registry / @orangeworks/orangetree / 0.30.1

@orangeworks/orangetree@0.30.1

Branching session-tree work-tracking tool (local-first, TypeScript)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 81 file(s), 2.05 MB of source, external domains: 127.0.0.1, api.openai.com, api.orangetree.dev, github.com, json-schema.org, orangetree.dev, registry.npmjs.org, www.w3.org

Oversized source lightweight scan

dist/public/mermaid.js3.29 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsTelemetryUrlStringsgithub.comwww.w3.org

Source & flagged code

5 flagged

dist/bin/orangetree.jsView file

Lines 44-107javascript

44 const o = raw;

45 const p = o.pairing ?? {};

46 return {

47 version: typeof o.version === "number" ? o.version : CONFIG_VERSION,

48 workRoot: asTrimmedString(o.workRoot),

49 remoteEnabled: asBool(o.remoteEnabled, d.remoteEnabled),

50 cloudApiBase: asHttpUrl(o.cloudApiBase),

51 remoteAuth: o.remoteAuth === "token" ? "token" : "cloud",

52 port: asPort(o.port),

53 bindHost: asTrimmedString(o.bindHost),

54 openBrowser: asBool(o.openBrowser, d.openBrowser),

55 pairing: {

56 onboardingToken: asTrimmedString(p.onboardingToken),

57 consumedAt: typeof p.consumedAt === "number" ? p.consumedAt : null

58 }

59 };

60}

61function loadConfig(appDataRoot) {

62 const path = configPath(appDataRoot);

63 if (!existsSync(path)) return defaults();

64 try {

65 return normalize(JSON.parse(readFileSync(path, "utf8")));

66 } catch {

67 return defaults();

68 }

69}

70function applyConfigToEnv(appDataRoot) {

71 const cfg = loadConfig(appDataRoot);

72 const fill = (key, value) => {

73 if (value != null && process.env[key] === void 0) process.env[key] = value;

74 };

75 fill("OTREE_CLOUD_API", cfg.cloudApiBase);

76 if (cfg.workRoot && existsSync(cfg.workRoot)) fill("OTREE_ROOT", cfg.workRoot);

77 if (cfg.remoteEnabled) {

78 fill("OTREE_REMOTE_ENABLED", "1");

79 fill("OTREE_REMOTE_AUTH", cfg.remoteAuth);

80 }

81 fill("OTREE_PORT", cfg.port != null ? String(cfg.port) : null);

82 fill("OTREE_BIND", cfg.bindHost);

83 if (cfg.openBrowser === false) fill("OTREE_OPEN", "0");

84 return cfg;

85}

87// lib/daemon.ts

88import { spawn, spawnSync } from "node:child_process";

89import { closeSync, existsSync as existsSync2, mkdirSync, openSync, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/bin/orangetree.jsView on unpkg · L87

90import { request } from "node:http";

91import { homedir } from "node:os";

92import { dirname, join as join2 } from "node:path";

93var PKG = "@orangeworks/orangetree";

94var HEALTH_PATH = "/api/daemon/status";

95var SHUTDOWN_PATH = "/api/shutdown";

96var LOCAL_HEADER = { "X-Otree-Local": "1" };

97var STARTING_GRACE_MS = 15e3;

98var LOCK_STALE_MS = 3e4;

99function dataRoot() {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/orangetree.jsView on unpkg · L64

100 return process.env.OTREE_DATA ?? join2(homedir(), ".orangetree");

101}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/orangetree.jsView on unpkg · L87

102function paths(root = dataRoot()) {

103 return { json: join2(root, "daemon.json"), lock: join2(root, "daemon.lock"), log: join2(root, "daemon.log") };

104}

105function readState(root = dataRoot()) {

106 const p = paths(root).json;

107 if (!existsSync2(p)) return null;

Lines 292-332javascript

292 spawn(cmd2, args, { stdio: "ignore", detached: true, windowsHide: true }).unref();

293 } catch {

294 }

295}

296function ensureShortcut(root) {

297 if (process.env.OTREE_NO_SHORTCUT === "1") return;

298

dist/public/mermaid.jsView file

•path = dist/public/mermaid.js kind = oversized_source_file sizeBytes = 3449175 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/public/mermaid.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/bin/orangetree.jsView file

High

Child Process

Package source references child process execution.

dist/bin/orangetree.jsView on unpkg · L87

312const ps = `$s=(New-Object -ComObject WScript.Shell).CreateShortcut(${psStr(lnk)});$s.TargetPath=${psStr(wscript)};$s.Arguments=${psStr(`//B //Nologo "${vbs}"`)};$s.Description='Or... L313: spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", ps], { stdio: "ignore", windowsHide: true }); L314: }

High

Shell

Package source references shell execution.

dist/bin/orangetree.jsView on unpkg · L312

87// lib/daemon.ts L88: import { spawn, spawnSync } from "node:child_process"; L89: import { closeSync, existsSync as existsSync2, mkdirSync, openSync, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync } from "node:fs"; L90: import { request } from "node:http"; L91: import { homedir } from "node:os"; ... L99: function dataRoot() { L100: return process.env.OTREE_DATA ?? join2(homedir(), ".orangetree"); L101: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/orangetree.jsView on unpkg · L87

