registry / @seemseam/ccb / 8.5.0

@seemseam/ccb@8.5.0

Lightweight multi-agent TUI and stable cross-provider collaboration layer for Codex, Claude, Gemini, Grok, Kimi, DeepSeek, and other CLI agents.

Static Scan Results

scanned 21d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 6 file(s), 10.8 KB of source, external domains: github.com

Source & flagged code

3 flagged

package.jsonView file

Lines 34-72json

34 ],

35 "bin": {

36 "ccb": "bin/ccb.js",

37 "ask": "bin/ask.js",

38 "autonew": "bin/autonew.js",

39 "ctx-transfer": "bin/ctx-transfer.js"

40 },

41 "files": [

42 "bin/ccb.js",

43 "bin/ask.js",

44 "bin/autonew.js",

45 "bin/ctx-transfer.js",

46 "bin/ccb-npm-install.js",

47 "bin/ccb-npm-runner.js",

48 "README.md",

49 "README/*.md",

50 "LICENSE",

51 "VERSION"

52 ],

53 "scripts": {

54 "postinstall": "node bin/ccb-npm-install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

55 "pack:check": "npm pack --dry-run"

56 },

57 "engines": {

58 "node": ">=18"

59 },

60 "os": [

61 "linux",

62 "darwin"

63 ],

64 "cpu": [

65 "x64",

66 "arm64"

67 ],

68 "publishConfig": {

69 "access": "public"

70 }

71}

bin/ask.jsView file

Lines 1-5javascript

1#!/usr/bin/env node

2"use strict";

4require("./ccb-npm-runner").run("ask");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/ask.jsView on unpkg · L3

bin/ccb-npm-install.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @seemseam/ccb@8.2.1 matchedIdentity = npm:QHNlZW1zZWFtL2NjYg:8.2.1 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/ccb-npm-install.jsView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code