registry / @sifxprime/krouter / 0.5.102

@sifxprime/krouter@0.5.102

kRouter (Kodelyth Router) CLI — Kodelyth AI Infrastructure

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 24 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 36 file(s), 569 KB of source, external domains: 127.0.0.1, api.example.com, registry.npmjs.org

Source & flagged code

15 flagged

package.jsonView file

Lines 8-48json

8 "url": "https://github.com/sifxprime/krouter.git"

9 },

10 "bugs": "https://github.com/sifxprime/krouter/issues",

11 "bin": {

12 "krouter": "./cli.js"

13 },

14 "files": [

15 "cli.js",

16 "src",

17 "hooks",

18 "app",

19 "README.md",

20 "LICENSE"

21 ],

22 "scripts": {

23 "dev": "nodemon -I --watch cli.js --watch src --watch hooks --ext js,json cli.js",

24 "build": "node scripts/build-cli.js",

25 "sync-readme": "node scripts/sync-readme.js",

26 "pack:cli": "npm run sync-readme && npm run build && npm pack --pack-destination ../..",

27 "publish:cli": "npm run sync-readme && npm run build && npm publish",

28 "postinstall": "node hooks/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 "prepublishOnly": "npm run sync-readme && npm run build"

30 },

31 "dependencies": {

32 "enquirer": "^2.4.1",

33 "node-forge": "^1.3.3",

34 "node-machine-id": "^1.1.12",

35 "react": "19.2.1",

36 "react-dom": "19.2.1"

37 },

38 "comment_sqlite": "sql.js + better-sqlite3 are NOT bundled here. They are installed into ~/.krouter/runtime/node_modules by hooks/postinstall.js (and re-checked at runtime by cli.js). This avoids Windows EBUSY errors when updating the global CLI, since native .node files no longer live under the locked install dir.",

39 "comment_systray": "systray2 is NOT bundled here. It is lazy-installed into ~/.krouter/runtime/node_modules by hooks/postinstall.js on macOS/Linux only. Windows uses PowerShell NotifyIcon (zero binary). This avoids shipping unsigned Go binaries that trigger antivirus false positives (Kaspersky). We use the systray2 fork because the legacy systray@1.0.5 ships a 2017 x86_64 binary that fails on modern macOS dyld.",

40 "engines": {

41 "node": ">=18.0.0"

42 },

43 "keywords": [

44 "krouter",

45 "9router",

46 "kodelyth",

47 "cli",

48 "proxy",

app/.next-cli-build/server/chunks/4306.jsView file

Lines 1-1javascript

1"use strict";exports.id=4306,exports.ids=[4306],exports.modules={37221:(a,b,c)=>{let d;c.d(b,{RD:()=>p});var e=c(99129),f=c(89419),g=c(19035);function h(a){return(0,g.Gv)(a)}class i{#a;#b=new WeakMap;constructor(a){if(!function(a){return a&&"object"==typeof a&&Array.isArray(a.keys)&&a.keys.every(h)}(a))throw new e.Dm("JSON Web Key Set malformed");this.#a=structuredClone(a)}jwks(){return this.#a}async getKey(a,b){let{alg:c,kid:d}={...a,...b?.header},f=function(a){switch("string"==typeof a&&a.slice(0,2)){case"RS":case"PS":return"RSA";case"ES":return"EC";case"Ed":return"OKP";case"ML":return"AKP"; ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

app/.next-cli-build/server/chunks/4306.jsView on unpkg · L1

Long lines were clipped for display.

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in app/.next-cli-build/server/chunks/4306.js

app/.next-cli-build/server/chunks/4306.jsView on unpkg · L1

app/src/mitm/server.jsView file

Lines 4-59javascript

4${f}`;Gt.writeFileSync(n,v)}catch{}},file:n}}ei.exports={log:qu,err:Hu,dumpRequest:$u,createResponseDumper:Yu,clearDumpDir:Gu}});var $=F((Sh,ti)=>{ti.exports={options:{usePureJavaScript:!1}}});var ni=F((Th,ai)=>{var Na={};ai.exports=Na;var ri={};Na.encode=function(e,t,a){if(typeof t!="string")throw new TypeError('"alphabet" must be a string.');if(a!==void 0&&typeof a!="number")throw new TypeError('"maxline" must be a number.');var r="";if(!(e instanceof Uint8Array))r=ju(e,t);else{var n=0,s=t.length,i=t.charAt(0),o=[0];for(n=0;n<e.length;++n){for(var u=0,l=e[n];u<o.length;++u)l+=o[u]<<8,o[u]=l% ...

5`)}return r};Na.decode=function(e,t){if(typeof e!="string")throw new TypeError('"input" must be a string.');if(typeof t!="string")throw new TypeError('"alphabet" must be a string.');var a=ri[t];if(!a){a=ri[t]=[];for(var r=0;r<t.length;++r)a[t.charCodeAt(r)]=r}e=e.replace(/\s/g,"");for(var n=t.length,s=t.charAt(0),i=[0],r=0;r<e.length;r++){var o=a[e.charCodeAt(r)];if(o===void 0)return;for(var u=0,l=o;u<i.length;++u)l+=i[u]*n,i[u]=l&255,l>>=8;for(;l>0;)i.push(l&255),l>>=8}for(var c=0;e[c]===s&&c<e.length-1;++c)i.push(0);return typeof Buffer<"u"?Buffer.from(i.reverse()):new Uint8Array(i.reverse() ...

6`,a=a.substr(t));return r+=a,r};E.decode64=function(e){e=e.replace(/[^A-Za-z0-9\+\/\=]/g,"");for(var t="",a,r,n,s,i=0;i<e.length;)a=Rt[e.charCodeAt(i++)-43],r=Rt[e.charCodeAt(i++)-43],n=Rt[e.charCodeAt(i++)-43],s=Rt[e.charCodeAt(i++)-43],t+=String.fromCharCode(a<<2|r>>4),n!==64&&(t+=String.fromCharCode((r&15)<<4|n>>2),s!==64&&(t+=String.fromCharCode((n&3)<<6|s)));return t};E.encodeUtf8=function(e){return unescape(encodeURIComponent(e))};E.decodeUtf8=function(e){return decodeURIComponent(escape(e))};E.binary={raw:{},hex:{},base64:{},base58:{},baseN:{encode:si.encode,decode:si.decode}};E.binary. ...

