registry / @superclawd-ai/pipelines / 0.1.2

@superclawd-ai/pipelines@0.1.2

Turn your board into an autonomous pipeline — a local, opt-in SuperClawd extension that runs your own Claude on your tickets and opens PRs for review.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 3 file(s), 2.45 MB of source, external domains: api.atlassian.com, api.linear.app, api.superclawd.com, cdn.jsdelivr.net, demo.atlassian.net, developer.mozilla.org, gist.github.com, github.com, huggingface.co, linear.app, mcp-api.superclawd.com, radix-ui.com, reactjs.org, superclawd.com, web.dev, www.markdownguide.org, www.w3.org, your-server.com

Source & flagged code

7 flagged

dist-server/index.mjsView file

Lines 1-29javascript

1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);

2var wi=Object.defineProperty;var Rn=(e,t)=>()=>(e&&(t=e(e=0)),t);var bi=(e,t)=>{for(var n in t)wi(e,n,{get:t[n],enumerable:!0})};var he,j,Re,Te,y,h,I,x,S,l,M,te,E,H,B,L,q,P,C,G,J,V=Rn(()=>{"use strict";he={loggedIn:!0,account:{email:"owner@example.com",org:"superclawd"}},j=[{id:"ws_front",name:"Frontend",tier:"paid"},{id:"ws_core",name:"Core Platform",tier:"paid"},{id:"ws_sandbox",name:"Sandbox",tier:"free"}],Re=[{id:"team_core",name:"Core"},{id:"team_review",name:"Reviewers"}],Te=[{id:"agent_orch",name:"Orchestrator"},{id:"agent_reviewer",name:"Code Reviewer"},{id:"agent_fixer",name:"Bug Fixe ...

4Debounce the input ~300ms with a trailing call, cancel in-flight requests on a new keystroke, and skip the fetch for empty queries. Want me to sketch the hook?`,ts:"09:02"}],starred:!0,createdAt:new Date(Date.now()-3*36e5).toISOString(),updatedAt:new Date(Date.now()-3*36e5).toISOString()},conv_2:{id:"conv_2",title:"Explain the credit reservation flow",workspaceId:"ws_core",workspaceName:"Core Platform",tier:"High",effort:"high",sessionId:"3f9c7e21-8a4b-4d16-b0e2-59c8a1f4d7b3",messages:[{id:"m1",role:"user",text:"Walk me through how credits get reserved and finalized on a metered fetch.",ts:"11 ...

6Reserve holds an estimated amount up front, the fetch runs, then finalize settles the real cost and refunds the difference. Want the FOR-UPDATE details?`,ts:"11:20"}],starred:!1,createdAt:new Date(Date.now()-26*36e5).toISOString(),updatedAt:new Date(Date.now()-26*36e5).toISOString()},conv_3:{id:"conv_3",title:"Draft release notes for v2",workspaceId:"ws_front",workspaceName:"Frontend",tier:"Instant"

8Here\u2019s a first pass grouped by Added / Changed / Fixed. Want me to tighten the copy?`,ts:"08:05"}],starred:!1,createdAt:new Date(Date.now()-2*24*36e5).toISOString(),updatedAt:new Date(Date.now()-2*24*36e5).toISOString()}},te=["conv_3","conv_2","conv_1"],E={sched_1:{id:"sched_1",name:"Triage new bugs",prompt:"Triage new Linear bugs: reproduce, label severity, and open a follow-up for anything urgent.",workspaceId:"ws_front",workspaceName:"Frontend",assignmentKind:"team",teamId:"team_core",teamName:"Core",cadence:"Every 2 hours",enabled:!0,starred:!0,createdAt:new Date(Date.now()-8*24*36e5) ...

10`)){let o=s.trim();if(!o)continue;let i;try{i=JSON.parse(o)}catch{continue}let c=i,d=c.type,u=c.message?.content;if(typeof u=="string"){let m=u.trim();if(!m)continue;d==="user"?r.push({type:"prompt",text:m}):d==="assistant"&&r.push({type:"text",text:m});continue}if(Array.isArray(u))for(let m of u){if(!m||typeof m!="object")continue;let g=m;if(g.type==="text"&&typeof g.text=="string"&&g.text.trim()){let p=g.text.trim();d==="user"?r.push({type:"prompt",text:p}):d==="assistant"&&r.push({type:"text",text:p})}else g.type==="tool_use"&&r.push({type:"tool",text:Oi(g.name,g.input)})}}return r}Je();V() ...

