registry / @wolpertingerlabs/callboard / 1.0.0-alpha.38

@wolpertingerlabs/callboard@1.0.0-alpha.38

A web-based control panel for managing Claude Code sessions, autonomous agents, and multi-agent workflows

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

GitDependency

scanned 171 file(s), 2.45 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.openai.com, chatgpt.com, claude.ai, console.anthropic.com, developers.cloudflare.com, github.com, openrouter.ai, platform.openai.com, proxy.example.com, reactjs.org, registry.npmjs.org, support.anthropic.com, www.w3.org

Source & flagged code

2 flagged

bin/callboard.jsView file

Lines 4-44javascript

4// Entry point for the `callboard` command after global npm install.

5// Provides daemon management, log viewing, config introspection, and

6// a first-run setup experience — all with zero extra dependencies.

7// ─────────────────────────────────────────────────────────────────────

9import { parseArgs } from "node:util";

10import { spawn } from "node:child_process";

11import { existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync, openSync } from "node:fs";

12import { stat } from "node:fs/promises";

13import { join, resolve, dirname } from "node:path";

14import { fileURLToPath } from "node:url";

15import { createRequire } from "node:module";

16import { createInterface } from "node:readline";

18// ── Paths & constants ────────────────────────────────────────────────

19const __filename = fileURLToPath(import.meta.url);

20const __dirname = dirname(__filename);

21const PKG_ROOT = resolve(__dirname, "..");

22const SERVER_ENTRY = join(PKG_ROOT, "backend/dist/index.js");

24// Import shared path utilities from compiled backend

25const { DATA_DIR, ENV_FILE, ensureDataDir, ensureEnvFile } = await import(join(PKG_ROOT, "backend/dist/utils/paths.js"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/callboard.jsView on unpkg · L24

27// Import dotenv for .env parsing (already a project dependency)

28const require = createRequire(import.meta.url);

29const dotenv = require("dotenv");

31const PID_FILE = join(DATA_DIR, "callboard.pid");

32const LOG_DIR = join(DATA_DIR, "logs");

33const LOG_FILE = join(LOG_DIR, "callboard.log");

34const VERSION_CACHE_FILE = join(DATA_DIR, "version-check.json");

35const VERSION_CHECK_TTL = 4 * 60 * 60 * 1000; // 4 hours

36const DEFAULT_PORT = 8000;

38// Read version from package.json

39const pkgJson = JSON.parse(readFileSync(join(PKG_ROOT, "package.json"), "utf-8"));

40const VERSION = pkgJson.version;

41const PKG_NAME = pkgJson.name;

43// ── Argument parsing ─────────────────────────────────────────────────

44const rawArgs = process.argv.slice(2);

backend/dist/services/claude.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @wolpertingerlabs/callboard@1.0.0-alpha.36 matchedIdentity = npm:[redacted]:1.0.0-alpha.36 similarity = 0.892 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

backend/dist/services/claude.jsView on unpkg

Source & flagged code

2 flagged · loading source

bin/callboard.jsView file

24// Import shared path utilities from compiled backend L25: const { DATA_DIR, ENV_FILE, ensureDataDir, ensureEnvFile } = await import(join(PKG_ROOT, "backend/dist/utils/paths.js")); L26:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/callboard.jsView on unpkg · L24

backend/dist/services/claude.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

backend/dist/services/claude.jsView on unpkg

Findings

1 High5 Medium5 Low

HighPrevious Version Dangerous Deltabackend/dist/services/claude.js

MediumDynamic Requirebin/callboard.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumGit Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

bin/callboard.jsView file

Lines 4-44javascript

4// Entry point for the `callboard` command after global npm install.

5// Provides daemon management, log viewing, config introspection, and

6// a first-run setup experience — all with zero extra dependencies.

9import { parseArgs } from "node:util";

10import { spawn } from "node:child_process";

11import { existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync, openSync } from "node:fs";

12import { stat } from "node:fs/promises";

13import { join, resolve, dirname } from "node:path";

14import { fileURLToPath } from "node:url";

15import { createRequire } from "node:module";

16import { createInterface } from "node:readline";

18// ── Paths & constants ────────────────────────────────────────────────

19const __filename = fileURLToPath(import.meta.url);

20const __dirname = dirname(__filename);

21const PKG_ROOT = resolve(__dirname, "..");

22const SERVER_ENTRY = join(PKG_ROOT, "backend/dist/index.js");

24// Import shared path utilities from compiled backend

25const { DATA_DIR, ENV_FILE, ensureDataDir, ensureEnvFile } = await import(join(PKG_ROOT, "backend/dist/utils/paths.js"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/callboard.jsView on unpkg · L24

27// Import dotenv for .env parsing (already a project dependency)

28const require = createRequire(import.meta.url);

29const dotenv = require("dotenv");

31const PID_FILE = join(DATA_DIR, "callboard.pid");

32const LOG_DIR = join(DATA_DIR, "logs");

33const LOG_FILE = join(LOG_DIR, "callboard.log");

34const VERSION_CACHE_FILE = join(DATA_DIR, "version-check.json");

35const VERSION_CHECK_TTL = 4 * 60 * 60 * 1000; // 4 hours

36const DEFAULT_PORT = 8000;

38// Read version from package.json

39const pkgJson = JSON.parse(readFileSync(join(PKG_ROOT, "package.json"), "utf-8"));

40const VERSION = pkgJson.version;

41const PKG_NAME = pkgJson.name;

43// ── Argument parsing ─────────────────────────────────────────────────

44const rawArgs = process.argv.slice(2);

backend/dist/services/claude.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

backend/dist/services/claude.jsView on unpkg