registry / @mmmbuto/nexuscrew / 0.8.5

@mmmbuto/nexuscrew@0.8.5

Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 56 file(s), 1.11 MB of source, external domains: 127.0.0.1, api.example.com, api.openai.com, api.z.ai, ollama.com, reactjs.org, www.apple.com, www.w3.org

Source & flagged code

3 flagged

bin/nexuscrew.jsView file

Lines 1-14javascript

1#!/usr/bin/env node

2'use strict';

3// The normal product surface is the PWA. `nexuscrew` starts it in background;

4// `nexuscrew show` starts it when needed and opens it.

5const { dispatch } = require('../lib/cli/commands.js');

6Promise.resolve(dispatch(process.argv.slice

Source & flagged code

3 flagged · loading source

bin/nexuscrew.jsView file

4// `nexuscrew show` starts it when needed and opens it. L5: const { dispatch } = require('../lib/cli/commands.js'); L6: Promise.resolve(dispatch(process.argv.slice(2)))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/nexuscrew.jsView on unpkg · L4

lib/nodes/commands.jsView file

13const path = require('node:path'); L14: const { execFileSync } = require('node:child_process'); L15: const store = require('./store.js'); ... L21: function isReadonly(opts) { L22: return process.env.NEXUSCREW_READONLY === '1' || !!opts.readonly; L23: } ... L64: let cfg = {}; L65: try { const c = JSON.parse(fs.readFileSync(configPath, 'utf8')); if (c && typeof c === 'object') cfg = c; } catch (_) {} L66: const roles = (cfg.roles && typeof cfg.roles === 'object') ? cfg.roles : {}; ... L139: log(`nodes add: nodo "${name}" aggiunto (ssh ${ssh}${sshPort ? `:${sshPort}` : ''}, nexus remoto ${remotePort} -> locale ${localPort})`); L140: log('Incolla nel ~/.ssh/authorized_keys del NODO (lato forward, chiave dedicata):'); L141: // permitopen vincola i -L alla SOLA porta nexus remota; command=/bin/false + restrict.

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/nodes/commands.jsView on unpkg · L13

lib/fleet/managed.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mmmbuto/nexuscrew@0.8.3 matchedIdentity = npm:QG1tbWJ1dG8vbmV4dXNjcmV3:0.8.3 similarity = 0.855 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/fleet/managed.jsView on unpkg

Findings

1 High6 Medium5 Low

HighPrevious Version Dangerous Deltalib/fleet/managed.js

MediumDynamic Requirebin/nexuscrew.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencelib/nodes/commands.js

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

lib/nodes/commands.jsView file

Lines 1-33javascript

1'use strict';

2// lib/nodes/commands.js — subcomandi CLI `nodes` e `node` (design §3, §4, §4b).

3//

4// nodes add/list/remove/test/up/down/restart/set-token + node on/off.

5// Invarianti:

6// - token per-nodo MAI loggati/stampati (redazione sempre; set-token li legge

7// da stdin/env, mai da argv -> niente segreti in `ps`).

8// - NEXUSCREW_READONLY blocca le MUTAZIONI DI CONFIG (add/remove/set-token/

9// on/off), non list/test/status/up/down/restart (lifecycle tunnel, non config).

10// - niente shell interpolation: ssh-keygen via execFile (argv), tunnel via spawn argv.

11const fs = require('node:fs');

12const os = require('node:os');

13const path = require('node:path');

14const { execFileSync } = require('node:child_process');

15const store = require('./store.js');

16const tunnel = require('./tunnel.js');

17const { resolvePaths, loadPort, DEFAULT_PORT } = require('../cli/url.js');

19const LOCAL_PORT_BASE = 43001; // porte locali stabili per i forward (design: stabili da nodes.json)

21function isReadonly(opts) {

22 return process.env.NEXUSCREW_READONLY === '1' || !!opts.readonly;

23}

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/nodes/commands.jsView on unpkg · L13

25function resolveNodePaths(opts) {

26 const { home, configDir, configPath } = resolvePaths(opts);

27 const nodesPath = opts.nodesPath || path.join(configDir, 'nodes.json');

28 return { home, configDir, configPath, nodesPath };

29}

31// Prima localPort libera >= base, evitando le porte gia' assegnate (porta STABILE:

32// una volta scelta resta in nodes.json, non si ricicla).

33function assignLocalPort(st) {