11`)}function ps(e){let{cmd:t,args:n,repoPaths:r,enabled:s}=e;return!s||!r.length||!Hi()?{cmd:t,args:n,sandboxed:!1}:{cmd:"sandbox-exec",args:["-p",Xi(r),t,...n],sandboxed:!0}}function Et(e){if(!e||!e.trim())return process.cwd();let t=e.trim();return t==="~"?t=qn.homedir():(t.startsWith("~/")||t.startsWith("~\\"))&&(t=rt.join(qn.homedir(),t.slice(2))),rt.resolve(t)}function ea(){return`http://127.0.0.1:${Number(process.env.PIPELINES_PORT||process.env.PIPELINES_MOCK_PORT||63210)}`}function ta(){let e=process.env.SUPERCLAWD_BIN;if(e)return{cmd:e,baseArgs:[]};let t=rt.dirname(Zi(import.meta.url));f ...

High

Child Process

Package source references child process execution.

dist-server/index.mjsView on unpkg · L9

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

dist-server/index.mjsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist-server/index.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist-server/index.mjsView on unpkg · L1

12`)}catch{}}let c=Yi(i.cmd,i.args,{cwd:o,detached:!0,stdio:["ignore","pipe","pipe"],env:{...process.env,...s}}),d="",u="";c.stdout?.on("data",p=>d+=String(p)),c.stderr?.on("data",p=>u+=String(p));let m=new Promise(p=>{c.on("error",w=>p({code:127,stdout:d,stderr:`${u}

13${String(w)}`})),c.on("close",w=>p({code:w??137,stdout:d,stderr:u}))}),g=c.pid??0;return{pid:g,pgid:g,done:m}}function fs(e,t="SIGTERM"){if(e){if(process.platform==="win32"){try{Vi("taskkill",["/pid",String(e),"/T","/F"],{stdio:"ignore"})}catch{}return}try{process.kill(-e,t)}catch{try{process.kill(e,t)}catch{}}}}function Ue(e){return Fn(e).done}var na=["haiku","sonnet","opus","fable"],ra=["low","medium","high","xhigh","max"],ce="opus",de="high",ye=(e,t=ce)=>{let n=String(e??"").trim();return na.includes(n)?n:t},we=(e,t=de)=>{let n=String(e??"").trim();return ra.includes(n)?n:t};function sa(){l ...

14`),d=(n??"").trim();return d?`${c}

16Additional instructions from the human:

17${d}`:c}async function ga(e){let t=e.worktrees??[];if(!t.length)return"";let n=[],r=!1;for(let o of t){let{behind:i}=await ds(o.worktreePath,o.branch,o.base);i>0

18`)}async function ha(e,t,n){let r=I[e];if(!r)return;let s=h.find(w=>w.id===r.ticketId),o=n??(s?`${s.title}

20${s.description??""}`.trim():r.title),i=t?await ga(r)+o:ma(s,r,n),c=s?.workingDir??l.workspaceDirs?.[r.workspaceId]??"~",d=s?.model||l.defaultModel||ce,u=s?.effort||l.defaultEffort||de,m=l.sandboxWorktreeEdits?(await De(Et(c))).map(w=>w.path):void 0,g=Fn({prompt:i,workspace:r.workspaceId,workingDir:c,model:d,effort:u,sessionId:t?null:r.sessionId,resume:t?r.sessionId??null:null,pipelinesTools:!0,ticketId:r.ticketId,sandbox:l.sandboxWorktreeEdits,sandboxRepos:m});st.set(e,g),je(r,"state_change",t?"re-engaged (resume)":"agent started"),r.updatedAt=new Date().toISOString(),await $(e);let p=await g ...

22${d}`:""}`}if(i&&(o.resultText=i.slice(0,5e4)),s||i){let d=h.find(m=>m.id===o.ticketId),u={id:`rr_${da()}`,ticketId:o.ticketId,runId:e,sessionId:o.sessionId,prompt:(s??"").slice(0,5e4),response:i.slice(0,5e4),status:t===0?"completed":"error",model:d?.model||l.defaultModel||ce,effort:d?.effort||l.defaultEffort||de,createdAt:new Date().toISOString()};q.unshift(u),await Qt(u)}let c=!!h.find(d=>d.id===o.ticketId)?.blockedReason;if(t===0){let d=n.trim().slice(0,4e3);if(d&&je(o,"state_change",d),je(o,"mcp_tool","agent finished its turn"),se(o,"stopped",{stopReason:"completed",clearBlocker:!0,webhook ...