7`,a=a.substr(t));return r+=a,r};E.binary.base64.decode=function(e,t,a){var r=t;r||(r=new Uint8Array(Math.ceil(e.length/4)*3)),e=e.replace(/[^A-Za-z0-9\+\/\=]/g,""),a=a||0;for(var n,s,i,o,u=0,l=a;u<e.length;)n=Rt[e.charCodeAt(u++)-43],s=Rt[e.charCodeAt(u++)-43],i=Rt[e.charCodeAt(u++)-43],o=Rt[e.charCodeAt(u++)-43],r[l++]=n<<2|s>>4,i!==64&&(r[l++]=(s&15)<<4|i>>2,o!==64&&(r[l++]=(i&3)<<6|o));return t?l-a:r.subarray(0,l)};E.binary.base58.encode=function(e,t){return E.binary.baseN.encode(e,oi,t)};E.binary.base58.decode=function(e,t){return E.binary.baseN.decode(e,oi,t)};E.text={utf8:{},utf16:{}};E. ...

8`);for(var n="",s=0;s<t*a;++s)n+=" ";switch(r+=n+"Tag: ",e.tagClass){case U.Class.UNIVERSAL:r+="Universal:";break;case U.Class.APPLICATION:r+="Application:";break;case U.Class.CONTEXT_SPECIFIC:r+="Context-Specific:";break;case U.Class.PRIVATE:r+="Private:";break}if(e.tagClass===U.Class.UNIVERSAL)switch(r+=e.type,e.type){case U.Type.NONE:r+=" (None)";break;case U.Type.BOOLEAN:r+=" (Boolean)";break;case U.Type.INTEGER:r+=" (Integer)";break;case U.Type.BITSTRING:r+=" (Bit string)";break;case U.Type.OCTETSTRING:r+=" (Octet string)";break;case U.Type.NULL:r+=" (Null)";break;case U.Type.OID:r+=" (Ob ...

9`,r+=n+"Constructed: "+e.constructed+`

10`,e.composed){for(var i=0,o="",s=0;s<e.value.length;++s)e.value[s]!==void 0&&(i+=1,o+=U.prettyPrint(e.value[s],t+1,a),s+1<e.value.length&&(o+=","));r+=n+"Sub values: "+i+o}else{if(r+=n+"Value: ",e.type===U.Type.OID){var u=U.derToOid(e.value);r+=u,de.pki&&de.pki.oids&&u in de.pki.oids&&(r+=" ("+de.pki.oids[u]+") ")}if(e.type===U.Type.INTEGER)try{r+=U.derToInteger(e.value)}catch{r+="0x"+de.util.bytesToHex(e.value)}else if(e.type===U.Type.BITSTRING){if(e.value.length>1?r+="0x"+de.util.bytesToHex(e.value.slice(1)):r+="(none)",e.value.length>0){var l=e.value.charCodeAt(0);l==1?r+=" (1 unused bit sh ...

11`,r;if(e.procType&&(r={name:"Proc-Type",values:[String(e.procType.version),e.procType.type]},a+=ra(r)),e.contentDomain&&(r={name:"Content-Domain",values:[e.contentDomain]},a+=ra(r)),e.dekInfo&&(r={name:"DEK-Info",values:[e.dekInfo.algorithm]},e.dekInfo.parameters&&r.values.push(e.dekInfo.parameters),a+=ra(r)),e.headers)for(var n=0;n<e.headers.length;++n)a+=ra(e.headers[n]);return e.procType&&(a+=`\r

12`),a+=aa.util.encode64(e.body,t.maxline||64)+`\r

13`,a+="-----END "+e.type+`-----\r

14`,a};Ii.decode=function(e){for(var t=[],a=/\s*-----BEGIN ([A-Z0-9- ]+)-----\r?\n?([\x21-\x7e\s]+?(?:\r?\n\r?\n))?([:A-Za-z0-9+\/=\s]+?)-----END \1-----/g,r=/([\x21-\x7e]+):\s*([\x21-\x7e\s^:]+)/,n=/\r?\n/,s;s=a.exec(e),!!s;){var i=s[1];i==="NEW CERTIFICATE REQUEST"&&(i="CERTIFICATE REQUEST");var o={type:i,procType:null,contentDomain:null,dekInfo:null,headers:[],body:aa.util.decode64(s[3])};if(t.push(o),!!s[2]){for(var u=s[2].split(n),l=0;s&&l<u.length;){for(var c=u[l].replace(/\s+$/,""),f=l+1;f<u.length;++f){var g=u[f];if(!/\s/.test(g[0]))break;c+=g,l=f}if(s=c.match(r),s){for(var v={name:s[1], ...

15`;for(var s=0,i=-1,n=0;n<t.length;++n,++s)if(s>65&&i!==-1){var o=t[i];o===","?(++i,t=t.substr(0,i)+`\r

16 `+t.substr(i)):t=t.substr(0,i)+`\r

17`+o+t.substr(i+1),s=n-i-1,i=-1,++n}else(t[n]===" "||t[n]===" "||t[n]===",")&&(i=n);return t}function i0(e){return e.replace(/^\s+/,"")}});var _r=F((Dh,bi)=>{var pe=$();Yr();Pa();re();bi.exports=pe.des=pe.des||{};pe.des.startEncrypting=function(e,t,a,r){var n=na({key:e,output:a,decrypt:!1,mode:r||(t===null?"ECB":"CBC")});return n.start(t),n};pe.des.createEncryptionCipher=function(e,t){return na({key:e,output:null,decrypt:!1,mode:t})};pe.des.startDecrypting=function(e,t,a,r){var n=na({key:e,output:a,decrypt:!0,mode:r||(t===null?"ECB":"CBC")});return n.start(t),n};pe.des.createDecryptionCipher=fu ...

