registry / @surething/cockpit / 1.0.232

@surething/cockpit@1.0.232

Claude Code GUI for parallel AI coding — drive Claude (default), Codex, DeepSeek, Kimi, or local Ollama in tabs. Multi-project sessions, terminal, browser & DB bubbles, code review, slash modes. Local-first, MIT.

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 23 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsObfuscatedUrlStrings

Manifest

WildcardDependency

scanned 32 file(s), 2.10 MB of source, external domains: 0.0.0.0, 127.0.0.1, api.deepseek.com, api.moonshot.cn, api.openai.com, github.com, json-schema.org

Source & flagged code

13 flagged

package.jsonView file

Lines 73-113json

73 "kernels",

74 "next.config.mjs",

75 "scripts/copy-tree-sitter-wasms.mjs",

76 "LICENSE",

77 "README.md"

78 ],

79 "scripts": {

80 "predev": "node scripts/copy-tree-sitter-wasms.mjs",

81 "dev": "COCKPIT_ENV=dev node --import tsx server.mjs",

82 "prepublishOnly": "npm run build && npm run build:server && rm -rf .next-prod/cache",

83 "prebuild": "node scripts/copy-tree-sitter-wasms.mjs",

84 "build": "next build --webpack",

85 "build:server": "tsup --config tsup.server.ts",

86 "setup": "npm run build && npm run build:server && npm link",

87 "setup-dev": "node bin/setup-dev.mjs",

88 "lint": "eslint",

89 "test": "vitest run",

90 "test:watch": "vitest",

91 "generate-icons": "node scripts/generate-icons.js",

92 "copy-wasms": "node scripts/copy-tree-sitter-wasms.mjs",

93 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L93

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L93

94 },

95 "dependencies": {

96 "@ai-sdk/openai": "^3.0.52",

97 "@anthropic-ai/claude-agent-sdk": "^0.3.179",

98 "@dagrejs/dagre": "^3.0.0",

99 "@tanstack/react-virtual": "^3.13.18",

100 "@tiptap/extension-link": "^3.19.0",

101 "@tiptap/extension-placeholder": "^3.19.0",

102 "@tiptap/extension-table": "^3.19.0",

103 "@tiptap/extension-table-cell": "^3.19.0",

104 "@tiptap/extension-table-header": "^3.19.0",

105 "@tiptap/extension-table-row": "^3.19.0",

106 "@tiptap/extension-task-item": "^3.19.0",

107 "@tiptap/extension-task-list": "^3.19.0",

108 "@tiptap/react": "^3.19.0",

109 "@tiptap/starter-kit": "^3.19.0",

110 "@types/hast": "^3.0.4",

111 "@types/pg": "^8.18.0",

112 "@types/react-syntax-highlighter": "^15.5.13",

113 "@vscode/ripgrep": "^1.17.0",

bin/cock.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

3import { dirname, resolve } from 'path';

4import { fileURLToPath } from 'url';

5import { spawnSync } from 'child_process';

High

Child Process

Package source references child process execution.

bin/cock.mjsView on unpkg · L4

7const

dist/chunk-GFI4IHYM.mjsView file

8289prop: "value", L8290: eval(fiber) { L8291: const cont = fiber.getCont(successCont);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-GFI4IHYM.mjsView on unpkg · L8289

chrome-extension/content.jsView file

Lines 191-225javascript

191 history.replaceState = function (...args) {

192 originalReplaceState.apply(this, args);

193 checkUrlChange();

194 };

195

196 window.addEventListener('popstate', checkUrlChange);

197 window.addEventListener

dist/wsServer.mjsView file

Lines 20-60javascript

20 writeStdinToCommand

21} from "./chunk-RJMSCVG5.mjs";

22import {

23 AppError,

24 Effect_exports,

25 FSError,

26 GLOBAL_STATE_FILE,

27 NotFoundError,

28 PubSub_exports,

29 Queue_exports,

30 REVIEW_DIR,

31 REVIEW_SIGNAL_FILE,

public/tree-sitter/tree-sitter-go.wasmView file

•path = public/tree-sitter/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

public/tree-sitter/tree-sitter-go.wasmView on unpkg

kernels/jupyter_bridge.pyView file

•path = kernels/jupyter_bridge.py kind = build_helper sizeBytes = 5532 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

kernels/jupyter_bridge.pyView on unpkg

.next-prod/static/media/KaTeX_Math-Italic.5295ba48.woffView file

•path = .next-prod/static/media/KaTeX_Math-Italic.5295ba48.woff kind = high_entropy_blob sizeBytes = 18748 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next-prod/static/media/KaTeX_Math-Italic.5295ba48.woffView on unpkg

.next-prod/server/chunks/7184.jsView file

•path = .next-prod/server/chunks/7184.js kind = payload_in_excluded_dir sizeBytes = 2511676 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next-prod/server/chunks/7184.jsView on unpkg

•path = .next-prod/server/chunks/7184.js kind = oversized_source_file sizeBytes = 2511676 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

.next-prod/server/chunks/7184.jsView on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cock.mjsView file

4import { fileURLToPath } from 'url'; L5: import { spawnSync } from 'child_process'; L6:

High

Child Process

Package source references child process execution.

bin/cock.mjsView on unpkg · L4

79// highWaterMark) this truncates at exactly 16384 bytes on macOS pipes. L80: // Without this, an ollama agent capturing our stdout via execAsync L81: // receives a cleanly cut mid-string blob and then misdiagnoses it as

High

Shell

Package source references shell execution.

bin/cock.mjsView on unpkg · L79

160// ============================================ L161: const port = process.env.PORT || process.env.COCKPIT_PORT || '3457'; L162: ... L164: try { L165: const res = await fetch(`http://localhost:${port}/api/version`, { signal: AbortSignal.timeout(1000) }); L166: return res.ok; ... L171: L172: const { exec } = await import('child_process'); L173: const running = await isServerRunning();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/cock.mjsView on unpkg · L160

dist/chunk-GFI4IHYM.mjsView file

8289prop: "value", L8290: eval(fiber) { L8291: const cont = fiber.getCont(successCont);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-GFI4IHYM.mjsView on unpkg · L8289

chrome-extension/content.jsView file

211// 7. 加载自动化层（automation.js）用于 CLI 控制 L212: // 通过 import() 在 isolated world 中加载（保留 chrome.runtime 访问） L213: // automation.js 监听 cockpit:cmd postMessage，执行 DOM 操作并返回结果

Medium

Dynamic Require

Package source references dynamic require/import behavior.

chrome-extension/content.jsView on unpkg · L211

dist/wsServer.mjsView file

40Cross-file remote execution chain: dist/wsServer.mjs spawns dist/chunk-GFI4IHYM.mjs; helper contains network access plus dynamic code execution. L40: // src/lib/wsServer.ts L41: import { WebSocketServer } from "ws"; L42: import { parse } from "url"; ... L55: try { L56: parsed = JSON.parse(String(data)); L57: } catch { ... L81: if (ws.readyState === ws.OPEN) { L82: ws.send(JSON.stringify(msg)); L83: } ... L97: // [redacted].ts L98: var isMac = process.platform === "darwin"; L99: var isWindows = process.platform === "win32";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/wsServer.mjsView on unpkg · L40

public/tree-sitter/tree-sitter-go.wasmView file

•path = public/tree-sitter/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

public/tree-sitter/tree-sitter-go.wasmView on unpkg

kernels/jupyter_bridge.pyView file

•path = kernels/jupyter_bridge.py kind = build_helper sizeBytes = 5532 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

kernels/jupyter_bridge.pyView on unpkg

.next-prod/static/media/KaTeX_Math-Italic.5295ba48.woffView file

•path = .next-prod/static/media/KaTeX_Math-Italic.5295ba48.woff kind = high_entropy_blob sizeBytes = 18748 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next-prod/static/media/KaTeX_Math-Italic.5295ba48.woffView on unpkg

.next-prod/server/chunks/7184.jsView file

•path = .next-prod/server/chunks/7184.js kind = payload_in_excluded_dir sizeBytes = 2511676 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next-prod/server/chunks/7184.jsView on unpkg

•path = .next-prod/server/chunks/7184.js kind = oversized_source_file sizeBytes = 2511676 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

.next-prod/server/chunks/7184.jsView on unpkg

Findings

8 High8 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/cock.mjs

HighShellbin/cock.mjs

HighSame File Env Network Executionbin/cock.mjs

HighCross File Remote Execution Contextdist/wsServer.mjs

HighShips High Entropy Blob.next-prod/static/media/KaTeX_Math-Italic.5295ba48.woff

HighPayload In Excluded Dir.next-prod/server/chunks/7184.js

HighOversized Source File.next-prod/server/chunks/7184.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirechrome-extension/content.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Modulepublic/tree-sitter/tree-sitter-go.wasm

MediumShips Build Helperkernels/jupyter_bridge.py

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/chunk-GFI4IHYM.mjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

13 flagged

package.jsonView file

Lines 73-113json

73 "kernels",

74 "next.config.mjs",

75 "scripts/copy-tree-sitter-wasms.mjs",

76 "LICENSE",

77 "README.md"

78 ],

79 "scripts": {

80 "predev": "node scripts/copy-tree-sitter-wasms.mjs",

81 "dev": "COCKPIT_ENV=dev node --import tsx server.mjs",

82 "prepublishOnly": "npm run build && npm run build:server && rm -rf .next-prod/cache",

83 "prebuild": "node scripts/copy-tree-sitter-wasms.mjs",

84 "build": "next build --webpack",

85 "build:server": "tsup --config tsup.server.ts",

86 "setup": "npm run build && npm run build:server && npm link",

87 "setup-dev": "node bin/setup-dev.mjs",

88 "lint": "eslint",

89 "test": "vitest run",

90 "test:watch": "vitest",

91 "generate-icons": "node scripts/generate-icons.js",

92 "copy-wasms": "node scripts/copy-tree-sitter-wasms.mjs",

93 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L93

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L93

94 },

95 "dependencies": {

96 "@ai-sdk/openai": "^3.0.52",

97 "@anthropic-ai/claude-agent-sdk": "^0.3.179",

98 "@dagrejs/dagre": "^3.0.0",

99 "@tanstack/react-virtual": "^3.13.18",

100 "@tiptap/extension-link": "^3.19.0",

101 "@tiptap/extension-placeholder": "^3.19.0",

102 "@tiptap/extension-table": "^3.19.0",

103 "@tiptap/extension-table-cell": "^3.19.0",

104 "@tiptap/extension-table-header": "^3.19.0",

105 "@tiptap/extension-table-row": "^3.19.0",

106 "@tiptap/extension-task-item": "^3.19.0",

107 "@tiptap/extension-task-list": "^3.19.0",

108 "@tiptap/react": "^3.19.0",

109 "@tiptap/starter-kit": "^3.19.0",

110 "@types/hast": "^3.0.4",

111 "@types/pg": "^8.18.0",

112 "@types/react-syntax-highlighter": "^15.5.13",

113 "@vscode/ripgrep": "^1.17.0",

bin/cock.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

3import { dirname, resolve } from 'path';

4import { fileURLToPath } from 'url';

5import { spawnSync } from 'child_process';

High

Child Process

Package source references child process execution.

bin/cock.mjsView on unpkg · L4

7const

dist/chunk-GFI4IHYM.mjsView file

8289prop: "value", L8290: eval(fiber) { L8291: const cont = fiber.getCont(successCont);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-GFI4IHYM.mjsView on unpkg · L8289

chrome-extension/content.jsView file

Lines 191-225javascript

191 history.replaceState = function (...args) {

192 originalReplaceState.apply(this, args);

193 checkUrlChange();

194 };

195

196 window.addEventListener('popstate', checkUrlChange);

197 window.addEventListener

dist/wsServer.mjsView file

Lines 20-60javascript

20 writeStdinToCommand

21} from "./chunk-RJMSCVG5.mjs";

22import {

23 AppError,

24 Effect_exports,

25 FSError,

26 GLOBAL_STATE_FILE,

27 NotFoundError,

28 PubSub_exports,

29 Queue_exports,

30 REVIEW_DIR,

31 REVIEW_SIGNAL_FILE,

public/tree-sitter/tree-sitter-go.wasmView file

•path = public/tree-sitter/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

public/tree-sitter/tree-sitter-go.wasmView on unpkg

kernels/jupyter_bridge.pyView file

•path = kernels/jupyter_bridge.py kind = build_helper sizeBytes = 5532 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

kernels/jupyter_bridge.pyView on unpkg

.next-prod/static/media/KaTeX_Math-Italic.5295ba48.woffView file

•path = .next-prod/static/media/KaTeX_Math-Italic.5295ba48.woff kind = high_entropy_blob sizeBytes = 18748 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next-prod/static/media/KaTeX_Math-Italic.5295ba48.woffView on unpkg

.next-prod/server/chunks/7184.jsView file

•path = .next-prod/server/chunks/7184.js kind = payload_in_excluded_dir sizeBytes = 2511676 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next-prod/server/chunks/7184.jsView on unpkg

•path = .next-prod/server/chunks/7184.js kind = oversized_source_file sizeBytes = 2511676 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

.next-prod/server/chunks/7184.jsView on unpkg