24Attached files (read these):

25${s.map(i=>`- ${i}`).join(`

26`)}`:"");return n.sessionId||(n.sessionId=ya()),se(n,"running",{stopReason:null,event:{kind:"state_change",text:r?`started with details: ${r.slice(0,80)}`:"started"},webhookEvent:"run.started"}),S[n.ticketId]="in_progress",await $(n.id),await T(n.ticketId),

27<html>

28 <head>

29 <meta charset="utf-8" />

Long lines were clipped for display.

dist/assets/transformers.web-CjIQtwg9.jsView file

6${N} L7: }`,m=new Function(Object.keys(F),N)(...Object.values(F)),N=`methodCaller<(${b.map(U=>U.name)}) => ${g.name}>`,my(Object.defineProperty(m,"name",{value:N}))}function by(u,f){return ... L8: `),r)}p.validationMode&&Mr(o,"validationMode",p.validationMode,r)}let _=Pe().webgpuRegisterDevice(h);if(_){let[p,w,v]=_;Mr(o,"deviceId",p.toString(),r),Mr(o,"webgpuInstance",w.toSt...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/transformers.web-CjIQtwg9.jsView on unpkg · L6

dist/assets/index-vUolqYQu.jsView file

51L52: Please change the parent <Route path="${C}"> to <Route path="${C==="/"?"*":`${C}/*`}">.`)}let b=bi(),y;y=b;let v=y.pathname||"/",T=v;if(m!=="/"){let C=m.replace(/^\//,"").split("/"... L53: * @license lucide-react v0.555.0 - ISC

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/index-vUolqYQu.jsView on unpkg · L51

dist/assets/ort-wasm-simd-threaded.asyncify-DMmc6YqF.wasmView file

•path = dist/assets/ort-wasm-simd-threaded.asyncify-DMmc6YqF.wasm kind = wasm_module sizeBytes = 23567050 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/assets/ort-wasm-simd-threaded.asyncify-DMmc6YqF.wasmView on unpkg

Source & flagged code

7 flagged · loading source

dist-server/index.mjsView file

9`)){let i=o.trim();if(!i)continue;let c;try{c=JSON.parse(i)}catch{continue}let d=c,u=Pi(d.message?.content);u&&(d.type==="user"&&r===null&&(r=u),d.type==="assistant"&&(s=u))}return... L10: `)){let o=s.trim();if(!o)continue;let i;try{i=JSON.parse(o)}catch{continue}let c=i,d=c.type,u=c.message?.content;if(typeof u=="string"){let m=u.trim();if(!m)continue;d==="user"?r.p... L11: `)}function ps(e){let{cmd:t,args:n,repoPaths:r,enabled:s}=e;return!s||!r.length||!Hi()?{cmd:t,args:n,sandboxed:!1}:{cmd:"sandbox-exec",args:["-p",Xi(r),t,...n],sandboxed:!0}}functi...

High

Child Process

Package source references child process execution.

dist-server/index.mjsView on unpkg · L9

1Manifest entrypoint (manifest.main) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L1: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L2: var wi=Object.defineProperty;var Rn=(e,t)=>()=>(e&&(t=e(e=0)),t);var bi=(e,t)=>{for(var n in t)wi(e,n,{get:t[n],enumerable:!0})};var he,j,Re,Te,y,h,I,x,S,l,M,te,E,H,B,L,q,P,C,G,J,V... L3: ... L7: L8: Here\u2019s a first pass grouped by Added / Changed / Fixed. Want me to tighten the copy?`,ts:"08:05"}],starred:!1,createdAt:new Date(Date.now()-2*24*36e5).toISOString(),updatedAt:... L9: `)){let i=o.trim();if(!i)continue;let c;try{c=JSON.parse(i)}catch{continue}let d=c,u=Pi(d.message?.content);u&&(d.type==="user"&&r===null&&(r=u),d.type==="assistant"&&(s=u))}return... L10: `)){let o=s.trim();if(!o)continue;let i;try{i=JSON.parse(o)}catch{continue}let c=i,d=c.type,u=c.message?.content;if(typeof u=="string"){let m=u.trim();if(!m)continue;d==="user"?r.p... L11: `)}function ps(e){let{cmd:t,args:n,repoPaths:r,enabled:s}=e;return!s||!r.length||!Hi()?{cmd:t,args:n,sandboxed:!1}:{cmd:"sandbox-exec",args:["-p",Xi(r),t,...n],sandboxed:!0}}func…

