registry / @task-handoff/controlled-instance / 0.0.2

@task-handoff/controlled-instance@0.0.2

Prebuilt TaskHandoff controlled instance runtime.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 68 file(s), 4.78 MB of source, external domains: api.dingtalk.com, chevrotain.io, en.wikipedia.org, example.com, github.com, langium.org, www.w3.org

Source & flagged code

5 flagged

ui/assets/index-dClYfUXk.jsView file

2[process exited]`)):x.type==="error"&&(s.value="error",a?.writeln(`\r L3: [error] ${x.message}`))}),o.addEventListener("close",()=>{s.value=s.value==="exited"?"exited":"disconnected"}),o.addEventListener("error",()=>{s.value="error"}),a.onData(S=>{o?.rea... L4: https://github.com/highlightjs/highlight.js/issues/2277`),Nt=oe,ct=_e),Qe===void 0&&(Qe=!0);const An={code:ct,language:Nt};Gs("before:highlight",An);const sr=An.result?An.result:cs...

High

Child Process

Package source references child process execution.

ui/assets/index-dClYfUXk.jsView on unpkg · L2

dist/controlled-instance-cli.jsView file

Lines 1-2javascript

1"use strict";var e=require("commander"),t=require("node:fs"),s=require("node:path"),n=require("node:os"),r=require("write-file-atomic"),i=require("zod"),o=require("node:net"),a=require("node:stream"),d=require("node:stream/promises"),c=require("@fastify/static"),p=require("@fastify/websocket"),u=require("fastify"),l=require("httpxy"),m=require("node:child_process"),h=require("node:crypto"),g=require("node:events"),f=require("node-pty"),y=require("ws"),v=require("node:url");const S=process.env.TASK_HANDOFF_CONFIG||s.join(process.env.XDG_CONFIG_HOME||s.join(n.homedir(),".config"),"task-handoff", ...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/controlled-instance-cli.jsView on unpkg · L1

Long lines were clipped for display.

dist/receiver-ink.mjsView file

Lines 1-2javascript

1import{spawn as e}from"node:child_process";import{Writable as t,PassThrough as n}from"node:stream";import s,{useCallback as i,useEffect as r,useMemo as o,useRef as a,useState as d}

ui/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = ui/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

ui/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

Source & flagged code

5 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code