registry / @overdeck/desktop / 0.45.13

@overdeck/desktop@0.45.13

⚠ Under review

Overdeck Command Deck — AI agent monitoring desktop app

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 26 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 816 file(s), 25.2 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.cloudflare.com, api.github.com, api.hume.ai, api.kimi.com, api.linear.app, api.machines.dev, api.minimax.io, api.moonshot.ai, api.openai.com, api.vercel.com, api.voyageai.com, api.x.ai, api.z.ai, app.excalidraw.com, bun.sh, chevrotain.io, claude.ai, dashscope-intl.aliyuncs.com, developer.mozilla.org, discord.gg, docker.com, docs.anthropic.com, docs.docker.com, docs.excalidraw.com, docs.expo.dev, docs.github.com, embed.reddit.com, en.wikipedia.org, encoding.spec.whatwg.org, esm.sh, example.com, excalidraw-room-persistence.firebaseio.com, fetch.spec.whatwg.org, giphy.com, gist.github.com, github.com, inference-api.nousresearch.com, infra.spec.whatwg.org, jimmy.warting.se, json.excalidraw.com, jsonplaceholder.typicode.com, langium.org, libraries.excalidraw.com, mermaid.js.org, mimesniff.spec.whatwg.org, nodejs.org, ollama.com, openrouter.ai

Oversized source lightweight scan

server/public/assets/index-BDqWyuZQ.js3.62 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsMinifiedUrlStringsProtestwaregithub.comwww.w3.org

server/server.js2.16 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStringsUrlStringsapi.github.comapi.openai.comgithub.comopenrouter.ai

server/src-D-VXCC9C.js5.71 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringsgithub.com

Source & flagged code

14 flagged

package.jsonView file

Lines 21-61json

21 "resources",

22 "drizzle",

23 "sync-sources"

24 ],

25 "engines": {

26 "node": ">=22.0.0"

27 },

28 "scripts": {

29 "dev": "bun run --parallel dev:bundle dev:electron",

30 "dev:bundle": "tsdown --watch",

31 "dev:electron": "bun run scripts/dev-electron.mjs",

32 "build": "tsdown",

33 "build:publish": "node scripts/build-for-publish.mjs",

34 "prepublishOnly": "node scripts/build-for-publish.mjs",

35 "start": "bun run scripts/start-electron.mjs",

36 "typecheck": "tsc --noEmit",

37 "test": "vitest run --configLoader runner --passWithNoTests",

38 "dist:linux": "node scripts/prepare-server-resources.mjs && electron-builder --linux AppImage --publish never",

39 "dist:mac": "node scripts/prepare-server-resources.mjs && electron-builder --mac dmg --arm64 --publish never",

40 "dist:win": "node scripts/prepare-server-resources.mjs && electron-builder --win nsis --publish never",

41 "postinstall": "electron-rebuild -f -w node-pty 2>/dev/null; exit 0"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 },

43 "dependencies": {

44 "conf": "^13.0.0",

45 "electron-updater": "^6.8.3",

46 "electron": "40.6.0"

47 },

48 "devDependencies": {

49 "@electron/notarize": "^2.5.0",

50 "@overdeck/contracts": "workspace:*",

51 "@types/node": "^22.0.0",

52 "electron-builder": "^25.1.8",

53 "tsdown": "^0.21.7",

54 "typescript": "^5.7.3",

55 "vitest": "^4.0.18",

56 "@electron/rebuild": "^4.2.0"

57 },

58 "build": {

59 "appId": "com.overdeck.app",

60 "productName": "Overdeck",

61 "publish": {

server/public/assets/chunk-EIO257PC-DnXo63uH.jsView file

22patternName = aws_access_key severity = critical line = 22 matchedText = `,m.push... t};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

server/public/assets/chunk-EIO257PC-DnXo63uH.jsView on unpkg · L22

22patternName = aws_access_key severity = critical line = 22 matchedText = `,m.push... t};

Critical

Secret Pattern

AWS access key ID in server/public/assets/chunk-EIO257PC-DnXo63uH.js

server/public/assets/chunk-EIO257PC-DnXo63uH.jsView on unpkg · L22

dist-electron/preload.jsView file

Lines 1-21javascript

1let electron = require("electron");

2//#region src/preload.ts

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-electron/preload.jsView on unpkg · L1

3/**

4* Preload script for the Overdeck Electron renderer.