18`;s+="Encryption: "+n+`\r

19`,s+="Comment: "+a+`\r

20`;var i=Ce.util.createBuffer();Cr(i,r),Et(i,e.e),Et(i,e.n);var o=Ce.util.encode64(i.bytes(),64),u=Math.floor(o.length/66)+1;s+="Public-Lines: "+u+`\r

21`,s+=o;var l=Ce.util.createBuffer();Et(l,e.d),Et(l,e.p),Et(l,e.q),Et(l,e.qInv);var c;if(!t)c=Ce.util.encode64(l.bytes(),64);else{var f=l.length()+16-1;f-=f%16;var g=Ta(l.bytes());g.truncate(g.length()-f+l.length()),l.putBuffer(g);var v=Ce.util.createBuffer();v.putBuffer(Ta("\0\0\0\0",t)),v.putBuffer(Ta("\0\0\0",t));var y=Ce.aes.createEncryptionCipher(v.truncate(8),"CBC");y.start(Ce.util.createBuffer().fillWithByte(0,16)),y.update(l.copy()),y.finish();var x=y.output;x.truncate(16),c=Ce.util.encode64(x.bytes(),64)}u=Math.floor(c.length/66)+1,s+=`\r

22Private-Lines: `+u+`\r

23`,s+=c;var S=Ta("putty-private-key-file-mac-key",t),I=Ce.util.createBuffer();Cr(I,r),Cr(I,n),Cr(I,a),I.putInt32(i.length()),I.putBuffer(i),I.putInt32(l.length()),I.putBuffer(l);var B=Ce.hmac.create();return B.start("sha1",S),B.update(I.bytes()),s+=`\r

24Private-MAC: `+B.digest().toHex()+`\r

25`,s};Ia.publicKeyToOpenSSH=function(e,t){var a="ssh-rsa";t=t||"";var r=Ce.util.createBuffer();return Cr(r,a),Et(r,e.e),Et(r,e.n),a+" "+Ce.util.encode64(r.bytes())+" "+t};Ia.privateKeyToOpenSSH=function(e,t){return t?Ce.pki.encryptRsaPrivateKey(e,t,{legacy:!0,algorithm:"aes128"}):Ce.pki.privateKeyToPem(e)};Ia.getPublicKeyFingerprint=function(e,t){t=t||{};var a=t.md||Ce.md.md5.create(),r="ssh-rsa",n=Ce.util.createBuffer();Cr(n,r),Et(n,e.e),Et(n,e.n),a.start(),a.update(n.getBytes());var s=a.digest();if(t.encoding==="hex"){var i=s.toHex();return t.delimiter?i.match(/.{2}/g).join(t.delimiter):i}els ...

26[ERROR] ${u.message}

27`)}finally{if(a)try{a.end()}catch{}if(!t.writableEnded)try{t.end()}catch{}}}async function ed(e,t,a,r){let n=e.headers.get("content-type")||"application/json",s={"Content-Type":n,"Cache-Control":"no-cache",Connection:"keep-alive"};if(n.includes("text/event-stream")&&(s["X-Accel-Buffering"]="no"),t.writeHead(200,s),!e.body){t.end(await e.text().catch(()=>""));return}let i=e.body.getReader(),o=new TextDecoder("utf-8",{fatal:!1}),u="",l=null;try{for(;;){let{done:c,value:f}=await i.read();if(c)break;u+=o.decode(f,{stream:!0});let g=u.split(`

28`);u=g.pop()||"";for(let v of g){let y=v.trim();if(!y||!y.startsWith("data:"))continue;let x=y.slice(5).trim();if(x!=="[DONE]"){process.env.DEBUG_MITM&&Ba(`[SSE in] ${x.slice(0,200)}`);try{let S=JSON.parse(x),I=a(S,r);if(I!=null){let B=Array.isArray(I)?I:[I];for(let b of B){if(process.env.DEBUG_MITM){let P=b.length||b.byteLength||0;Ba(`[write binary frame] (${P}B) first 20B: ${Array.from(b.slice(0,20)).join(",")}`)}t.write(Buffer.from(b))}}}catch{}}}}}catch(c){l=c,xr(`[MITM] pipeTransformedSSE upstream read failed: ${c.message}`)}finally{try{let c=a(null,r);if(c!=null){let f=Array.isArray(c)?c ...

30data: [DONE]

32`)}catch{}if(!t.writableEnded)try{t.end()}catch{}}}async function td(e,t,a,r){let n={"Content-Type":"application/vnd.amazon.eventstream","Cache-Control":"no-cache",Connection:"keep-alive"};if(!e.ok){let l=await jf(e);xr(`[MITM] upstream ${e.status}: ${l}`),t.writeHead(200,n);try{t.write(Lo(`[${e.status}] ${l}`))}catch(c){xr(`[MITM] exception frame write failed: ${c.message}`)}t.end();return}if(t.writeHead(200,n),!e.body){t.end(await e.text().catch(()=>""));return}let s=e.body.getReader(),i=new TextDecoder("utf-8",{fatal:!1}),o="",u=null;try{for(;;){let{done:l,value:c}=await s.read();if(l)break ...

33`);o=f.pop()||"";for(let g of f){let v=g.trim();if(!v||!v.startsWith("data:"))continue;let y=v.slice(5).trim();if(y!=="[DONE]"){process.env.DEBUG_MITM&&Ba(`[SSE in] ${y.slice(0,200)}`);try{let x=JSON.parse(y),S=a(x,r);if(S!=null){let I=Array.isArray(S)?S:[S];for(let B of I){if(process.env.DEBUG_MITM){let b=B.length||B.byteLength||0;Ba(`[write binary frame] (${b}B) first 20B: ${Array.from(B.slice(0,20)).join(",")}`)}t.write(Buffer.from(B))}}}catch{}}}}}catch(l){u=l,xr(`[MITM] pipeTransformedEventStream upstream read failed: ${l.message}`)}finally{try{let l=a(null,r);if(l!=null){let c=Array.isAr ...

