registry  /  @profoundlogic/coderflow-server  /  0.12.135

@profoundlogic/coderflow-server@0.12.135

AI Coder Server - Manages Docker containers for AI agent task execution

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 447 file(s), 28.1 MB of source, external domains: 0.0.0.0, accounts.google.com, api.atlassian.com, api.slack.com, coder.example.com, coderflow.ai, coderflow.example.com, deb.sury.org, dev.azure.com, docs.docker.com, docs.github.com, docs.litellm.ai, docusaurus.io, dot.net, en.wikipedia.org, engelschall.com, example.com, fb.me, gist.github.com, github.com, host.docker.internal, id.atlassian.com, jquery.org, learn.microsoft.com, lmstudio.ai, lodash.com, login.microsoftonline.com, manpages.ubuntu.com, modelcontextprotocol.io, myaccount.google.com, myibmi.mycompany.com, openjsf.org, openrouter.ai, opensource.org, packages.adoptium.net, peps.python.org, pm2.keymetrics.io, portal.azure.com, production.example.com, profoundlogicsupport.atlassian.net, proxy.example.com, react.dev, resource.openai.azure.com, s3.us-east-2.amazonaws.com, schema.org, slack-hooks.example.com, support.atlassian.com, tldrlegal.com, uicdn.toast.com, underscorejs.org
Oversized source lightweight scan
dist/routes/tasks.js3.60 MB file, sampled 256 KB
ObfuscatedHighEntropyStringsMinified
dist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.js2.83 MB file, sampled 256 KB
ChildProcessHighEntropyStringsMinifiedUrlStringsen.wikipedia.orgengelschall.comgithub.comjquery.orglodash.comopenjsf.orgopensource.orgtldrlegal.comunderscorejs.orgwww.w3.org

Source & flagged code

7 flagged · loading source
dist/web-ui/public/setup-password.jsView file
1patternName = generic_password severity = medium line = 1 matchedText = import{i...;});
Medium
Secret Pattern

Package contains a possible secret pattern.

dist/web-ui/public/setup-password.jsView on unpkg · L1
dist/web-ui/public/vendor/tui-color-picker/2.2.8/tui-color-picker.min.jsView file
8// @license RGB <-> HSV conversion utilities based off of http://www.cs.rit.edu/~ncs/color/t_convert.html L9: hexToRGB:function(t){return!!o.isValidRGB(t)&&(t=t.substring(1),[parseInt(t.substr(0,2),16),parseInt(t.substr(2,2),16),parseInt(t.substr(4,2),16)])},rgbToHEX:function(t,e,r){var n=...
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/web-ui/public/vendor/tui-color-picker/2.2.8/tui-color-picker.min.jsView on unpkg · L8
dist/middleware/requirePermission.jsView file
1(function(_0x9e1afc,_0x5f5181){const _0xe3c042={_0x490ae9:0x1ce,_0x2006d7:0x1de,_0x265bfb:0x214,_0x5490d7:0xec,_0x1069e5:0x113,_0x35db9b:0x14a,_0x3f65d6:0x9f,_0x10a380:0xcc,_0x53e7...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/middleware/requirePermission.jsView on unpkg · L1
dist/middleware/requireInit.jsView file
1function _0x4f33(_0x879eeb,_0x56a00c){_0x879eeb=_0x879eeb-(0xcf2*-0x2+-0x2404+-0x3*-0x14c6);const _0x37f3f4=_0x2e80();let _0x5ec6df=_0x37f3f4[_0x879eeb];if(_0x4f33['\x4a\x75\x5a\x4...
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/middleware/requireInit.jsView on unpkg · L1
dist/base-image/start-code-server.shView file
•path = dist/base-image/start-code-server.sh kind = build_helper sizeBytes = 2714 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/base-image/start-code-server.shView on unpkg
dist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.jsView file
•path = dist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.js kind = oversized_source_file sizeBytes = 2963890 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.jsView on unpkg
dist/routes/tasks.jsView file
•path = dist/routes/tasks.js kind = oversized_cli_entrypoint sizeBytes = 3772201 magicHex = [redacted]
Medium
Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/routes/tasks.jsView on unpkg

Findings

3 High7 Medium7 Low
HighObfuscated Payload Loaderdist/middleware/requireInit.js
HighObfuscated
HighOversized Source Filedist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.js
MediumSecret Patterndist/web-ui/public/setup-password.js
MediumDynamic Requiredist/middleware/requirePermission.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/base-image/start-code-server.sh
MediumOversized Cli Entrypointdist/routes/tasks.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/web-ui/public/vendor/tui-color-picker/2.2.8/tui-color-picker.min.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License