registry  /  @profoundlogic/coderflow-server  /  0.12.126

@profoundlogic/coderflow-server@0.12.126

AI Coder Server - Manages Docker containers for AI agent task execution

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 415 file(s), 26.9 MB of source, external domains: accounts.google.com, api.atlassian.com, api.slack.com, coderflow.ai, coderflow.example.com, dev.azure.com, docs.docker.com, docs.github.com, docs.litellm.ai, docusaurus.io, en.wikipedia.org, engelschall.com, example.com, fb.me, gist.github.com, github.com, host.docker.internal, id.atlassian.com, jquery.org, learn.microsoft.com, lmstudio.ai, lodash.com, login.microsoftonline.com, manpages.ubuntu.com, modelcontextprotocol.io, myaccount.google.com, myibmi.mycompany.com, openjsf.org, openrouter.ai, opensource.org, pm2.keymetrics.io, portal.azure.com, production.example.com, profoundlogicsupport.atlassian.net, proxy.example.com, react.dev, resource.openai.azure.com, s3.us-east-2.amazonaws.com, schema.org, slack-hooks.example.com, support.atlassian.com, tldrlegal.com, uicdn.toast.com, underscorejs.org, www.google-analytics.com, www.unicode.org, www.w3.org, your-company.atlassian.net, your-endpoint.example.com
Oversized source lightweight scan
dist/routes/tasks.js3.63 MB file, sampled 256 KB
ObfuscatedHighEntropyStringsMinified
dist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.js2.83 MB file, sampled 256 KB
ChildProcessHighEntropyStringsMinifiedUrlStringsen.wikipedia.orgengelschall.comgithub.comjquery.orglodash.comopenjsf.orgopensource.orgtldrlegal.comunderscorejs.orgwww.w3.org

Source & flagged code

7 flagged · loading source
dist/web-ui/public/setup-password.jsView file
1patternName = generic_password severity = medium line = 1 matchedText = import{i...;});
Medium
Secret Pattern

Package contains a possible secret pattern.

dist/web-ui/public/setup-password.jsView on unpkg · L1
dist/web-ui/public/vendor/tui-color-picker/2.2.8/tui-color-picker.min.jsView file
8// @license RGB <-> HSV conversion utilities based off of http://www.cs.rit.edu/~ncs/color/t_convert.html L9: hexToRGB:function(t){return!!o.isValidRGB(t)&&(t=t.substring(1),[parseInt(t.substr(0,2),16),parseInt(t.substr(2,2),16),parseInt(t.substr(4,2),16)])},rgbToHEX:function(t,e,r){var n=...
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/web-ui/public/vendor/tui-color-picker/2.2.8/tui-color-picker.min.jsView on unpkg · L8
dist/middleware/requirePermission.jsView file
1(function(_0x2d1cef,_0x2c2d1b){const _0x13a4c8={_0x3b12e9:0x242,_0x22cdc4:0x266,_0xcb33cb:0x243,_0x5320e1:0xdb,_0x4f96cb:0x60,_0x5f4ef1:0xd7,_0x48a97e:0x281,_0x36f334:0x27c,_0x2e19...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/middleware/requirePermission.jsView on unpkg · L1
dist/middleware/requireInit.jsView file
1(function(_0x39904d,_0x1a2253){const _0x4f1c0b={_0x54b339:'\x30\x78\x32\x38\x65',_0x2b9965:'\x30\x78\x31\x35\x65',_0x562977:'\x58\x25\x66\x52',_0x175f97:'\x30\x78\x31\x33\x61',_0x4...
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/middleware/requireInit.jsView on unpkg · L1
dist/base-image/start-code-server.shView file
•path = dist/base-image/start-code-server.sh kind = build_helper sizeBytes = 2714 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/base-image/start-code-server.shView on unpkg
dist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.jsView file
•path = dist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.js kind = oversized_source_file sizeBytes = 2963890 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.jsView on unpkg
dist/routes/tasks.jsView file
•path = dist/routes/tasks.js kind = oversized_cli_entrypoint sizeBytes = 3807818 magicHex = [redacted]
Medium
Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/routes/tasks.jsView on unpkg

Findings

3 High7 Medium7 Low
HighObfuscated Payload Loaderdist/middleware/requireInit.js
HighObfuscated
HighOversized Source Filedist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.js
MediumSecret Patterndist/web-ui/public/setup-password.js
MediumDynamic Requiredist/middleware/requirePermission.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/base-image/start-code-server.sh
MediumOversized Cli Entrypointdist/routes/tasks.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/web-ui/public/vendor/tui-color-picker/2.2.8/tui-color-picker.min.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License