens it.

5const { dispatch } = require('../lib/cli/commands.js');

6Promise.resolve(dispatch(process.argv.slice(2)))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/nexuscrew.jsView on unpkg · L4

7 .then((r) => {

8 if (!r || !r.keepAlive) process.exitCode = (r && r.code) || 0;

9 })

10 .catch((e) => {

11 process.stderr.write(`nexuscrew: ${String((e && e.message) || e)}\n`);

12 process.exitCode = 1;

13 });

lib/nodes/commands.jsView file

Lines 1-33javascript

1'use strict';

2// lib/nodes/commands.js — subcomandi CLI `nodes` e `node` (design §3, §4, §4b).

3//

4// nodes add/list/remove/test/up/down/restart/set-token + node on/off.

5// Invarianti:

6// - token per-nodo MAI loggati/stampati (redazione sempre; set-token li legge

7// da stdin/env, mai da argv -> niente segreti in `ps`).

8// - NEXUSCREW_READONLY blocca le MUTAZIONI DI CONFIG (add/remove/set-token/

9// on/off), non list/test/status/up/down/restart (lifecycle tunnel, non config).

10// - niente shell interpolation: ssh-keygen via execFile (argv), tunnel via spawn argv.

lib/fleet/managed.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/fleet/managed.jsView on unpkg