34[ERROR] ${i.message}

35`),n.end()),s?(t.headersSent||t.writeHead(200,{"Content-Type":"text/event-stream"}),t.end(`data: ${JSON.stringify({error:{message:i.message}})}\r

36\r

37`)):(t.headersSent||t.writeHead(500,{"Content-Type":"application/json"}),t.end(JSON.stringify({error:{message:i.message,type:"mitm_error"}})))}}Po.exports={intercept:od}});var Fo=F((Cp,Vo)=>{var{err:ud}=wt(),{fetchRouter:ld,pipeSSE:cd}=Kr(),fd={"/chat/completions":"/v1/chat/completions","/v1/messages":"/v1/messages","/responses":"/v1/responses"};function dd(e){for(let[t,a]of Object.entries(fd))if(e.includes(t))return a;return"/v1/chat/completions"}async function hd(e,t,a,r){try{let n=JSON.parse(a.toString());n.model=r;let s=dd(e.url),i=await ld(n,s,e.headers);await cd(i,t)}catch(n){ud(`[copilo ...

38`)}catch{}}var xd=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t++){let a=t;for(let r=0;r<8;r++)a=a&1?3988292384^a>>>1:a>>>1;e[t]=a}return e})();function Mo(e){let t=4294967295;for(let a=0;a<e.length;a++)t=t>>>8^xd[(t^e[a])&255];return(t^4294967295)>>>0}function Sd(e){return{modelId:e||null,toolCallInit:{},hasToolCalls:!1,finishSent:!1,usage:null,inThink:!1,thinkBuf:""}}function Un(e,t){if(!e)return{thinking:null,text:null};let a=e;t.inThink&&t.thinkBuf&&(a=t.thinkBuf+a,t.thinkBuf="",t.inThink=!1);let r=/<thinking>|<think>/i,n=a.match(r);if(!n)return{thinking:null,text:a};let s=n[0].toLo ...

39`)||null,text:v.text||null}}var qo=255,Ho=65535,Go=16*1024*1024;function Dn(e,t){let a=Buffer.from(e,"utf8"),r=Buffer.from(t,"utf8");if(a.length>qo)throw new Error(`EventStream header name too long (${a.length} > ${qo}): ${e.slice(0,32)}\u2026`);if(r.length>Ho)throw new Error(`EventStream header value too long (${r.length} > ${Ho}) for ${e}`);let n=Buffer.alloc(1+a.length+1+2+r.length),s=0;return n[s++]=a.length,a.copy(n,s),s+=a.length,n[s++]=7,n.writeUInt16BE(r.length,s),s+=2,r.copy(n,s),n}function xt(e,t){let a=Buffer.from(typeof t=="string"?t:JSON.stringify(t),"utf8"),r=Buffer.concat([Dn(": ...

40`);t.push({role:"tool",tool_call_id:i.toolUseId||"",content:o})}let r=Array.isArray(e.images)?e.images:[],n=[];for(let i of r){let o=i?.source?.bytes;if(!o)continue;let u=(i?.format||"png").toLowerCase(),c=new Set(["png","jpeg","jpg","gif","webp"]).has(u)?`image/${u==="jpg"?"jpeg":u}`:"image/png";n.push({type:"image_url",image_url:{url:`data:${c};base64,${o}`}})}let s=(e.content||"").trim();if(s||n.length>0||a.length===0)if(n.length>0){let i=[];s&&i.push({type:"text",text:s}),i.push(...n),t.push({role:"user",content:i})}else t.push({role:"user",content:s});return t}function Id(e){let t=e.toolU ...

41 $proc = Start-Process powershell -ArgumentList @(

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

app/src/mitm/server.jsView on unpkg · L24

High

Child Process

Package source references child process execution.

app/src/mitm/server.jsView on unpkg · L39

42 '-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass',

43 '-WindowStyle','Hidden','-EncodedCommand','${t}'

44 ) -Verb RunAs -Wait -PassThru -WindowStyle Hidden;

45 if ($proc.ExitCode -ne 0) { throw "Elevated command exited with code $($proc.ExitCode)" }

46 `;return new Promise((r,n)=>{eu(`powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command ${au(a)}`,{windowsHide:!0},(s,i,o)=>{if(s){let u=o||s.message;u.includes("canceled by the user")||u.includes("operation was canceled")?n(new Error("User canceled UAC prompt")):n(new Error(u))}else r(i)})})}nu.exports={isAdmin:ru,runElevatedPowerShell:Vd,quotePs:au}});var pu=F((_p,hu)=>{var{exec:Ap,spawn:su,execSync:Mr}=require("child_process"),_e=require("fs"),Fd=require("path"),Bp=require("os"),{log:ba,err:Kd}=wt(),{TOOL_HOSTS:qt}=Zo(),{runElevatedPowerShell:ou,isAdmin:bp}=iu();function u ...

47`),s.stdin.end())})}async function fu(e){bt||(lu?await qr("dscacheutil -flushcache && killall -HUP mDNSResponder",e):await qr("resolvectl flush-caches 2>/dev/null || true",e))}function Pn(e=null){try{let t=_e.readFileSync(Ze,"utf8");return e?t.includes(e):qt.antigravity.every(a=>t.includes(a))}catch{return!1}}function qd(){try{let e=_e.readFileSync(Ze,"utf8"),t={};for(let[a,r]of Object.entries(qt))t[a]=r.every(n=>e.includes(n));return t}catch{return Object.fromEntries(Object.keys(qt).map(e=>[e,!1]))}}async function Hd(e,t){let a=qt[e];if(!a)throw new Error(`Unknown tool: ${e}`);let r=a.filter( ...

48`),o=`${s}\r

49${i}\r

50`;uu(Ze,n,o),await ou("ipconfig /flushdns | Out-Null")}else{let s=_e.readFileSync(Ze,"utf8").replace(/[\r\n\s]+$/g,""),i=r.map(l=>`127.0.0.1 ${l}`).join(`

51`),u=`${s}

52${i}

53`.replace(/'/g,"'\\''");await qr(`printf '%s' '${u}' | tee ${Ze} > /dev/null`,t),await fu(t)}ba(`\u{1F310} DNS ${e}: \u2705 added ${r.join(", ")}`)}catch(n){let s=n.message?.includes("incorrect password")?"Wrong sudo password":`Failed to add DNS entry: ${n.message}`;throw new Error(s)}}async function du(e,t){let a=qt[e];if(!a)throw new Error(`Unknown tool: ${e}`);let r=a.filter(n=>Pn(n));if(r.length===0){ba(`\u{1F310} DNS ${e}: already inactive`);return}try{if(bt){let n=_e.readFileSync(Ze,"utf8"),i=n.split(/\r?\n/).filter(o=>!r.some(u=>o.includes(u))).join(`\r

54`).replace(/[\r\n\s]+$/g,"")+`\r

55`;uu(Ze,n,i),await ou("ipconfig /flushdns | Out-Null")}else{let o=(_e.readFileSync(Ze,"utf8").split(/\r?\n/).filter(u=>!r.some(l=>u.includes(l))).join(`

56`).replace(/[\r\n\s]+$/g,"")+`

57`).replace(/'/g,"'\\''");await qr(`printf '%s' '${o}' | tee ${Ze} > /dev/null`,t),await fu(t)}ba(`\u{1F310} DNS ${e}: \u2705 removed ${r.join(", ")}`)}catch(n){let s=n.message?.includes("incorrect password")?"Wrong sudo password":`Failed to remove DNS entry: ${n.message}`;throw new Error(s)}}async function Gd(e){for(let t of Object.keys(qt))try{await du(t,e)}catch(a){Kd(`DNS ${t}: failed to remove \u2014 ${a.message}`)}}function zd(){try{if(!_e.existsSync(Ze))return;let e=Object.values(qt).flat(),t=_e.readFileSync(Ze,"utf8"),a=bt?`\r

58`:`

59`,n=t.split(/\r?\n/).filter(s=>!e.some(i=>s.includes(i))).join(a).replace(/[\r\n\s]+$/g,"")+a;if(n===t)return;if(_e.writeFileSync(Ze,n,"utf8"),bt)try{Mr("ipconfig /flushdns",{windowsHide:!0,stdio:"ignore"})}catch{}else if(lu)try{Mr("dscacheutil -flushcache && killall -HUP mDNSResponder",{stdio:"ignore"})}catch{}else try{Mr("resolvectl flush-caches 2>/dev/null || true",{stdio:"ignore"})}catch{}}catch{}}hu.exports={TOOL_HOSTS:qt,addDNSEntry:Hd,removeDNSEntry:du,removeAllDNSEntries:Gd,removeAllDNSEntriesSync:zd,execWithPassword:qr,isSudoAvailable:_a,canRunSudoWithoutPassword:cu,isSudoPasswordRequ ...

Long lines were clipped for display.

44) -Verb RunAs -Wait -PassThru -WindowStyle Hidden; L45: if ($proc.ExitCode -ne 0) { throw "Elevated command exited with code $($proc.ExitCode)" } L46: `;return new Promise((r,n)=>{eu(`powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command ${au(a)}`,{windowsHide:!0},(s,i,o)=>{if(s){let u=o||s.message;u.includes("ca... L47: `),s.stdin.end())})}async function fu(e){bt||(lu?await qr("dscacheutil -flushcache && killall -HUP mDNSResponder",e):await qr("resolvectl flush-caches 2>/dev/null || true",e))}func... ... L58: `:` L59: `,n=t.split(/\r?\n/).filter(s=>!e.some(i=>s.includes(i))).join(a).replace(/[\r\n\s]+$/g,"")+a;if(n===t)return;if(_e.writeFileSync(Ze,n,"utf8"),bt)try{Mr("ipconfig /flushdns",{windo... L60: ${Bu}`});Vn.set(e,r),t(null,r)}catch(a){ot(`SNI error for ${e}: ${a.message}`),t(a)}}var bu;try{let e=gu.readFileSync(yu.join(vu,"rootCA.key")),t=gu.readFileSync(yu.join(vu,"rootCA...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

app/src/mitm/server.jsView on unpkg · L44

cli.jsView file

Lines 219-259javascript

219 process.kill(pid, "SIGKILL");

220 }

221 } catch { }

222 try { fs.unlinkSync(pidFile); } catch { }

223 } catch { }

224}

225

226// Kill tunnel processes (cloudflared/tailscale) by their PID files

227function killTunnelByPidFile() {

228 const tunnelDir = path.join(getAppDataDir(), "tunnel");

229 killByPidFile(path.join(tunnelDir, "cloudflared.pid"));

230 killByPidFile(path.join(tunnelDir, "tailscale.pid"));

231}

232

233// Kill cloudflared whose --url targets this app's port (covers stale PID file case)

234function killCloudflaredByAppPort(appPort) {

235 if (!appPort) return [];

236 const portMatchers = [`localhost:${appPort}`, `127.0.0.1:${appPort}`];

237 const pids = [];

238 try {

239 if (process.platform === "win32") {

240 const psCmd = `powershell -NonInteractive -WindowStyle Hidden -Command "Get-WmiObject Win32_Process -Filter 'Name=\\"cloudflared.exe\\"' | Select-Object ProcessId,CommandLine | ConvertTo-Csv -NoTypeInformation"`;

