registry / accelr8 / 3.0.0

accelr8@3.0.0

Collaborative ascii canvas in your terminal. Real multiplayer, live cursors, mouse-driven TUI.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 191 KB of source, external domains: api.anthropic.com, api.openai.com, registry.npmjs.org

Source & flagged code

3 flagged

dist/chunks/client-7BVK2DEW.jsView file

Lines 7-47javascript

7 VERSION,

8 decode,

9 encode

10} from "./chunk-SF6NNSYZ.js";

11import {

12 DEFAULT_MODEL,

13 addAccount,

14 defaultHandle,

15 detectClaudeCode,

16 execute,

17 loadAccounts,

18 loadTokens,

19 removeAccount,

20 saveAccounts,

21 saveToken,

22 verifyAccount

23} from "./chunk-3JNUWI22.js";

25// src/client.ts

26import tk from "terminal-kit";

27import { WebSocket } from "ws";

28import { spawn } from "node:child_process";

29import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/chunks/client-7BVK2DEW.jsView on unpkg · L27

30import { homedir } from "node:os";

31import { join } from "node:path";

33// src/logo.ts

34var LOGO = [

35 " ('-. ('-. _ .-')",

36 " ( OO ).-. _( OO) ( \\( -O )",

37 " / . --. / .-----. .-----. (,------. ,--. ,------. .-----.",

38 " | \\-. \\ ' .--./ ' .--./ | .---' | |.-') | /`. ' / .-. \\",

39 ".-'-' | | | |('-. | |('-. | | | | OO ) | / | | | \\_.' /",

40 " \\| |_.' | /_) |OO ) /_) |OO ) (| '--. | |`-' | | |_.' | / .-. '.",

41 " | .-. | || |`-'| || |`-'| | .--' (| '---.' | . '.' | | | |",

42 " | | | | (_' '--'\\ (_' '--'\\ | `---. | | | |\\ \\ \\ '-' /",

43 " `--' `--' `-----' `-----' `------' `------' `--' '--' `----''"

44];

45var LOGO_W = Math.max(...LOGO.map((l) => l.length));

47// src/chat.ts

dist/chunks/chunk-3JNUWI22.jsView file

Lines 115-155javascript

115function saveToken(projectId, agentId, token, baseDir) {

116 const tokens = loadTokens(baseDir);

117 tokens[tokenKey(projectId, agentId)] = token;

118 writeJson(path.join(dirOf(baseDir),

dist/chunks/update-UEPNGB6Y.jsView file

Lines 40-80javascript

40 }

41 if (fresh) return;

42 const ac = new AbortController();

43 const timer = setTimeout(() => ac.abort(), 2500);

Source & flagged code

3 flagged · loading source

dist/chunks/client-7BVK2DEW.jsView file

27import { WebSocket } from "ws"; L28: import { spawn } from "node:child_process"; L29: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/chunks/client-7BVK2DEW.jsView on unpkg · L27

dist/chunks/chunk-3JNUWI22.jsView file

135const a = process.env.ANTHROPIC_API_KEY?.trim(); L136: const o = process.env.OPENAI_API_KEY?.trim(); L137: if (a) out.anthropic = a; ... L148: // src/executor.ts L149: import { spawn } from "node:child_process"; L150: var ANTHROPIC_VERSION = "2023-06-01"; L151: var ANTHROPIC_BASE = "https://api.anthropic.com"; L152: var OPENAI_BASE = "https://api.openai.com";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/chunk-3JNUWI22.jsView on unpkg · L135

dist/chunks/update-UEPNGB6Y.jsView file

60const u = cachedUpdate(current, baseDir); L61: return u ? `update available \xB7 v${u.latest} \xB7 npm i -g accelr8@latest` : null; L62: } ... L66: try { L67: child = spawn("npm", ["install", "-g", "accelr8@latest", "--no-fund", "--no-audit"], { stdio: ["ignore", "pipe", "pipe"] }); L68: } catch (e) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/chunks/update-UEPNGB6Y.jsView on unpkg · L60

Findings

4 High3 Medium5 Low

HighChild Processdist/chunks/client-7BVK2DEW.js

HighShell

HighSame File Env Network Executiondist/chunks/chunk-3JNUWI22.js

HighRuntime Package Installdist/chunks/update-UEPNGB6Y.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/chunks/client-7BVK2DEW.jsView file

Lines 7-47javascript

7 VERSION,

8 decode,

9 encode

10} from "./chunk-SF6NNSYZ.js";

11import {

12 DEFAULT_MODEL,

13 addAccount,

14 defaultHandle,

15 detectClaudeCode,

16 execute,

17 loadAccounts,

18 loadTokens,

19 removeAccount,

20 saveAccounts,

21 saveToken,

22 verifyAccount

23} from "./chunk-3JNUWI22.js";

25// src/client.ts

26import tk from "terminal-kit";

27import { WebSocket } from "ws";

28import { spawn } from "node:child_process";

29import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/chunks/client-7BVK2DEW.jsView on unpkg · L27

30import { homedir } from "node:os";

31import { join } from "node:path";

33// src/logo.ts

34var LOGO = [

35 " ('-. ('-. _ .-')",

36 " ( OO ).-. _( OO) ( \\( -O )",

37 " / . --. / .-----. .-----. (,------. ,--. ,------. .-----.",

38 " | \\-. \\ ' .--./ ' .--./ | .---' | |.-') | /`. ' / .-. \\",

39 ".-'-' | | | |('-. | |('-. | | | | OO ) | / | | | \\_.' /",

40 " \\| |_.' | /_) |OO ) /_) |OO ) (| '--. | |`-' | | |_.' | / .-. '.",

41 " | .-. | || |`-'| || |`-'| | .--' (| '---.' | . '.' | | | |",

42 " | | | | (_' '--'\\ (_' '--'\\ | `---. | | | |\\ \\ \\ '-' /",

43 " `--' `--' `-----' `-----' `------' `------' `--' '--' `----''"

44];

45var LOGO_W = Math.max(...LOGO.map((l) => l.length));

47// src/chat.ts

dist/chunks/chunk-3JNUWI22.jsView file

Lines 115-155javascript

115function saveToken(projectId, agentId, token, baseDir) {

116 const tokens = loadTokens(baseDir);

117 tokens[tokenKey(projectId, agentId)] = token;

118 writeJson(path.join(dirOf(baseDir),

dist/chunks/update-UEPNGB6Y.jsView file

Lines 40-80javascript

40 }

41 if (fresh) return;

42 const ac = new AbortController();

43 const timer = setTimeout(() => ac.abort(), 2500);