6* Exposes `window.overdeckBridge` via contextBridge.exposeInMainWorld.

7* The renderer uses this bridge to communicate with the main process over IPC.

server/agents-DqQa4Dq_.jsView file

Lines 28-68javascript

28import { a as init_stack_health, i as getWorkspaceStackHealth } from "./stack-health-C-le5erA.js";

29import { a as createActiveSlice, c as groupItemsByWave, s as getDispatchableItems, u as init_dag } from "./dag-BQFtXOuJ.js";

30import { n as init_bd_process_lock, t as BdTransientFailure } from "./bd-process-lock-D1aJxeYv.js";

bin/overdeck.mjsView file

Lines 38-78javascript

38}

40/** Verify the dashboard server bundle exists inside the package. */

41function checkServerBundle() {

42 const serverPath = join(packageDir, "server", "server.js");

43 if (!existsSync(serverPath)) {

44 console.error

server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/third_party/conpty/1.22.250204002/win10-arm64/conpty.dllView file

•path = server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/third_party/conpty/1.22.250204002/win10-arm64/conpty.dll kind = native_binary sizeBytes = 102944 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/third_party/conpty/1.22.250204002/win10-arm64/conpty.dllView on unpkg

server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/binding.gypView file

•path = server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/binding.gyp kind = build_helper sizeBytes = 3061 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/binding.gypView on unpkg

resources/icon.icoView file

•path = resources/icon.ico kind = high_entropy_blob sizeBytes = 29519 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

resources/icon.icoView on unpkg

server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/deps/winpty/src/tests/subdir.mkView file

•path = server/supervisor/vendor/@homebridge/node-pty-prebuilt-[redacted].mk kind = payload_in_excluded_dir sizeBytes = 1304 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/deps/winpty/src/tests/subdir.mkView on unpkg

server/server.jsView file

•path = server/server.js kind = oversized_source_file sizeBytes = 2266373 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

server/server.jsView on unpkg

server/public/assets/chunk-ZUYEQ4TG-B82Qm37l.jsView file

Lines 1-7javascript

1var e={VITE_APP_BACKEND_V2_GET_URL:`https://json.excalidraw.com/api/v2/`,VITE_APP_BACKEND_V2_POST_URL:`https://json.excalidraw.com/api/v2/post/`,VITE_APP_LIBRARY_URL:`https://libraries.excalidraw.com`,VITE_APP_LIBRARY_BACKEND:`https://us-central1-excalidraw-room-persistence.cloudfunctions.net/libraries`,VITE_APP_PLUS_LP:`https://plus.excalidraw.com`,VITE_APP_PLUS_APP:`https://app.excalidraw.com`,VITE_APP_AI_BACKEND:`https://oss-ai.excalidraw.com`,VITE_APP_WS_SERVER_URL:`https://oss-collab.excalidraw.com`,VITE_APP_FIREBASE_CONFIG:`{"apiKey":"AIzaSyAd15pYlMci_xIp9ko6wkEsDzAAA0Dn0RU","authDomain" ...

High

Secret Pattern

Google API key in server/public/assets/chunk-ZUYEQ4TG-B82Qm37l.js

server/public/assets/chunk-ZUYEQ4TG-B82Qm37l.jsView on unpkg · L1

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = electron-rebuild -f -w node-pty 2>/dev/null; exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = electron-rebuild -f -w node-pty 2>/dev/null; exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

server/public/assets/chunk-EIO257PC-DnXo63uH.jsView file

22patternName = aws_access_key severity = critical line = 22 matchedText = `,m.push... t};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

server/public/assets/chunk-EIO257PC-DnXo63uH.jsView on unpkg · L22

22patternName = aws_access_key severity = critical line = 22 matchedText = `,m.push... t};