241 const output = execSync(psCmd, { encoding: "utf8", windowsHide: true, timeout: 5000 });

High

Shell

Package source references shell execution.

cli.jsView on unpkg · L239

242 const lines = output.split("\n").slice(1).filter(l => l.trim());

243 lines.forEach(line => {

244 if (portMatchers.some(m => line.includes(m))) {

245 const match = line.match(/^"(\d+)"/);

246 if (match && match[1]) pids.push(match[1]);

247 }

248 });

249 } else {

250 const output = execSync("ps -eo pid,command 2>/dev/null", { encoding: "utf8", timeout: 5000 });

251 output.split("\n").forEach(line => {

252 if (line.includes("cloudflared") && portMatchers.some(m => line.includes(m))) {

253 const parts = line.trim().split(/\s+/);

254 const pid = parts[0];

255 if (pid && !isNaN(pid)) pids.push(pid);

256 }

257 });

258 }

259 } catch { }

2Cross-file remote execution chain: cli.js spawns app/src/mitm/server.js; helper contains network access plus dynamic code execution. L2: L3: const { spawn, exec, execSync } = require("child_process"); L4: const path = require("path"); L5: const fs = require("fs"); L6: const https = require("https"); L7: const os = require("os"); ... L16: start() { L17: if (process.stdout.isTTY) { L18: process.stdout.write(`\r${frames[0]} ${currentText}`); L19: interval = setInterval(() => { ... L44: L45: const pkg = require("./package.json");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli.jsView on unpkg · L2

app/server.jsView file

Lines 1-21javascript

1const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L1

3const dir = path.join(__dirname)

5process.env.NODE_ENV = 'production'

6process.chdir(__dirname)

8const currentPort = parseInt(process.env.PORT, 10) || 3000

9const hostname = process.env.HOSTNAME || '0.0.0.0'

11let keepAliveTimeout = parseInt(process.env.KEEP_ALIVE_TIMEOUT, 10)

12const nextConfig = {"env":{},"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next-cli-build","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.mjs","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp ...

14process.env.__NEXT_PRIVATE_STANDALONE_CONFIG = JSON.stringify(nextConfig)

16require('next')

17const { startServer } = require('next/dist/server/lib/start-server')

19if (

20 Number.isNaN(keepAliveTimeout) ||

21 !Number.isFinite(keepAliveTimeout) ||

Long lines were clipped for display.

src/cli/tray/autostart.jsView file

Lines 1-23javascript

1const fs = require("fs");

2const path = require("path");

3const os = require("os");

4const { execSync } = require("child_process");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli/tray/autostart.jsView on unpkg · L3

6const APP_NAME = "krouter";

7const APP_LABEL = "com.krouter.autostart";

9/**

10 * Resolve the absolute path to this package's cli.js.

11 *

12 * Order of preference:

13 * 1. Explicit `cliPath` argument — cleanest, used when called from running

14 * cli.js with `__filename`.

15 * 2. `process.argv[1]` if it's our cli.js — true when kRouter is currently

16 * running and the tray menu fires this code path.

17 * 3. Compute relative to this file's own location. autostart.js lives at

18 * `<pkg>/src/cli/tray/autostart.js`, so cli.js is three levels up.

19 * This works for any global install layout (nvm, Volta, asdf, Homebrew,

20 * /usr/local, etc.) without depending on `npm bin -g` (removed in npm 9)

21 * or a hardcoded `/usr/local/...` path.

22 *

23 * Returns null if no candidate exists — callers should not write an autostart

app/src/lib/updater/updater.jsView file

1// Standalone detached updater process. L2: // Spawns `npm i -g <pkg>@latest`, exposes progress via tiny HTTP server. L3: // Survives after parent Next server exits (detached + unref by spawner). L4: L5: const { spawn } = require("child_process"); L6: const http = require("http");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/src/lib/updater/updater.jsView on unpkg · L1

src/cli/tray/tray.ps1View file

•path = src/cli/tray/tray.ps1 kind = build_helper sizeBytes = 2581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/cli/tray/tray.ps1View on unpkg

app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2View file

•path = app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2 kind = high_entropy_blob sizeBytes = 3962536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2View on unpkg

app/.next-cli-build/server/chunks/8971.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in app/.next-cli-build/server/chunks/8971.js

app/.next-cli-build/server/chunks/8971.jsView on unpkg · L1

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node hooks/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node hooks/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

app/.next-cli-build/server/chunks/4306.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

app/.next-cli-build/server/chunks/4306.jsView on unpkg · L1

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in app/.next-cli-build/server/chunks/4306.js

app/.next-cli-build/server/chunks/4306.jsView on unpkg · L1

app/src/mitm/server.jsView file

39`)||null,text:v.text||null}}var qo=255,Ho=65535,Go=16*1024*1024;function Dn(e,t){let a=Buffer.from(e,"utf8"),r=Buffer.from(t,"utf8");if(a.length>qo)throw new Error(`EventStream hea... L40: `);t.push({role:"tool",tool_call_id:i.toolUseId||"",content:o})}let r=Array.isArray(e.images)?e.images:[],n=[];for(let i of r){let o=i?.source?.bytes;if(!o)continue;let u=(i?.forma... L41: $proc = Start-Process powershell -ArgumentList @(

High

Child Process

Package source references child process execution.

app/src/mitm/server.jsView on unpkg · L39

24Private-MAC: `+B.digest().toHex()+`\r L25: `,s};Ia.publicKeyToOpenSSH=function(e,t){var a="ssh-rsa";t=t||"";var r=Ce.util.createBuffer();return Cr(r,a),Et(r,e.e),Et(r,e.n),a+" "+Ce.util.encode64(r.bytes())+" "+t};Ia.private... L26: [ERROR] ${u.message} ... L39: `)||null,text:v.text||null}}var qo=255,Ho=65535,Go=16*1024*1024;function Dn(e,t){let a=Buffer.from(e,"utf8"),r=Buffer.from(t,"utf8");if(a.length>qo)throw new Error(`EventStream hea... L40: `);t.push({role:"tool",tool_call_id:i.toolUseId||"",content:o})}let r=Array.isArray(e.images)?e.images:[],n=[];for(let i of r){let o=i?.source?.bytes;if(!o)continue;let u=(i?.forma... L41: $proc = Start-Process powershell -ArgumentList @(

