registry / @umudik/lotaru / 0.2.5

@umudik/lotaru@0.2.5

Local-first task orchestration ? run shell tasks on your projects from the browser

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 21 file(s), 864 KB of source, external domains: 127.0.0.1, auth.fookiecloud.com, lotaru.fookiecloud.com, reactjs.org, www.w3.org

Source & flagged code

5 flagged

dist-server/auth/credentials.jsView file

Lines 1-24javascript

1import { createServer } from 'node:http';

2import { createHash, randomBytes } from 'node:crypto';

3import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs';

4import { join } from 'node:path';

5import { spawn } from 'node:child_process';

6import { hostname as osHostname } from 'node:os';

High

Child Process

Package source references child process execution.

dist-server/auth/credentials.jsView on unpkg · L4

7const AUTH_ISSUER = process.env['FOOKIE_AUTH_ISSUER'] ?? 'https://auth.fookiecloud.com';

8const CLIENT_ID = process.env['LOTARU_CLIENT_ID'] ?? 'lotaru';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist-server/auth/credentials.jsView on unpkg · L1

9const AGENT_REDIRECT_URI = process.env['LOTARU_AGENT_REDIRECT_URI'] ?? 'http://127.0.0.1:8743/callback';

10const AGENT_CALLBACK_PORT = Number.parseInt(process.env['LOTARU_AGENT_CALLBACK_PORT'] ?? '8743', 10);

11function credentialsPath(dataDir) {

12 return join(dataDir, 'credentials.json');

13}

14function base64url(buf) {

15 return buf.toString('base64url');

16}

17function pkcePair() {

18 const verifier = base64url(randomBytes(32));

19 const challenge = base64url(createHash('sha256').update(verifier).digest());

20 return { verifier, challenge };

21}

22function openBrowser(url) {

23 let child;

24 if (process.platform === 'win32') {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist-server/auth/credentials.jsView on unpkg · L1

dist-server/system/pickFolder.jsView file

Lines 1-32javascript

1import { execFile } from 'node:child_process';

2import { promisify } from 'node:util';

3const execFileAsync = promisify(execFile);

4async function pickFolderWindows() {

5 const script =

dist/index.jsView file

Lines 19-59javascript

19}

20function isOffline() {

21 return process.env['LOTARU_OFFLINE'] === '1';

22}

23function resolveStaticDir() {

24 if (!isOffline()) {

25 return null

Source & flagged code

5 flagged · loading source

dist-server/auth/credentials.jsView file

4import { join } from 'node:path'; L5: import { spawn } from 'node:child_process'; L6: import { hostname as osHostname } from 'node:os';

High

Child Process

Package source references child process execution.

dist-server/auth/credentials.jsView on unpkg · L4

1import { createServer } from 'node:http'; L2: import { createHash, randomBytes } from 'node:crypto'; ... L4: import { join } from 'node:path'; L5: import { spawn } from 'node:child_process'; L6: import { hostname as osHostname } from 'node:os'; L7: const AUTH_ISSUER = process.env['FOOKIE_AUTH_ISSUER'] ?? 'https://auth.fookiecloud.com'; L8: const CLIENT_ID = process.env['LOTARU_CLIENT_ID'] ?? 'lotaru';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist-server/auth/credentials.jsView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist-server/auth/credentials.jsView on unpkg · L1

dist-server/system/pickFolder.jsView file

12].join('; '); L13: const { stdout } = await execFileAsync('powershell.exe', ['-NoProfile', '-STA', '-Command', script], { windowsHide: false }); L14: const path = stdout.trim();

High

Shell

Package source references shell execution.

dist-server/system/pickFolder.jsView on unpkg · L12

dist/index.jsView file

39if (existsSync(bundled)) { L40: const mod = (await import(pathToFileURL(bundled).href)); L41: return mod.start;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L39

Findings

4 High4 Medium5 Low

HighChild Processdist-server/auth/credentials.js

HighShelldist-server/system/pickFolder.js

HighSame File Env Network Executiondist-server/auth/credentials.js

HighSandbox Evasion Gated Capabilitydist-server/auth/credentials.js

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist-server/auth/credentials.jsView file

Lines 1-24javascript

1import { createServer } from 'node:http';

2import { createHash, randomBytes } from 'node:crypto';

3import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs';

4import { join } from 'node:path';

5import { spawn } from 'node:child_process';

6import { hostname as osHostname } from 'node:os';

High

Child Process

Package source references child process execution.

dist-server/auth/credentials.jsView on unpkg · L4

7const AUTH_ISSUER = process.env['FOOKIE_AUTH_ISSUER'] ?? 'https://auth.fookiecloud.com';

8const CLIENT_ID = process.env['LOTARU_CLIENT_ID'] ?? 'lotaru';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist-server/auth/credentials.jsView on unpkg · L1

9const AGENT_REDIRECT_URI = process.env['LOTARU_AGENT_REDIRECT_URI'] ?? 'http://127.0.0.1:8743/callback';

10const AGENT_CALLBACK_PORT = Number.parseInt(process.env['LOTARU_AGENT_CALLBACK_PORT'] ?? '8743', 10);

11function credentialsPath(dataDir) {

12 return join(dataDir, 'credentials.json');

13}

14function base64url(buf) {

15 return buf.toString('base64url');

16}

17function pkcePair() {

18 const verifier = base64url(randomBytes(32));

19 const challenge = base64url(createHash('sha256').update(verifier).digest());

20 return { verifier, challenge };

21}

22function openBrowser(url) {

23 let child;

24 if (process.platform === 'win32') {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist-server/auth/credentials.jsView on unpkg · L1

dist-server/system/pickFolder.jsView file

Lines 1-32javascript

1import { execFile } from 'node:child_process';

2import { promisify } from 'node:util';

3const execFileAsync = promisify(execFile);

4async function pickFolderWindows() {

5 const script =

dist/index.jsView file

Lines 19-59javascript

19}

20function isOffline() {

21 return process.env['LOTARU_OFFLINE'] === '1';

22}

23function resolveStaticDir() {

24 if (!isOffline()) {

25 return null