registry / accelr8 / 3.0.1

accelr8@3.0.1

Collaborative ascii canvas in your terminal. Real multiplayer, live cursors, mouse-driven TUI.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 205 KB of source, external domains: api.anthropic.com, api.openai.com, registry.npmjs.org

Source & flagged code

3 flagged

dist/chunks/chunk-3JNUWI22.jsView file

Lines 115-168javascript

115function saveToken(projectId, agentId, token, baseDir) {

116 const tokens = loadTokens(baseDir);

117 tokens[tokenKey(projectId, agentId)] = token;

118 writeJson(path.join(dirOf(baseDir), TOKENS_FILE), tokens);

119}

120function detectClaudeCode() {

121 const dirs = (process.env.PATH ?? "").split(path.delimiter).filter(Boolean);

122 for (const dir of dirs) {

123 const candidate = path.join(dir, "claude");

124 try {

125 if (!fs.existsSync(candidate)) continue;

126 fs.accessSync(candidate, fs.constants.X_OK);

127 if (fs.statSync(candidate).isFile()) return { available: true, path: candidate };

128 } catch {

129 }

130 }

131 return { available: false };

132}

133function detectEnvKeys() {

134 const out = {};

135 const a = process.env.ANTHROPIC_API_KEY?.trim();

136 const o = process.env.OPENAI_API_KEY?.trim();

137 if (a) out.anthropic = a;

138 if (o) out.openai = o;

139 return out;

140}

141function defaultHandle(userName, provider) {

142 const suffix = "s" + (provider === "anthropic" ? "claude" : "gpt");

143 let name = userName.toLowerCase().replace(/[^a-z0-9-]/g, "").replace(/^-+/, "");

144 if (!name) name = "my";

145 return name.slice(0, 20 - suffix.length) + suffix;

146}

147

148// src/executor.ts

149import { spawn } from "node:child_process";

150var ANTHROPIC_VERSION = "2023-06-01";

High

Child Process

Package source references child process execution.

dist/chunks/chunk-3JNUWI22.jsView on unpkg · L148

151var ANTHROPIC_BASE = "https://api.anthropic.com";

152var OPENAI_BASE = "https://api.openai.com";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/chunk-3JNUWI22.jsView on unpkg · L135

153var DELTA_MS = 100;

154var DELTA_CHARS = 800;

155var RETRY_CAP_MS = 1e4;

156var STDERR_TAIL = 500;

157var Run = class {

158 constructor(cb, secret) {

159 this.cb = cb;

160 this.secret = secret;

161 }

162 cb;

163 secret;

164 ac = new AbortController();

165 aborted = false;

166 settled = false;

167 buf = "";

168 timer = null;

dist/chunks/update-UEPNGB6Y.jsView file

Lines 40-80javascript

40 }

41 if (fresh) return;

42 const ac = new AbortController();

43 const timer = setTimeout(() => ac.abort(), 2500);

Source & flagged code

3 flagged · loading source

dist/chunks/chunk-3JNUWI22.jsView file

148// src/executor.ts L149: import { spawn } from "node:child_process"; L150: var ANTHROPIC_VERSION = "2023-06-01";

High

Child Process

Package source references child process execution.

dist/chunks/chunk-3JNUWI22.jsView on unpkg · L148

135const a = process.env.ANTHROPIC_API_KEY?.trim(); L136: const o = process.env.OPENAI_API_KEY?.trim(); L137: if (a) out.anthropic = a; ... L148: // src/executor.ts L149: import { spawn } from "node:child_process"; L150: var ANTHROPIC_VERSION = "2023-06-01"; L151: var ANTHROPIC_BASE = "https://api.anthropic.com"; L152: var OPENAI_BASE = "https://api.openai.com";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/chunk-3JNUWI22.jsView on unpkg · L135

dist/chunks/update-UEPNGB6Y.jsView file

60const u = cachedUpdate(current, baseDir); L61: return u ? `update available \xB7 v${u.latest} \xB7 npm i -g accelr8@latest` : null; L62: } ... L66: try { L67: child = spawn("npm", ["install", "-g", "accelr8@latest", "--no-fund", "--no-audit"], { stdio: ["ignore", "pipe", "pipe"] }); L68: } catch (e) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/chunks/update-UEPNGB6Y.jsView on unpkg · L60

Findings

4 High3 Medium6 Low

HighChild Processdist/chunks/chunk-3JNUWI22.js

HighShell

HighSame File Env Network Executiondist/chunks/chunk-3JNUWI22.js

HighRuntime Package Installdist/chunks/update-UEPNGB6Y.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/chunks/chunk-3JNUWI22.jsView file

Lines 115-168javascript

115function saveToken(projectId, agentId, token, baseDir) {

116 const tokens = loadTokens(baseDir);

117 tokens[tokenKey(projectId, agentId)] = token;

118 writeJson(path.join(dirOf(baseDir), TOKENS_FILE), tokens);

119}

120function detectClaudeCode() {

121 const dirs = (process.env.PATH ?? "").split(path.delimiter).filter(Boolean);

122 for (const dir of dirs) {

123 const candidate = path.join(dir, "claude");

124 try {

125 if (!fs.existsSync(candidate)) continue;

126 fs.accessSync(candidate, fs.constants.X_OK);

127 if (fs.statSync(candidate).isFile()) return { available: true, path: candidate };

128 } catch {

129 }

130 }

131 return { available: false };

132}

133function detectEnvKeys() {

134 const out = {};

135 const a = process.env.ANTHROPIC_API_KEY?.trim();

136 const o = process.env.OPENAI_API_KEY?.trim();

137 if (a) out.anthropic = a;

138 if (o) out.openai = o;

139 return out;

140}

141function defaultHandle(userName, provider) {

142 const suffix = "s" + (provider === "anthropic" ? "claude" : "gpt");

143 let name = userName.toLowerCase().replace(/[^a-z0-9-]/g, "").replace(/^-+/, "");

144 if (!name) name = "my";

145 return name.slice(0, 20 - suffix.length) + suffix;

146}

147

148// src/executor.ts

149import { spawn } from "node:child_process";

150var ANTHROPIC_VERSION = "2023-06-01";

High

Child Process

Package source references child process execution.

dist/chunks/chunk-3JNUWI22.jsView on unpkg · L148

151var ANTHROPIC_BASE = "https://api.anthropic.com";

152var OPENAI_BASE = "https://api.openai.com";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/chunk-3JNUWI22.jsView on unpkg · L135

153var DELTA_MS = 100;

154var DELTA_CHARS = 800;

155var RETRY_CAP_MS = 1e4;

156var STDERR_TAIL = 500;

157var Run = class {

158 constructor(cb, secret) {

159 this.cb = cb;

160 this.secret = secret;

161 }

162 cb;

163 secret;

164 ac = new AbortController();

165 aborted = false;

166 settled = false;

167 buf = "";

168 timer = null;

dist/chunks/update-UEPNGB6Y.jsView file

Lines 40-80javascript

40 }

41 if (fresh) return;

42 const ac = new AbortController();

43 const timer = setTimeout(() => ac.abort(), 2500);