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

app/src/mitm/server.jsView on unpkg · L24

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

app/src/mitm/server.jsView on unpkg · L44

cli.jsView file

239if (process.platform === "win32") { L240: const psCmd = `powershell -NonInteractive -WindowStyle Hidden -Command "Get-WmiObject Win32_Process -Filter 'Name=\\"cloudflared.exe\\"' | Select-Object ProcessId,CommandLine | Con... L241: const output = execSync(psCmd, { encoding: "utf8", windowsHide: true, timeout: 5000 });

High

Shell

Package source references shell execution.

cli.jsView on unpkg · L239

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli.jsView on unpkg · L2

app/server.jsView file

1const path = require('path') L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L1

src/cli/tray/autostart.jsView file

3const os = require("os"); L4: const { execSync } = require("child_process"); L5: ... L36: } L37: const computed = path.resolve(__dirname, "..", "..", "..", "cli.js"); L38: if (fs.existsSync(computed)) return computed; ... L47: function enableAutoStart(cliPath) { L48: const platform = process.platform; L49: L50: if (!["darwin", "win32", "linux"].includes(platform)) return false; L51: if (platform === "linux" && !process.env.DISPLAY) return false; L52:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli/tray/autostart.jsView on unpkg · L3

app/src/lib/updater/updater.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/src/lib/updater/updater.jsView on unpkg · L1

src/cli/tray/tray.ps1View file

•path = src/cli/tray/tray.ps1 kind = build_helper sizeBytes = 2581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/cli/tray/tray.ps1View on unpkg

app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2View file

•path = app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2 kind = high_entropy_blob sizeBytes = 3962536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2View on unpkg

app/.next-cli-build/server/chunks/8971.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in app/.next-cli-build/server/chunks/8971.js

app/.next-cli-build/server/chunks/8971.jsView on unpkg · L1

Findings

3 Critical8 High7 Medium6 Low

CriticalCritical Secretapp/.next-cli-build/server/chunks/4306.js

CriticalSecret Patternapp/.next-cli-build/server/chunks/4306.js

CriticalSecret Patternapp/.next-cli-build/server/chunks/8971.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processapp/src/mitm/server.js

HighShellcli.js

HighSame File Env Network Executionapp/src/mitm/server.js

HighCommand Output Exfiltrationapp/src/mitm/server.js

HighCross File Remote Execution Contextcli.js

HighRuntime Package Installapp/src/lib/updater/updater.js

HighShips High Entropy Blobapp/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requireapp/server.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/cli/tray/autostart.js

MediumShips Build Helpersrc/cli/tray/tray.ps1

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

15 flagged

package.jsonView file

Lines 8-48json

8 "url": "https://github.com/sifxprime/krouter.git"

9 },

10 "bugs": "https://github.com/sifxprime/krouter/issues",

11 "bin": {

12 "krouter": "./cli.js"

13 },

14 "files": [

15 "cli.js",

16 "src",

17 "hooks",

18 "app",

19 "README.md",

20 "LICENSE"

21 ],

22 "scripts": {

23 "dev": "nodemon -I --watch cli.js --watch src --watch hooks --ext js,json cli.js",

24 "build": "node scripts/build-cli.js",

25 "sync-readme": "node scripts/sync-readme.js",

26 "pack:cli": "npm run sync-readme && npm run build && npm pack --pack-destination ../..",

27 "publish:cli": "npm run sync-readme && npm run build && npm publish",

28 "postinstall": "node hooks/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 "prepublishOnly": "npm run sync-readme && npm run build"

30 },

31 "dependencies": {

32 "enquirer": "^2.4.1",

33 "node-forge": "^1.3.3",

34 "node-machine-id": "^1.1.12",

35 "react": "19.2.1",

36 "react-dom": "19.2.1"

37 },

40 "engines": {

41 "node": ">=18.0.0"

42 },

43 "keywords": [

44 "krouter",

45 "9router",

46 "kodelyth",

47 "cli",

48 "proxy",

app/.next-cli-build/server/chunks/4306.jsView file

Lines 1-1javascript

Critical

Critical Secret

Package contains a critical-looking secret pattern.

app/.next-cli-build/server/chunks/4306.jsView on unpkg · L1

Long lines were clipped for display.

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in app/.next-cli-build/server/chunks/4306.js

app/.next-cli-build/server/chunks/4306.jsView on unpkg · L1

app/src/mitm/server.jsView file

Lines 4-59javascript

9`,r+=n+"Constructed: "+e.constructed+`

12`),a+=aa.util.encode64(e.body,t.maxline||64)+`\r

13`,a+="-----END "+e.type+`-----\r

15`;for(var s=0,i=-1,n=0;n<t.length;++n,++s)if(s>65&&i!==-1){var o=t[i];o===","?(++i,t=t.substr(0,i)+`\r

16 `+t.substr(i)):t=t.substr(0,i)+`\r

18`;s+="Encryption: "+n+`\r

19`,s+="Comment: "+a+`\r

20`;var i=Ce.util.createBuffer();Cr(i,r),Et(i,e.e),Et(i,e.n);var o=Ce.util.encode64(i.bytes(),64),u=Math.floor(o.length/66)+1;s+="Public-Lines: "+u+`\r

22Private-Lines: `+u+`\r

24Private-MAC: `+B.digest().toHex()+`\r

26[ERROR] ${u.message}

30data: [DONE]

