registry  /  @profoundlogic/coderflow-server  /  0.12.127

@profoundlogic/coderflow-server@0.12.127

AI Coder Server - Manages Docker containers for AI agent task execution

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
Manifest
NoLicense
scanned 417 file(s), 27.1 MB of source, external domains: accounts.google.com, api.atlassian.com, api.slack.com, coderflow.ai, coderflow.example.com, dev.azure.com, docs.docker.com, docs.github.com, docs.litellm.ai, docusaurus.io, en.wikipedia.org, engelschall.com, example.com, fb.me, gist.github.com, github.com, host.docker.internal, id.atlassian.com, jquery.org, learn.microsoft.com, lmstudio.ai, lodash.com, login.microsoftonline.com, manpages.ubuntu.com, modelcontextprotocol.io, myaccount.google.com, myibmi.mycompany.com, openjsf.org, openrouter.ai, opensource.org, pm2.keymetrics.io, portal.azure.com, production.example.com, profoundlogicsupport.atlassian.net, proxy.example.com, react.dev, resource.openai.azure.com, s3.us-east-2.amazonaws.com, schema.org, slack-hooks.example.com, support.atlassian.com, tldrlegal.com, uicdn.toast.com, underscorejs.org, www.google-analytics.com, www.unicode.org, www.w3.org, your-company.atlassian.net, your-endpoint.example.com
Oversized source lightweight scan
dist/routes/tasks.js3.66 MB file, sampled 256 KB
ObfuscatedHighEntropyStringsMinified
dist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.js2.83 MB file, sampled 256 KB
ChildProcessHighEntropyStringsMinifiedUrlStringsen.wikipedia.orgengelschall.comgithub.comjquery.orglodash.comopenjsf.orgopensource.orgtldrlegal.comunderscorejs.orgwww.w3.org

Source & flagged code

7 flagged · loading source
dist/web-ui/public/setup-password.jsView file
1patternName = generic_password severity = medium line = 1 matchedText = import{i...;});
Medium
Secret Pattern

Package contains a possible secret pattern.

dist/web-ui/public/setup-password.jsView on unpkg · L1
dist/web-ui/public/vendor/tui-color-picker/2.2.8/tui-color-picker.min.jsView file
8// @license RGB <-> HSV conversion utilities based off of http://www.cs.rit.edu/~ncs/color/t_convert.html L9: hexToRGB:function(t){return!!o.isValidRGB(t)&&(t=t.substring(1),[parseInt(t.substr(0,2),16),parseInt(t.substr(2,2),16),parseInt(t.substr(4,2),16)])},rgbToHEX:function(t,e,r){var n=...
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/web-ui/public/vendor/tui-color-picker/2.2.8/tui-color-picker.min.jsView on unpkg · L8
dist/middleware/requirePermission.jsView file
1(function(_0x2349cb,_0x41aafa){const _0x2b2fde={_0x3e561f:0x268,_0x5b99ad:0x2b4,_0x47ff7f:0x30f,_0x138893:0x317,_0x5bb10:0x23f,_0x463b5f:0x249,_0x393993:0x29d,_0x1add09:0x278,_0x58...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/middleware/requirePermission.jsView on unpkg · L1
dist/middleware/requireInit.jsView file
1(function(_0x558cdb,_0x341a74){const _0x2cb34d={_0x50a6b9:0x300,_0x254c93:'\x30\x78\x32\x65\x30',_0x4e75ba:0x25d,_0x3027e1:0x1d3,_0x386ae1:'\x6b\x33\x4b\x30',_0x1490bb:'\x43\x23\x7...
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/middleware/requireInit.jsView on unpkg · L1
dist/base-image/start-code-server.shView file
•path = dist/base-image/start-code-server.sh kind = build_helper sizeBytes = 2714 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/base-image/start-code-server.shView on unpkg
dist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.jsView file
•path = dist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.js kind = oversized_source_file sizeBytes = 2963890 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.jsView on unpkg
dist/routes/tasks.jsView file
•path = dist/routes/tasks.js kind = oversized_cli_entrypoint sizeBytes = 3836463 magicHex = [redacted]
Medium
Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/routes/tasks.jsView on unpkg

Findings

3 High8 Medium7 Low
HighObfuscated Payload Loaderdist/middleware/requireInit.js
HighObfuscated
HighOversized Source Filedist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.js
MediumSecret Patterndist/web-ui/public/setup-password.js
MediumDynamic Requiredist/middleware/requirePermission.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Build Helperdist/base-image/start-code-server.sh
MediumOversized Cli Entrypointdist/routes/tasks.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/web-ui/public/vendor/tui-color-picker/2.2.8/tui-color-picker.min.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License