registry  /  @profoundlogic/coderflow-server  /  0.12.137

@profoundlogic/coderflow-server@0.12.137

AI Coder Server - Manages Docker containers for AI agent task execution

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 451 file(s), 28.2 MB of source, external domains: 0.0.0.0, accounts.google.com, api.atlassian.com, api.slack.com, coder.example.com, coderflow.ai, coderflow.example.com, deb.sury.org, dev.azure.com, docs.docker.com, docs.github.com, docs.litellm.ai, docusaurus.io, dot.net, en.wikipedia.org, engelschall.com, example.com, fb.me, gist.github.com, github.com, host.docker.internal, id.atlassian.com, jquery.org, learn.microsoft.com, lmstudio.ai, lodash.com, login.microsoftonline.com, manpages.ubuntu.com, modelcontextprotocol.io, myaccount.google.com, myibmi.mycompany.com, openjsf.org, openrouter.ai, opensource.org, packages.adoptium.net, peps.python.org, pm2.keymetrics.io, portal.azure.com, production.example.com, profoundlogicsupport.atlassian.net, proxy.example.com, react.dev, resource.openai.azure.com, s3.us-east-2.amazonaws.com, schema.org, slack-hooks.example.com, support.atlassian.com, tldrlegal.com, uicdn.toast.com, underscorejs.org
Oversized source lightweight scan
dist/routes/tasks.js3.62 MB file, sampled 256 KB
ObfuscatedHighEntropyStringsMinified
dist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.js2.83 MB file, sampled 256 KB
ChildProcessHighEntropyStringsMinifiedUrlStringsen.wikipedia.orgengelschall.comgithub.comjquery.orglodash.comopenjsf.orgopensource.orgtldrlegal.comunderscorejs.orgwww.w3.org

Source & flagged code

7 flagged · loading source
dist/web-ui/public/setup-password.jsView file
1patternName = generic_password severity = medium line = 1 matchedText = import{i...;});
Medium
Secret Pattern

Package contains a possible secret pattern.

dist/web-ui/public/setup-password.jsView on unpkg · L1
dist/web-ui/public/vendor/tui-color-picker/2.2.8/tui-color-picker.min.jsView file
8// @license RGB <-> HSV conversion utilities based off of http://www.cs.rit.edu/~ncs/color/t_convert.html L9: hexToRGB:function(t){return!!o.isValidRGB(t)&&(t=t.substring(1),[parseInt(t.substr(0,2),16),parseInt(t.substr(2,2),16),parseInt(t.substr(4,2),16)])},rgbToHEX:function(t,e,r){var n=...
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/web-ui/public/vendor/tui-color-picker/2.2.8/tui-color-picker.min.jsView on unpkg · L8
dist/middleware/requirePermission.jsView file
1(function(_0x4e2805,_0xb73487){const _0x3fc21e={_0x617760:0x38a,_0x43068b:0x38f,_0x165c35:0x4b9,_0x23152a:0x47a,_0x36acae:0x47e,_0x3f44aa:0x480,_0xbd435b:0x46c,_0x38db6f:0x4dd,_0x2...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/middleware/requirePermission.jsView on unpkg · L1
dist/middleware/requireInit.jsView file
1(function(_0x2647f3,_0xf1ccd1){const _0x1bdef8={_0x3d1f8e:'\x30\x78\x31\x61\x32',_0x17f8cd:'\x30\x78\x31\x37\x38',_0x35ff30:'\x30\x78\x31\x38\x65',_0x850ecb:'\x30\x78\x31\x66\x36',...
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/middleware/requireInit.jsView on unpkg · L1
dist/base-image/start-code-server.shView file
•path = dist/base-image/start-code-server.sh kind = build_helper sizeBytes = 2714 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/base-image/start-code-server.shView on unpkg
dist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.jsView file
•path = dist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.js kind = oversized_source_file sizeBytes = 2963890 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.jsView on unpkg
dist/routes/tasks.jsView file
•path = dist/routes/tasks.js kind = oversized_cli_entrypoint sizeBytes = 3791551 magicHex = [redacted]
Medium
Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/routes/tasks.jsView on unpkg

Findings

3 High7 Medium7 Low
HighObfuscated Payload Loaderdist/middleware/requireInit.js
HighObfuscated
HighOversized Source Filedist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.js
MediumSecret Patterndist/web-ui/public/setup-password.js
MediumDynamic Requiredist/middleware/requirePermission.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/base-image/start-code-server.sh
MediumOversized Cli Entrypointdist/routes/tasks.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/web-ui/public/vendor/tui-color-picker/2.2.8/tui-color-picker.min.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License