registry / @task-handoff/controlled-instance / 0.0.1

@task-handoff/controlled-instance@0.0.1

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 16 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 68 file(s), 5.21 MB of source, external domains: 127.0.0.1, api.dingtalk.com, chevrotain.io, en.wikipedia.org, example.com, github.com, langium.org, task-handoff.local, www.w3.org

Source & flagged code

6 flagged

ui/assets/index-dClYfUXk.jsView file

2[process exited]`)):x.type==="error"&&(s.value="error",a?.writeln(`\r L3: [error] ${x.message}`))}),o.addEventListener("close",()=>{s.value=s.value==="exited"?"exited":"disconnected"}),o.addEventListener("error",()=>{s.value="error"}),a.onData(S=>{o?.rea... L4: https://github.com/highlightjs/highlight.js/issues/2277`),Nt=oe,ct=_e),Qe===void 0&&(Qe=!0);const An={code:ct,language:Nt};Gs("before:highlight",An);const sr=An.result?An.result:cs...

High

Child Process

Package source references child process execution.

ui/assets/index-dClYfUXk.jsView on unpkg · L2

dist/controlled-instance-cli.jsView file

8var zod = require('zod'); L9: var net = require('node:net'); L10: var node_stream = require('node:stream'); ... L15: var httpxy = require('httpxy'); L16: var node_child_process = require('node:child_process'); L17: var crypto = require('node:crypto'); ... L22: L23: const CONFIG_PATH = process.env.TASK_HANDOFF_CONFIG || L24: path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config"), "task-handoff", "config.json");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/controlled-instance-cli.jsView on unpkg · L8

2L3: var commander = require('commander'); L4: var fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/controlled-instance-cli.jsView on unpkg · L2

11345async function runReceiver(options) { L11346: const importModule = new Function("specifier", "return import(specifier)"); L11347: const { runReceiverInk } = await importModule(node_url.pathToFileURL(path.join(__dirname, "receiver-ink.mjs")).href);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/controlled-instance-cli.jsView on unpkg · L11345

dist/receiver-ink.mjsView file

1import { spawn } from 'node:child_process'; L2: import { Writable, PassThrough } from 'node:stream'; ... L10: import telegramifyMarkdown from 'telegramify-markdown'; L11: import net from 'node:net'; L12: import crypto, { randomUUID, createHash } from 'node:crypto'; ... L25: L26: const CONFIG_PATH = process.env.TASK_HANDOFF_CONFIG || L27: path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config"), "task-handoff", "config.json"); L28: const SettingsSchema = z.record(z.string(), z.unknown()); ... L30: try { L31: return SettingsSchema.parse(JSON.parse(fs.readFileSync(CONFIG_PATH, "utf8"))); L32: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/receiver-ink.mjsView on unpkg · L1

ui/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = ui/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

ui/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

Source & flagged code

6 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code