Critical

Secret Pattern

AWS access key ID in server/public/assets/chunk-EIO257PC-DnXo63uH.js

server/public/assets/chunk-EIO257PC-DnXo63uH.jsView on unpkg · L22

dist-electron/preload.jsView file

1let electron = require("electron"); L2: //#region src/preload.ts

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-electron/preload.jsView on unpkg · L1

server/agents-DqQa4Dq_.jsView file

48import { platform as platform$2 } from "process"; L49: import { exec, execFile } from "node:child_process"; L50: import { promisify } from "node:util"; ... L56: import { layer } from "@effect/platform-node/NodeServices"; L57: import { request } from "node:http"; L58: //#region ../../lib/cost-parsers/ohmypi-parser.ts ... L154: try { L155: parsed = JSON.parse(line); L156: } catch { ... L397: init_internal_token(); L398: DASHBOARD_URL = process.env["OVERDECK_DASHBOARD_URL"] || "http://127.0.0.1:3011"; L399: DEFAULT_TIMEOUT_MS = 1500;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

server/agents-DqQa4Dq_.jsView on unpkg · L48

•matchType = previous_version_dangerous_delta matchedPackage = @overdeck/desktop@0.45.12 matchedIdentity = npm:QG92ZXJkZWNrL2Rlc2t0b3A:0.45.12 similarity = 0.650 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/agents-DqQa4Dq_.jsView on unpkg

bin/overdeck.mjsView file

58package = @overdeck/desktop; repositoryIdentity = overdeck; dependency = electron L58: // The `electron` package exports its binary path as its module value. L59: return require("electron"); L60: } catch {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

bin/overdeck.mjsView on unpkg · L58

server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/third_party/conpty/1.22.250204002/win10-arm64/conpty.dllView file

•path = server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/third_party/conpty/1.22.250204002/win10-arm64/conpty.dll kind = native_binary sizeBytes = 102944 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/third_party/conpty/1.22.250204002/win10-arm64/conpty.dllView on unpkg

server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/binding.gypView file

•path = server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/binding.gyp kind = build_helper sizeBytes = 3061 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/binding.gypView on unpkg

resources/icon.icoView file

•path = resources/icon.ico kind = high_entropy_blob sizeBytes = 29519 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

resources/icon.icoView on unpkg

server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/deps/winpty/src/tests/subdir.mkView file

•path = server/supervisor/vendor/@homebridge/node-pty-prebuilt-[redacted].mk kind = payload_in_excluded_dir sizeBytes = 1304 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/deps/winpty/src/tests/subdir.mkView on unpkg

server/server.jsView file

•path = server/server.js kind = oversized_source_file sizeBytes = 2266373 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

server/server.jsView on unpkg

server/public/assets/chunk-ZUYEQ4TG-B82Qm37l.jsView file

1patternName = google_api_key severity = high line = 1 matchedText = var e={V...AZZX

High

Secret Pattern

Google API key in server/public/assets/chunk-ZUYEQ4TG-B82Qm37l.js

server/public/assets/chunk-ZUYEQ4TG-B82Qm37l.jsView on unpkg · L1

Findings

4 Critical6 High8 Medium8 Low

CriticalCritical Secretserver/public/assets/chunk-EIO257PC-DnXo63uH.js

CriticalCredential Exfiltrationserver/agents-DqQa4Dq_.js

CriticalPrevious Version Dangerous Deltaserver/agents-DqQa4Dq_.js

CriticalSecret Patternserver/public/assets/chunk-EIO257PC-DnXo63uH.js

HighInstall Time Lifecycle Scriptspackage.json

HighCopied Package Dependency Bridgebin/overdeck.mjs

HighShips High Entropy Blobresources/icon.ico

HighPayload In Excluded Dirserver/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/deps/winpty/src/tests/subdir.mk

HighOversized Source Fileserver/server.js

HighSecret Patternserver/public/assets/chunk-ZUYEQ4TG-B82Qm37l.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist-electron/preload.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Native Binaryserver/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/third_party/conpty/1.22.250204002/win10-arm64/conpty.dll

MediumShips Build Helperserver/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/binding.gyp

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

14 flagged

package.jsonView file

Lines 21-61json

21 "resources",

22 "drizzle",

23 "sync-sources"

24 ],

25 "engines": {

26 "node": ">=22.0.0"

27 },

28 "scripts": {

29 "dev": "bun run --parallel dev:bundle dev:electron",

30 "dev:bundle": "tsdown --watch",

31 "dev:electron": "bun run scripts/dev-electron.mjs",

32 "build": "tsdown",

33 "build:publish": "node scripts/build-for-publish.mjs",

34 "prepublishOnly": "node scripts/build-for-publish.mjs",

35 "start": "bun run scripts/start-electron.mjs",

36 "typecheck": "tsc --noEmit",

37 "test": "vitest run --configLoader runner --passWithNoTests",

38 "dist:linux": "node scripts/prepare-server-resources.mjs && electron-builder --linux AppImage --publish never",