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

dist-server/index.mjsView on unpkg · L1

1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L2: var wi=Object.defineProperty;var Rn=(e,t)=>()=>(e&&(t=e(e=0)),t);var bi=(e,t)=>{for(var n in t)wi(e,n,{get:t[n],enumerable:!0})};var he,j,Re,Te,y,h,I,x,S,l,M,te,E,H,B,L,q,P,C,G,J,V... L3: ... L9: `)){let i=o.trim();if(!i)continue;let c;try{c=JSON.parse(i)}catch{continue}let d=c,u=Pi(d.message?.content);u&&(d.type==="user"&&r===null&&(r=u),d.type==="assistant"&&(s=u))}return... L10: `)){let o=s.trim();if(!o)continue;let i;try{i=JSON.parse(o)}catch{continue}let c=i,d=c.type,u=c.message?.content;if(typeof u=="string"){let m=u.trim();if(!m)continue;d==="user"?r.p... L11: `)}function ps(e){let{cmd:t,args:n,repoPaths:r,enabled:s}=e;return!s||!r.length||!Hi()?{cmd:t,args:n,sandboxed:!1}:{cmd:"sandbox-exec",args:["-p",Xi(r),t,...n],sandboxed:!0}}functi...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist-server/index.mjsView on unpkg · L1

1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L2: var wi=Object.defineProperty;var Rn=(e,t)=>()=>(e&&(t=e(e=0)),t);var bi=(e,t)=>{for(var n in t)wi(e,n,{get:t[n],enumerable:!0})};var he,j,Re,Te,y,h,I,x,S,l,M,te,E,H,B,L,q,P,C,G,J,V... L3: ... L7: L8: Here\u2019s a first pass grouped by Added / Changed / Fixed. Want me to tighten the copy?`,ts:"08:05"}],starred:!1,createdAt:new Date(Date.now()-2*24*36e5).toISOString(),updatedAt:... L9: `)){let i=o.trim();if(!i)continue;let c;try{c=JSON.parse(i)}catch{continue}let d=c,u=Pi(d.message?.content);u&&(d.type==="user"&&r===null&&(r=u),d.type==="assistant"&&(s=u))}return... L10: `)){let o=s.trim();if(!o)continue;let i;try{i=JSON.parse(o)}catch{continue}let c=i,d=c.type,u=c.message?.content;if(typeof u=="string"){let m=u.trim();if(!m)continue;d==="user"?r.p... L11: `)}function ps(e){let{cmd:t,args:n,repoPaths:r,enabled:s}=e;return!s||!r.length||!Hi()?{cmd:t,args:n,sandboxed:!1}:{cmd:"sandbox-exec",args:["-p",Xi(r),t,...n],sandboxed:!0}}functi...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist-server/index.mjsView on unpkg · L1

dist/assets/transformers.web-CjIQtwg9.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/transformers.web-CjIQtwg9.jsView on unpkg · L6

dist/assets/index-vUolqYQu.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/index-vUolqYQu.jsView on unpkg · L51

dist/assets/ort-wasm-simd-threaded.asyncify-DMmc6YqF.wasmView file

•path = dist/assets/ort-wasm-simd-threaded.asyncify-DMmc6YqF.wasm kind = wasm_module sizeBytes = 23567050 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/assets/ort-wasm-simd-threaded.asyncify-DMmc6YqF.wasmView on unpkg

Findings

4 High5 Medium8 Low

HighChild Processdist-server/index.mjs

HighEntrypoint Build Divergencedist-server/index.mjs

HighSame File Env Network Executiondist-server/index.mjs

HighCommand Output Exfiltrationdist-server/index.mjs

MediumDynamic Requiredist/assets/index-vUolqYQu.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Moduledist/assets/ort-wasm-simd-threaded.asyncify-DMmc6YqF.wasm

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/assets/transformers.web-CjIQtwg9.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

dist-server/index.mjsView file

Lines 1-29javascript

1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);

High

Child Process

Package source references child process execution.

dist-server/index.mjsView on unpkg · L9

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

dist-server/index.mjsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist-server/index.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist-server/index.mjsView on unpkg · L1

14`),d=(n??"").trim();return d?`${c}

16Additional instructions from the human:

17${d}`:c}async function ga(e){let t=e.worktrees??[];if(!t.length)return"";let n=[],r=!1;for(let o of t){let{behind:i}=await ds(o.worktreePath,o.branch,o.base);i>0

18`)}async function ha(e,t,n){let r=I[e];if(!r)return;let s=h.find(w=>w.id===r.ticketId),o=n??(s?`${s.title}

24Attached files (read these):

25${s.map(i=>`- ${i}`).join(`

27<html>

28 <head>

29 <meta charset="utf-8" />

Long lines were clipped for display.

dist/assets/transformers.web-CjIQtwg9.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/transformers.web-CjIQtwg9.jsView on unpkg · L6

dist/assets/index-vUolqYQu.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/index-vUolqYQu.jsView on unpkg · L51

dist/assets/ort-wasm-simd-threaded.asyncify-DMmc6YqF.wasmView file

•path = dist/assets/ort-wasm-simd-threaded.asyncify-DMmc6YqF.wasm kind = wasm_module sizeBytes = 23567050 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/assets/ort-wasm-simd-threaded.asyncify-DMmc6YqF.wasmView on unpkg