34[ERROR] ${i.message}

35`),n.end()),s?(t.headersSent||t.writeHead(200,{"Content-Type":"text/event-stream"}),t.end(`data: ${JSON.stringify({error:{message:i.message}})}\r

36\r

41 $proc = Start-Process powershell -ArgumentList @(

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

app/src/mitm/server.jsView on unpkg · L24

High

Child Process

Package source references child process execution.

app/src/mitm/server.jsView on unpkg · L39

42 '-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass',

43 '-WindowStyle','Hidden','-EncodedCommand','${t}'

44 ) -Verb RunAs -Wait -PassThru -WindowStyle Hidden;

45 if ($proc.ExitCode -ne 0) { throw "Elevated command exited with code $($proc.ExitCode)" }

48`),o=`${s}\r

49${i}\r

50`;uu(Ze,n,o),await ou("ipconfig /flushdns | Out-Null")}else{let s=_e.readFileSync(Ze,"utf8").replace(/[\r\n\s]+$/g,""),i=r.map(l=>`127.0.0.1 ${l}`).join(`

51`),u=`${s}

52${i}

54`).replace(/[\r\n\s]+$/g,"")+`\r

55`;uu(Ze,n,i),await ou("ipconfig /flushdns | Out-Null")}else{let o=(_e.readFileSync(Ze,"utf8").split(/\r?\n/).filter(u=>!r.some(l=>u.includes(l))).join(`

56`).replace(/[\r\n\s]+$/g,"")+`

58`:`

Long lines were clipped for display.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

app/src/mitm/server.jsView on unpkg · L44

cli.jsView file

Lines 219-259javascript

219 process.kill(pid, "SIGKILL");

220 }

221 } catch { }

222 try { fs.unlinkSync(pidFile); } catch { }

223 } catch { }

224}

225

226// Kill tunnel processes (cloudflared/tailscale) by their PID files

227function killTunnelByPidFile() {

228 const tunnelDir = path.join(getAppDataDir(), "tunnel");

229 killByPidFile(path.join(tunnelDir, "cloudflared.pid"));

230 killByPidFile(path.join(tunnelDir, "tailscale.pid"));

231}

232

233// Kill cloudflared whose --url targets this app's port (covers stale PID file case)

234function killCloudflaredByAppPort(appPort) {

235 if (!appPort) return [];

236 const portMatchers = [`localhost:${appPort}`, `127.0.0.1:${appPort}`];

237 const pids = [];

238 try {

239 if (process.platform === "win32") {

241 const output = execSync(psCmd, { encoding: "utf8", windowsHide: true, timeout: 5000 });

High

Shell

Package source references shell execution.

cli.jsView on unpkg · L239

242 const lines = output.split("\n").slice(1).filter(l => l.trim());

243 lines.forEach(line => {

244 if (portMatchers.some(m => line.includes(m))) {

245 const match = line.match(/^"(\d+)"/);

246 if (match && match[1]) pids.push(match[1]);

247 }

248 });

249 } else {

250 const output = execSync("ps -eo pid,command 2>/dev/null", { encoding: "utf8", timeout: 5000 });

251 output.split("\n").forEach(line => {

252 if (line.includes("cloudflared") && portMatchers.some(m => line.includes(m))) {

253 const parts = line.trim().split(/\s+/);

254 const pid = parts[0];

255 if (pid && !isNaN(pid)) pids.push(pid);

256 }

257 });

258 }

259 } catch { }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli.jsView on unpkg · L2

app/server.jsView file

Lines 1-21javascript

1const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L1

3const dir = path.join(__dirname)

5process.env.NODE_ENV = 'production'

6process.chdir(__dirname)

8const currentPort = parseInt(process.env.PORT, 10) || 3000

9const hostname = process.env.HOSTNAME || '0.0.0.0'

11let keepAliveTimeout = parseInt(process.env.KEEP_ALIVE_TIMEOUT, 10)

14process.env.__NEXT_PRIVATE_STANDALONE_CONFIG = JSON.stringify(nextConfig)

16require('next')

17const { startServer } = require('next/dist/server/lib/start-server')

19if (

20 Number.isNaN(keepAliveTimeout) ||

21 !Number.isFinite(keepAliveTimeout) ||

Long lines were clipped for display.

src/cli/tray/autostart.jsView file

Lines 1-23javascript

1const fs = require("fs");

2const path = require("path");

3const os = require("os");

4const { execSync } = require("child_process");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli/tray/autostart.jsView on unpkg · L3

6const APP_NAME = "krouter";

7const APP_LABEL = "com.krouter.autostart";

9/**

10 * Resolve the absolute path to this package's cli.js.

11 *

12 * Order of preference:

13 * 1. Explicit `cliPath` argument — cleanest, used when called from running

14 * cli.js with `__filename`.

15 * 2. `process.argv[1]` if it's our cli.js — true when kRouter is currently

16 * running and the tray menu fires this code path.

17 * 3. Compute relative to this file's own location. autostart.js lives at

18 * `<pkg>/src/cli/tray/autostart.js`, so cli.js is three levels up.

19 * This works for any global install layout (nvm, Volta, asdf, Homebrew,

20 * /usr/local, etc.) without depending on `npm bin -g` (removed in npm 9)

21 * or a hardcoded `/usr/local/...` path.

22 *

23 * Returns null if no candidate exists — callers should not write an autostart

app/src/lib/updater/updater.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/src/lib/updater/updater.jsView on unpkg · L1

src/cli/tray/tray.ps1View file

•path = src/cli/tray/tray.ps1 kind = build_helper sizeBytes = 2581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/cli/tray/tray.ps1View on unpkg

app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2View file

•path = app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2 kind = high_entropy_blob sizeBytes = 3962536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

app/.next-cli-build/static/media/material-symbols-outlined.ec1fa111.woff2View on unpkg

app/.next-cli-build/server/chunks/8971.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in app/.next-cli-build/server/chunks/8971.js

app/.next-cli-build/server/chunks/8971.jsView on unpkg · L1