registry  /  @monotykamary/localterm  /  2.34.0

@monotykamary/localterm@2.34.0

⚠ Under review

A browser-based terminal: one browser tab is one PTY session. Friendly URL, persistent xterm.js front-end, hono + node-pty back-end.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 68 file(s), 4.11 MB of source, external domains: base-ui.com, fonts.googleapis.com, github.com, json-schema.org, login.tailscale.com, react.dev, tailscale.com, www.apple.com, www.w3.org

Source & flagged code

7 flagged · loading source
dist/utils/spawn-daemon.jsView file
1import { spawn } from "node:child_process"; L2: import { DAEMON_CHILD_ENV_FLAG, RESTART_DAEMON_ENV_FLAG } from "../constants.js";
High
Child Process

Package source references child process execution.

dist/utils/spawn-daemon.jsView on unpkg · L1
dist/commands/install.jsView file
102Environment=PATH=${pathEnv} L103: ExecStartPre=/bin/sh -c 'command -v tailscale >/dev/null 2>&1 || exit 0; for i in $(seq 1 ${input.tailscaleBootWaitSeconds}); do tailscale status --json >/dev/null 2>&1 && exit 0; ... L104: ExecStart=${input.execPath} ${input.cliEntry} start --foreground --port ${input.port} --host ${input.host}
High
Shell

Package source references shell execution.

dist/commands/install.jsView on unpkg · L102
3import path from "node:path"; L4: import { execFile } from "node:child_process"; L5: import { promisify } from "node:util"; ... L7: import { DAEMON_BASE_PATH, LAUNCHD_LABEL, PORTLESS_RESOLVE_TIMEOUT_MS, PORTLESS_SERVICE_TIMEOUT_MS, SYSTEMD_OPERATION_TIMEOUT_MS, SYSTEMD_TAILSCALE_BOOT_WAIT_SECONDS, SYSTEMD_USER_... L8: import { cliError, exitCodeForCliError } from "../errors.js"; L9: import { getLaunchdPlistPath, getStateDirectory, getSystemdUserUnitDir, getSystemdUserUnitPath, } from "../paths.js"; ... L60: <key>HOME</key> L61: <string>${os.homedir()}</string> L62: <key>PATH</key> ... L94: Description=localterm terminal daemon L95: Documentation=https://github.com/monotykamary/localterm L96: After=network-online.target tailscaled.service
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/install.jsView on unpkg · L3
terminal/assets/ruby-BIq8jP7L.jsView file
1import e from"./shellscript-CLZ0U2zV.js";import{t}from"./c-N8i06uft.js";import n from"./sql-BsFa4tDR.js";import r from"./cpp-WgfOAgmr.js";import i from"./css-BsVw1vtW.js";import a ... L2: //# sourceMappingURL=ruby-BIq8jP7L.js.map
Medium
Dynamic Require

Package source references dynamic require/import behavior.

terminal/assets/ruby-BIq8jP7L.jsView on unpkg · L1
terminal/assets/index-D5BmXSKd.jsView file
122contains invisible/control Unicode U+2060 (word joiner) `):e}var ZI=null,QI;function $I(){return ZI===null&&(ZI=new Intl.Segmenter(QI,{granularity:`word`})),ZI}var eL=/\p{Script=Arabic}/u,tL=/\p{M}/u,nL=/\p{Nd}/u;function rL(e){return eL.test(e)}function iL(e){return e>=19968&&e<=40959||e>=13312
Critical
Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

terminal/assets/index-D5BmXSKd.jsView on unpkg · L122
270XID_Continue XIDC L271: XID_Start XIDS`.split(/\s/).map(e=>[kJ(e),e])),CY=new Map([[`s`,sY(383)],[sY(383),`s`]]),wY=new Map([[sY(223),sY(7838)],[sY(107),sY(8490)],[sY(229),sY(8491)],[sY(969),sY(8486)]]),T... L272: ]`:`(?>\r L273: ?|[ L274: \v\f…\u2028\u2029])`),t));else if(c===`posix`)if(!i&&(u===`graph`||u===`print`)){if(r===`strict`)throw Error(`POSIX class "${u}" requires min target ES2024 or non-strict accuracy`)... L275: `),BX=(e,t)=>{let n=PX.get(e);if(n&&n.contentKey===zX(t))return n.result},VX=async(e,t,n)=>{let r=BX(e,t);if(r!==void 0)return r;let i=AX[n];if(!i)return PX.set(e,{contentKey:zX(t)... L276: `),o=r.codeToTokens(a,{lang:n,theme:NX}).tokens.map(e=>({tokens:e.map(e=>({content:e.content,color:e.color??``,fontStyle:e.fontStyle??0}))}));return PX.set(e,{contentKey:zX(t),resu... L277: `);a.length>0&&a[a.length-1]===``&&a.pop();for(let e of a){let a=gZ.exec(e);if(a){r=Number.parseInt(a[1],10),i=Number.parseInt(a[2],10),n={header:e,lines:[]},t.push(n);continue}if(... ... L279: `)},ye[jw]=()=>{let e=n.querySelector(`.xterm-screen`);if(!(e instanceof HTMLElement))return null;let t=e.getBoundingClientRect();return{left:t.left,top:t.top,cellWidth:G.cols>0?t.... L280:
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

terminal/assets/index-D5BmXSKd.jsView on unpkg · L270
terminal/assets/geist-mono-latin-600-normal-DQQBcVN0.woff2View file
•path = terminal/assets/geist-mono-latin-600-normal-DQQBcVN0.woff2 kind = high_entropy_blob sizeBytes = 15264 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

terminal/assets/geist-mono-latin-600-normal-DQQBcVN0.woff2View on unpkg

Findings

1 Critical4 High5 Medium5 Low
CriticalTrojan Source Unicodeterminal/assets/index-D5BmXSKd.js
HighChild Processdist/utils/spawn-daemon.js
HighShelldist/commands/install.js
HighCommand Output Exfiltrationterminal/assets/index-D5BmXSKd.js
HighShips High Entropy Blobterminal/assets/geist-mono-latin-600-normal-DQQBcVN0.woff2
MediumDynamic Requireterminal/assets/ruby-BIq8jP7L.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/commands/install.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings