registry  /  @mmmbuto/nexuscrew  /  0.8.3

@mmmbuto/nexuscrew@0.8.3

Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy

Static Scan Results

scanned 20h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason
No blocking static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket
Supply chain
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
ManifestNo manifest risk signals triggered.
scanned 55 file(s), 1.08 MB of source, external domains: 127.0.0.1, api.example.com, api.z.ai, ollama.com, reactjs.org, www.apple.com, www.w3.org

Source & flagged code

2 flagged · loading source
bin/nexuscrew.jsView file
4// `nexuscrew show` starts it when needed and opens it. L5: const { dispatch } = require('../lib/cli/commands.js'); L6: Promise.resolve(dispatch(process.argv.slice(2)))
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/nexuscrew.jsView on unpkg · L4
lib/nodes/commands.jsView file
13const path = require('node:path'); L14: const { execFileSync } = require('node:child_process'); L15: const store = require('./store.js'); ... L21: function isReadonly(opts) { L22: return process.env.NEXUSCREW_READONLY === '1' || !!opts.readonly; L23: } ... L64: let cfg = {}; L65: try { const c = JSON.parse(fs.readFileSync(configPath, 'utf8')); if (c && typeof c === 'object') cfg = c; } catch (_) {} L66: const roles = (cfg.roles && typeof cfg.roles === 'object') ? cfg.roles : {}; ... L139: log(`nodes add: nodo "${name}" aggiunto (ssh ${ssh}${sshPort ? `:${sshPort}` : ''}, nexus remoto ${remotePort} -> locale ${localPort})`); L140: log('Incolla nel ~/.ssh/authorized_keys del NODO (lato forward, chiave dedicata):'); L141: // permitopen vincola i -L alla SOLA porta nexus remota; command=/bin/false + restrict.
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/nodes/commands.jsView on unpkg · L13

Findings

6 Medium5 Low
MediumDynamic Requirebin/nexuscrew.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencelib/nodes/commands.js
MediumProtestware
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings