registry / @surething/cockpit / 1.0.235

@surething/cockpit@1.0.235

⚠ Under review

The open-source Claude Code GUI — an IDE-like workbench for parallel AI coding. Drive Claude (default), Codex, DeepSeek, Kimi, or local Ollama in tabs. Terminal, browser & DB bubbles, code review. Self-host on a shared dev box — a seat for every teammate.

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis flagged 24 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsObfuscatedUrlStrings

Manifest

WildcardDependency

scanned 32 file(s), 2.13 MB of source, external domains: 0.0.0.0, 127.0.0.1, api.deepseek.com, api.moonshot.cn, api.openai.com, github.com, json-schema.org

Source & flagged code

14 flagged

package.jsonView file

Lines 74-114json

74 "kernels",

75 "next.config.mjs",

76 "scripts/copy-tree-sitter-wasms.mjs",

77 "LICENSE",

78 "README.md"

79 ],

80 "scripts": {

81 "predev": "node scripts/copy-tree-sitter-wasms.mjs",

82 "dev": "COCKPIT_ENV=dev node --import tsx server.mjs",

83 "prepublishOnly": "npm run build && npm run build:server && rm -rf .next-prod/cache",

84 "prebuild": "node scripts/copy-tree-sitter-wasms.mjs",

85 "build": "next build --webpack",

86 "build:server": "tsup --config tsup.server.ts",

87 "setup": "npm run build && npm run build:server && npm link",

88 "setup-dev": "node bin/setup-dev.mjs",

89 "lint": "eslint",

90 "test": "vitest run",

91 "test:watch": "vitest",

92 "generate-icons": "node scripts/generate-icons.js",

93 "copy-wasms": "node scripts/copy-tree-sitter-wasms.mjs",

94 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L94

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L94

95 },

96 "dependencies": {

97 "@ai-sdk/openai": "^3.0.52",

98 "@anthropic-ai/claude-agent-sdk": "^0.3.179",

99 "@dagrejs/dagre": "^3.0.0",

100 "@tanstack/react-virtual": "^3.13.18",

101 "@tiptap/extension-link": "^3.19.0",

102 "@tiptap/extension-placeholder": "^3.19.0",

103 "@tiptap/extension-table": "^3.19.0",

104 "@tiptap/extension-table-cell": "^3.19.0",

105 "@tiptap/extension-table-header": "^3.19.0",

106 "@tiptap/extension-table-row": "^3.19.0",

107 "@tiptap/extension-task-item": "^3.19.0",

108 "@tiptap/extension-task-list": "^3.19.0",

109 "@tiptap/react": "^3.19.0",

110 "@tiptap/starter-kit": "^3.19.0",

111 "@types/hast": "^3.0.4",

112 "@types/pg": "^8.18.0",

113 "@types/react-syntax-highlighter": "^15.5.13",

114 "@vscode/ripgrep": "^1.17.0",

bin/cock.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

3import { dirname, resolve } from 'path';

4import { fileURLToPath } from 'url';

5import { spawnSync } from 'child_process';

High

Child Process

Package source references child process execution.

bin/cock.mjsView on unpkg · L4

7const

dist/chunk-GFI4IHYM.mjsView file

8289prop: "value", L8290: eval(fiber) { L8291: const cont = fiber.getCont(successCont);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-GFI4IHYM.mjsView on unpkg · L8289

chrome-extension/content.jsView file

Lines 191-225javascript

191 history.replaceState = function (...args) {

192 originalReplaceState.apply(this, args);

193 checkUrlChange();

194 };

195

196 window.addEventListener('popstate', checkUrlChange);

197 window.addEventListener

dist/wsServer.mjsView file

Lines 19-59javascript

19 unregisterBrowser,

20 writeStdinToCommand

21} from "./chunk-RJMSCVG5.mjs";

22import {

23 AppError,

24 Effect_exports,

25 FSError,

26 GLOBAL_STATE_FILE,

27 NotFoundError,

28 PubSub_exports,

29 Queue_exports,

30 REVIEW_DIR,

public/tree-sitter/tree-sitter-go.wasmView file

•path = public/tree-sitter/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

public/tree-sitter/tree-sitter-go.wasmView on unpkg

kernels/jupyter_bridge.pyView file

•path = kernels/jupyter_bridge.py kind = build_helper sizeBytes = 5532 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

kernels/jupyter_bridge.pyView on unpkg

.next-prod/static/media/KaTeX_Math-Italic.5295ba48.woffView file

•path = .next-prod/static/media/KaTeX_Math-Italic.5295ba48.woff kind = high_entropy_blob sizeBytes = 18748 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next-prod/static/media/KaTeX_Math-Italic.5295ba48.woffView on unpkg

.next-prod/server/chunks/7184.jsView file

•path = .next-prod/server/chunks/7184.js kind = payload_in_excluded_dir sizeBytes = 2511676 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next-prod/server/chunks/7184.jsView on unpkg

•path = .next-prod/server/chunks/7184.js kind = oversized_source_file sizeBytes = 2511676 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

.next-prod/server/chunks/7184.jsView on unpkg

dist/scheduledTasks.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @surething/cockpit@1.0.232 matchedIdentity = npm:QHN1cmV0aGluZy9jb2NrcGl0:1.0.232 similarity = 0.806 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/scheduledTasks.mjsView on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cock.mjsView file

4import { fileURLToPath } from 'url'; L5: import { spawnSync } from 'child_process'; L6:

High

Child Process

Package source references child process execution.

bin/cock.mjsView on unpkg · L4

79// highWaterMark) this truncates at exactly 16384 bytes on macOS pipes. L80: // Without this, an ollama agent capturing our stdout via execAsync L81: // receives a cleanly cut mid-string blob and then misdiagnoses it as

High

Shell

Package source references shell execution.

bin/cock.mjsView on unpkg · L79

160// ============================================ L161: const port = process.env.PORT || process.env.COCKPIT_PORT || '3457'; L162: ... L164: try { L165: const res = await fetch(`http://localhost:${port}/api/version`, { signal: AbortSignal.timeout(1000) }); L166: return res.ok; ... L171: L172: const { exec } = await import('child_process'); L173: const running = await isServerRunning();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/cock.mjsView on unpkg · L160

dist/chunk-GFI4IHYM.mjsView file

8289prop: "value", L8290: eval(fiber) { L8291: const cont = fiber.getCont(successCont);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-GFI4IHYM.mjsView on unpkg · L8289

chrome-extension/content.jsView file

211// 7. Load the automation layer (automation.js) for CLI control L212: // Loaded via import() in the isolated world (keeps chrome.runtime access) L213: // automation.js listens for cockpit:cmd postMessages, performs DOM operations, and returns results

Medium

Dynamic Require

Package source references dynamic require/import behavior.

chrome-extension/content.jsView on unpkg · L211

dist/wsServer.mjsView file

39Cross-file remote execution chain: dist/wsServer.mjs spawns dist/chunk-GFI4IHYM.mjs; helper contains network access plus dynamic code execution. L39: // src/lib/wsServer.ts L40: import { WebSocketServer } from "ws"; L41: import { parse } from "url"; ... L54: try { L55: parsed = JSON.parse(String(data)); L56: } catch { ... L80: if (ws.readyState === ws.OPEN) { L81: ws.send(JSON.stringify(msg)); L82: } ... L96: // [redacted].ts L97: var isMac = process.platform === "darwin"; L98: var isWindows = process.platform === "win32";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/wsServer.mjsView on unpkg · L39

public/tree-sitter/tree-sitter-go.wasmView file

•path = public/tree-sitter/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

public/tree-sitter/tree-sitter-go.wasmView on unpkg

kernels/jupyter_bridge.pyView file

•path = kernels/jupyter_bridge.py kind = build_helper sizeBytes = 5532 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

kernels/jupyter_bridge.pyView on unpkg

.next-prod/static/media/KaTeX_Math-Italic.5295ba48.woffView file

•path = .next-prod/static/media/KaTeX_Math-Italic.5295ba48.woff kind = high_entropy_blob sizeBytes = 18748 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next-prod/static/media/KaTeX_Math-Italic.5295ba48.woffView on unpkg

.next-prod/server/chunks/7184.jsView file

•path = .next-prod/server/chunks/7184.js kind = payload_in_excluded_dir sizeBytes = 2511676 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next-prod/server/chunks/7184.jsView on unpkg

•path = .next-prod/server/chunks/7184.js kind = oversized_source_file sizeBytes = 2511676 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

.next-prod/server/chunks/7184.jsView on unpkg

dist/scheduledTasks.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/scheduledTasks.mjsView on unpkg

Findings

1 Critical8 High8 Medium7 Low

CriticalPrevious Version Dangerous Deltadist/scheduledTasks.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/cock.mjs

HighShellbin/cock.mjs

HighSame File Env Network Executionbin/cock.mjs

HighCross File Remote Execution Contextdist/wsServer.mjs

HighShips High Entropy Blob.next-prod/static/media/KaTeX_Math-Italic.5295ba48.woff

HighPayload In Excluded Dir.next-prod/server/chunks/7184.js

HighOversized Source File.next-prod/server/chunks/7184.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirechrome-extension/content.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Modulepublic/tree-sitter/tree-sitter-go.wasm

MediumShips Build Helperkernels/jupyter_bridge.py

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/chunk-GFI4IHYM.mjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

14 flagged

package.jsonView file

Lines 74-114json

74 "kernels",

75 "next.config.mjs",

76 "scripts/copy-tree-sitter-wasms.mjs",

77 "LICENSE",

78 "README.md"

79 ],

80 "scripts": {

81 "predev": "node scripts/copy-tree-sitter-wasms.mjs",

82 "dev": "COCKPIT_ENV=dev node --import tsx server.mjs",

83 "prepublishOnly": "npm run build && npm run build:server && rm -rf .next-prod/cache",

84 "prebuild": "node scripts/copy-tree-sitter-wasms.mjs",

85 "build": "next build --webpack",

86 "build:server": "tsup --config tsup.server.ts",

87 "setup": "npm run build && npm run build:server && npm link",

88 "setup-dev": "node bin/setup-dev.mjs",

89 "lint": "eslint",

90 "test": "vitest run",

91 "test:watch": "vitest",

92 "generate-icons": "node scripts/generate-icons.js",

93 "copy-wasms": "node scripts/copy-tree-sitter-wasms.mjs",

94 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L94

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L94

95 },

96 "dependencies": {

97 "@ai-sdk/openai": "^3.0.52",

98 "@anthropic-ai/claude-agent-sdk": "^0.3.179",

99 "@dagrejs/dagre": "^3.0.0",

100 "@tanstack/react-virtual": "^3.13.18",

101 "@tiptap/extension-link": "^3.19.0",

102 "@tiptap/extension-placeholder": "^3.19.0",

103 "@tiptap/extension-table": "^3.19.0",

104 "@tiptap/extension-table-cell": "^3.19.0",

105 "@tiptap/extension-table-header": "^3.19.0",

106 "@tiptap/extension-table-row": "^3.19.0",

107 "@tiptap/extension-task-item": "^3.19.0",

108 "@tiptap/extension-task-list": "^3.19.0",

109 "@tiptap/react": "^3.19.0",

110 "@tiptap/starter-kit": "^3.19.0",

111 "@types/hast": "^3.0.4",

112 "@types/pg": "^8.18.0",

113 "@types/react-syntax-highlighter": "^15.5.13",

114 "@vscode/ripgrep": "^1.17.0",

bin/cock.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

3import { dirname, resolve } from 'path';

4import { fileURLToPath } from 'url';

5import { spawnSync } from 'child_process';

High

Child Process

Package source references child process execution.

bin/cock.mjsView on unpkg · L4

7const

dist/chunk-GFI4IHYM.mjsView file

8289prop: "value", L8290: eval(fiber) { L8291: const cont = fiber.getCont(successCont);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-GFI4IHYM.mjsView on unpkg · L8289

chrome-extension/content.jsView file

Lines 191-225javascript

191 history.replaceState = function (...args) {

192 originalReplaceState.apply(this, args);

193 checkUrlChange();

194 };

195

196 window.addEventListener('popstate', checkUrlChange);

197 window.addEventListener

dist/wsServer.mjsView file

Lines 19-59javascript

19 unregisterBrowser,

20 writeStdinToCommand

21} from "./chunk-RJMSCVG5.mjs";

22import {

23 AppError,

24 Effect_exports,

25 FSError,

26 GLOBAL_STATE_FILE,

27 NotFoundError,

28 PubSub_exports,

29 Queue_exports,

30 REVIEW_DIR,

public/tree-sitter/tree-sitter-go.wasmView file

•path = public/tree-sitter/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

public/tree-sitter/tree-sitter-go.wasmView on unpkg

kernels/jupyter_bridge.pyView file

•path = kernels/jupyter_bridge.py kind = build_helper sizeBytes = 5532 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

kernels/jupyter_bridge.pyView on unpkg

.next-prod/static/media/KaTeX_Math-Italic.5295ba48.woffView file

•path = .next-prod/static/media/KaTeX_Math-Italic.5295ba48.woff kind = high_entropy_blob sizeBytes = 18748 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next-prod/static/media/KaTeX_Math-Italic.5295ba48.woffView on unpkg

.next-prod/server/chunks/7184.jsView file

•path = .next-prod/server/chunks/7184.js kind = payload_in_excluded_dir sizeBytes = 2511676 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next-prod/server/chunks/7184.jsView on unpkg

•path = .next-prod/server/chunks/7184.js kind = oversized_source_file sizeBytes = 2511676 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

.next-prod/server/chunks/7184.jsView on unpkg

dist/scheduledTasks.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/scheduledTasks.mjsView on unpkg