64Cross-file remote execution chain: dist/bin/orangetree.js spawns dist/server.js; helper contains network access plus dynamic code execution. L64: try { L65: return normalize(JSON.parse(readFileSync(path, "utf8"))); L66: } catch { ... L72: const fill = (key, value) => { L73: if (value != null && process.env[key] === void 0) process.env[key] = value; L74: }; ... L87: // lib/daemon.ts L88: import { spawn, spawnSync } from "node:child_process"; L89: import { closeSync, existsSync as existsSync2, mkdirSync, openSync, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync } from "node:fs"; L90: import { request } from "node:http"; L91: import { homedir } from "node:os"; ... L99: function dataRoot() {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/orangetree.jsView on unpkg · L64

dist/public/mermaid.jsView file

•path = dist/public/mermaid.js kind = oversized_source_file sizeBytes = 3449175 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/public/mermaid.jsView on unpkg

Findings

5 High3 Medium6 Low

HighChild Processdist/bin/orangetree.js

HighShelldist/bin/orangetree.js

HighSame File Env Network Executiondist/bin/orangetree.js

HighCross File Remote Execution Contextdist/bin/orangetree.js

HighOversized Source Filedist/public/mermaid.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/bin/orangetree.jsView file

Lines 44-107javascript

44 const o = raw;

45 const p = o.pairing ?? {};

46 return {

47 version: typeof o.version === "number" ? o.version : CONFIG_VERSION,

48 workRoot: asTrimmedString(o.workRoot),

49 remoteEnabled: asBool(o.remoteEnabled, d.remoteEnabled),

50 cloudApiBase: asHttpUrl(o.cloudApiBase),

51 remoteAuth: o.remoteAuth === "token" ? "token" : "cloud",

52 port: asPort(o.port),

53 bindHost: asTrimmedString(o.bindHost),

54 openBrowser: asBool(o.openBrowser, d.openBrowser),

55 pairing: {

56 onboardingToken: asTrimmedString(p.onboardingToken),

57 consumedAt: typeof p.consumedAt === "number" ? p.consumedAt : null

58 }

59 };

60}

61function loadConfig(appDataRoot) {

62 const path = configPath(appDataRoot);

63 if (!existsSync(path)) return defaults();

64 try {

65 return normalize(JSON.parse(readFileSync(path, "utf8")));

66 } catch {

67 return defaults();

68 }

69}

70function applyConfigToEnv(appDataRoot) {

71 const cfg = loadConfig(appDataRoot);

72 const fill = (key, value) => {

73 if (value != null && process.env[key] === void 0) process.env[key] = value;

74 };

75 fill("OTREE_CLOUD_API", cfg.cloudApiBase);

76 if (cfg.workRoot && existsSync(cfg.workRoot)) fill("OTREE_ROOT", cfg.workRoot);

77 if (cfg.remoteEnabled) {

78 fill("OTREE_REMOTE_ENABLED", "1");

79 fill("OTREE_REMOTE_AUTH", cfg.remoteAuth);

80 }

81 fill("OTREE_PORT", cfg.port != null ? String(cfg.port) : null);

82 fill("OTREE_BIND", cfg.bindHost);

83 if (cfg.openBrowser === false) fill("OTREE_OPEN", "0");

84 return cfg;

85}

87// lib/daemon.ts

88import { spawn, spawnSync } from "node:child_process";

89import { closeSync, existsSync as existsSync2, mkdirSync, openSync, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/bin/orangetree.jsView on unpkg · L87

90import { request } from "node:http";

91import { homedir } from "node:os";

92import { dirname, join as join2 } from "node:path";

93var PKG = "@orangeworks/orangetree";

94var HEALTH_PATH = "/api/daemon/status";

95var SHUTDOWN_PATH = "/api/shutdown";

96var LOCAL_HEADER = { "X-Otree-Local": "1" };

97var STARTING_GRACE_MS = 15e3;

98var LOCK_STALE_MS = 3e4;

99function dataRoot() {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/orangetree.jsView on unpkg · L64

100 return process.env.OTREE_DATA ?? join2(homedir(), ".orangetree");

101}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/orangetree.jsView on unpkg · L87

102function paths(root = dataRoot()) {

103 return { json: join2(root, "daemon.json"), lock: join2(root, "daemon.lock"), log: join2(root, "daemon.log") };

104}

105function readState(root = dataRoot()) {

106 const p = paths(root).json;

107 if (!existsSync2(p)) return null;

Lines 292-332javascript

292 spawn(cmd2, args, { stdio: "ignore", detached: true, windowsHide: true }).unref();

293 } catch {

294 }

295}

296function ensureShortcut(root) {

297 if (process.env.OTREE_NO_SHORTCUT === "1") return;

298

dist/public/mermaid.jsView file

•path = dist/public/mermaid.js kind = oversized_source_file sizeBytes = 3449175 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/public/mermaid.jsView on unpkg