registry / @omniforge/mission-control / 0.8.0

@omniforge/mission-control@0.8.0

Mission Control is a local-first control panel for running AI coding agents against your own repositories. It turns a request into a scoped ticket, routes that ticket through a workflow, keeps local project memory, and can hand completed work to PR or MR

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 48 file(s), 1.47 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.clickup.com, api.github.com, app.clickup.com, boxy-svg.com, chatgpt.com, claude.ai, code.claude.com, cursor.com, github.com, gitlab.com, json-schema.org, nodejs.org, registry.npmjs.org, www.w3.org

Source & flagged code

2 flagged

package.jsonView file

Lines 29-69json

29 "registry": "https://registry.npmjs.org/"

30 },

31 "overrides": {

32 "form-data": "^4.0.6"

33 },

34 "scripts": {

35 "build": "vite build -c vite.config.client.ts",

36 "build:server": "node scripts/build-server.mjs",

37 "run:server": "node --experimental-strip-types --experimental-transform-types --disable-warning=ExperimentalWarning src/server/index.ts",

38 "start": "node scripts/check-node.mjs && npm run build && npm run run:server",

39 "test": "vitest run",

40 "lint": "eslint src tests",

41 "fix:lint": "eslint src tests --fix",

42 "typecheck": "tsc --noEmit && tsc --noEmit -p src/ui/tsconfig.json",

43 "knip": "knip",

44 "fix:knip": "knip --fix --fix-type exports,types",

45 "fix": "npm run fix:lint && npm run fix:knip || true",

46 "check": "npm run lint && npm run typecheck && npm run test && npm run knip && npm run build && npm run build:server",

47 "prepublishOnly": "npm run build && npm run build:server",

48 "prepare": "git rev-parse --is-inside-work-tree >/dev/null 2>&1 && git config core.hooksPath .githooks || true",

49 "postinstall": "node scripts/ensure-node-pty.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

50 "changeset": "changeset",

51 "release": "changeset publish"

52 },

53 "dependencies": {

54 "@types/ws": "^8.18.1",

55 "@xterm/addon-fit": "^0.11.0",

56 "@xterm/xterm": "^6.0.0",

57 "express": "^5.1.0",

58 "marked": "^18.0.6",

59 "node-pty": "^1.1.0",

60 "preact": "^10.29.7",

61 "ws": "^8.21.1",

62 "yaml": "^2.9.0"

63 },

64 "devDependencies": {

65 "@changesets/cli": "^2.31.1",

66 "@eslint/js": "^10.0.1",

67 "@preact/preset-vite": "^2.10.5",

68 "@types/express": "^5.0.3",

69 "@types/node": "^26.1.1",

dist/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @omniforge/mission-control@0.7.2 matchedIdentity = npm:[redacted]:0.7.2 similarity = 0.885 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server.jsView on unpkg

Source & flagged code

2 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code