registry  /  @profoundlogic/coderflow-server  /  0.12.125

@profoundlogic/coderflow-server@0.12.125

AI Coder Server - Manages Docker containers for AI agent task execution

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 431 file(s), 27.2 MB of source, external domains: 0.0.0.0, accounts.google.com, api.atlassian.com, api.slack.com, coderflow.ai, coderflow.example.com, deb.sury.org, dev.azure.com, docs.docker.com, docs.github.com, docs.litellm.ai, docusaurus.io, dot.net, en.wikipedia.org, engelschall.com, example.com, fb.me, gist.github.com, github.com, host.docker.internal, id.atlassian.com, jquery.org, learn.microsoft.com, lmstudio.ai, lodash.com, login.microsoftonline.com, manpages.ubuntu.com, modelcontextprotocol.io, myaccount.google.com, myibmi.mycompany.com, openjsf.org, openrouter.ai, opensource.org, packages.adoptium.net, peps.python.org, pm2.keymetrics.io, portal.azure.com, production.example.com, profoundlogicsupport.atlassian.net, proxy.example.com, react.dev, resource.openai.azure.com, s3.us-east-2.amazonaws.com, schema.org, slack-hooks.example.com, support.atlassian.com, tldrlegal.com, uicdn.toast.com, underscorejs.org, www.google-analytics.com
Oversized source lightweight scan
dist/routes/tasks.js3.53 MB file, sampled 256 KB
ObfuscatedHighEntropyStringsMinified
dist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.js2.83 MB file, sampled 256 KB
ChildProcessHighEntropyStringsMinifiedUrlStringsen.wikipedia.orgengelschall.comgithub.comjquery.orglodash.comopenjsf.orgopensource.orgtldrlegal.comunderscorejs.orgwww.w3.org

Source & flagged code

7 flagged · loading source
dist/web-ui/public/setup-password.jsView file
1patternName = generic_password severity = medium line = 1 matchedText = import{i...;});
Medium
Secret Pattern

Package contains a possible secret pattern.

dist/web-ui/public/setup-password.jsView on unpkg · L1
dist/web-ui/public/vendor/tui-color-picker/2.2.8/tui-color-picker.min.jsView file
8// @license RGB <-> HSV conversion utilities based off of http://www.cs.rit.edu/~ncs/color/t_convert.html L9: hexToRGB:function(t){return!!o.isValidRGB(t)&&(t=t.substring(1),[parseInt(t.substr(0,2),16),parseInt(t.substr(2,2),16),parseInt(t.substr(4,2),16)])},rgbToHEX:function(t,e,r){var n=...
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/web-ui/public/vendor/tui-color-picker/2.2.8/tui-color-picker.min.jsView on unpkg · L8
dist/middleware/requirePermission.jsView file
1(function(_0x4c043b,_0x510972){const _0x4266c9={_0x51e3e0:0x37e,_0x137eb9:0x352,_0x30d13c:0x326,_0x547317:0x538,_0x32d76b:0x52d,_0x2cf2eb:0x393,_0x3381eb:0x39e,_0x4a21fb:0x3ad,_0x1...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/middleware/requirePermission.jsView on unpkg · L1
dist/middleware/requireInit.jsView file
1function _0x3e1d(_0x3f9799,_0x864520){_0x3f9799=_0x3f9799-(-0x1862*-0x1+-0x946*0x2+-0x1*0x482);const _0x6cb5c4=_0x439e();let _0x5c4d33=_0x6cb5c4[_0x3f9799];if(_0x3e1d['\x70\x49\x7a...
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/middleware/requireInit.jsView on unpkg · L1
dist/base-image/start-code-server.shView file
•path = dist/base-image/start-code-server.sh kind = build_helper sizeBytes = 2714 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/base-image/start-code-server.shView on unpkg
dist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.jsView file
•path = dist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.js kind = oversized_source_file sizeBytes = 2963890 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.jsView on unpkg
dist/routes/tasks.jsView file
•path = dist/routes/tasks.js kind = oversized_cli_entrypoint sizeBytes = 3705030 magicHex = [redacted]
Medium
Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/routes/tasks.jsView on unpkg

Findings

3 High7 Medium7 Low
HighObfuscated Payload Loaderdist/middleware/requireInit.js
HighObfuscated
HighOversized Source Filedist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.js
MediumSecret Patterndist/web-ui/public/setup-password.js
MediumDynamic Requiredist/middleware/requirePermission.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/base-image/start-code-server.sh
MediumOversized Cli Entrypointdist/routes/tasks.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/web-ui/public/vendor/tui-color-picker/2.2.8/tui-color-picker.min.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License