39 "dist:mac": "node scripts/prepare-server-resources.mjs && electron-builder --mac dmg --arm64 --publish never",

40 "dist:win": "node scripts/prepare-server-resources.mjs && electron-builder --win nsis --publish never",

41 "postinstall": "electron-rebuild -f -w node-pty 2>/dev/null; exit 0"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 },

43 "dependencies": {

44 "conf": "^13.0.0",

45 "electron-updater": "^6.8.3",

46 "electron": "40.6.0"

47 },

48 "devDependencies": {

49 "@electron/notarize": "^2.5.0",

50 "@overdeck/contracts": "workspace:*",

51 "@types/node": "^22.0.0",

52 "electron-builder": "^25.1.8",

53 "tsdown": "^0.21.7",

54 "typescript": "^5.7.3",

55 "vitest": "^4.0.18",

56 "@electron/rebuild": "^4.2.0"

57 },

58 "build": {

59 "appId": "com.overdeck.app",

60 "productName": "Overdeck",

61 "publish": {

server/public/assets/chunk-EIO257PC-DnXo63uH.jsView file

22patternName = aws_access_key severity = critical line = 22 matchedText = `,m.push... t};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

server/public/assets/chunk-EIO257PC-DnXo63uH.jsView on unpkg · L22

22patternName = aws_access_key severity = critical line = 22 matchedText = `,m.push... t};

Critical

Secret Pattern

AWS access key ID in server/public/assets/chunk-EIO257PC-DnXo63uH.js

server/public/assets/chunk-EIO257PC-DnXo63uH.jsView on unpkg · L22

dist-electron/preload.jsView file

Lines 1-21javascript

1let electron = require("electron");

2//#region src/preload.ts

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-electron/preload.jsView on unpkg · L1

3/**

4* Preload script for the Overdeck Electron renderer.

6* Exposes `window.overdeckBridge` via contextBridge.exposeInMainWorld.

7* The renderer uses this bridge to communicate with the main process over IPC.

server/agents-DqQa4Dq_.jsView file

Lines 28-68javascript

28import { a as init_stack_health, i as getWorkspaceStackHealth } from "./stack-health-C-le5erA.js";

29import { a as createActiveSlice, c as groupItemsByWave, s as getDispatchableItems, u as init_dag } from "./dag-BQFtXOuJ.js";

30import { n as init_bd_process_lock, t as BdTransientFailure } from "./bd-process-lock-D1aJxeYv.js";

bin/overdeck.mjsView file

Lines 38-78javascript

38}

40/** Verify the dashboard server bundle exists inside the package. */

41function checkServerBundle() {

42 const serverPath = join(packageDir, "server", "server.js");

43 if (!existsSync(serverPath)) {

44 console.error

server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/third_party/conpty/1.22.250204002/win10-arm64/conpty.dllView file

•path = server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/third_party/conpty/1.22.250204002/win10-arm64/conpty.dll kind = native_binary sizeBytes = 102944 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/third_party/conpty/1.22.250204002/win10-arm64/conpty.dllView on unpkg

server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/binding.gypView file

•path = server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/binding.gyp kind = build_helper sizeBytes = 3061 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/binding.gypView on unpkg

resources/icon.icoView file

•path = resources/icon.ico kind = high_entropy_blob sizeBytes = 29519 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

resources/icon.icoView on unpkg

server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/deps/winpty/src/tests/subdir.mkView file

•path = server/supervisor/vendor/@homebridge/node-pty-prebuilt-[redacted].mk kind = payload_in_excluded_dir sizeBytes = 1304 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

server/supervisor/vendor/@homebridge/node-pty-prebuilt-multiarch/deps/winpty/src/tests/subdir.mkView on unpkg

server/server.jsView file

•path = server/server.js kind = oversized_source_file sizeBytes = 2266373 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

server/server.jsView on unpkg

server/public/assets/chunk-ZUYEQ4TG-B82Qm37l.jsView file

Lines 1-7javascript

High

Secret Pattern

Google API key in server/public/assets/chunk-ZUYEQ4TG-B82Qm37l.js

server/public/assets/chunk-ZUYEQ4TG-B82Qm37l.jsView on unpkg · L1