registry / accelr8 / 3.8.0

accelr8@3.8.0

Collaborative ascii canvas in your terminal. Real multiplayer, live cursors, mouse-driven TUI.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 991 KB of source, external domains: accelr8-canvas.patonchain.workers.dev, api.anthropic.com, api.openai.com, registry.npmjs.org

Source & flagged code

4 flagged

dist/chunks/app-DCVVDS5A.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

2import {

3 detectVoiceTools,

4 tzCity,

5 tzToCoords

6} from "./chunk-HY6ULYGH.js";

7import {

8 DEFAULT_SERVER

9} from "./chunk-YUZORFN4.js";

11// src/radio/app.ts

12import tk from "terminal-kit";

13import { WebSocket } from "ws";

15// src/radio/asciivideo.ts

16import { spawn } from "node:child_process";

17var RAMPS = {

High

Child Process

Package source references child process execution.

dist/chunks/app-DCVVDS5A.jsView on unpkg · L15

18 broadcast: " .'`^\",:;Il!i~+_-?][}{1)(|/tfjrxnuvczXYUJCLQ0OZmwqpdbkhao*#MW&8%B@$",

19 blocks: " \u2591\u2592\u2593\u2588",

20 classic: " .:-=+*#%@"

21};

22function xterm256(r, g, b) {

23 const max = Math.max(r, g, b), min = Math.min(r, g, b);

24 if (max - min < 12) {

25 if (max < 8) return 16;

26 if (max > 248) return 231;

27 return 232 + Math.min(23, Math.round((max - 8) / 230 * 23));

28 }

29 const q = (v) => Math.round(v / 255 * 5);

30 return 16 + 36 * q(r) + 6 * q(g) + q(b);

31}

32function frameToCells(rgb, w, h, ramp2 = RAMPS.broadcast) {

33 const out = new Array(w * h);

34 const last = ramp2.length - 1;

35 for (let i = 0, p = 0; i < w * h; i++, p += 3) {

dist/chunks/client-Y2PNGYRP.jsView file

875{ file: "konsole", mk: (c) => ["-e", "sh", "-c", c] }, L876: { file: "xfce4-terminal", mk: (c) => ["-e", `sh -c '${c}'`] }, L877: { file: "alacritty", mk: (c) => ["-e", "sh", "-c", c] },

High

Shell

Package source references shell execution.

dist/chunks/client-Y2PNGYRP.jsView on unpkg · L875

dist/chunks/chunk-3JNUWI22.jsView file

Lines 115-155javascript

115function saveToken(projectId, agentId, token, baseDir) {

116 const tokens = loadTokens(baseDir);

117 tokens[tokenKey(projectId, agentId)] = token;

118 writeJson(path.join(dirOf(baseDir),

dist/chunks/update-UEPNGB6Y.jsView file

Lines 40-80javascript

40 }

41 if (fresh) return;

42 const ac = new AbortController();

43 const timer = setTimeout(() => ac.abort(), 2500);

Source & flagged code

4 flagged · loading source

dist/chunks/app-DCVVDS5A.jsView file

15// src/radio/asciivideo.ts L16: import { spawn } from "node:child_process"; L17: var RAMPS = {

High

Child Process

Package source references child process execution.

dist/chunks/app-DCVVDS5A.jsView on unpkg · L15

dist/chunks/client-Y2PNGYRP.jsView file

875{ file: "konsole", mk: (c) => ["-e", "sh", "-c", c] }, L876: { file: "xfce4-terminal", mk: (c) => ["-e", `sh -c '${c}'`] }, L877: { file: "alacritty", mk: (c) => ["-e", "sh", "-c", c] },

High

Shell

Package source references shell execution.

dist/chunks/client-Y2PNGYRP.jsView on unpkg · L875

dist/chunks/chunk-3JNUWI22.jsView file

135const a = process.env.ANTHROPIC_API_KEY?.trim(); L136: const o = process.env.OPENAI_API_KEY?.trim(); L137: if (a) out.anthropic = a; ... L148: // src/executor.ts L149: import { spawn } from "node:child_process"; L150: var ANTHROPIC_VERSION = "2023-06-01"; L151: var ANTHROPIC_BASE = "https://api.anthropic.com"; L152: var OPENAI_BASE = "https://api.openai.com";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/chunk-3JNUWI22.jsView on unpkg · L135

dist/chunks/update-UEPNGB6Y.jsView file

60const u = cachedUpdate(current, baseDir); L61: return u ? `update available \xB7 v${u.latest} \xB7 npm i -g accelr8@latest` : null; L62: } ... L66: try { L67: child = spawn("npm", ["install", "-g", "accelr8@latest", "--no-fund", "--no-audit"], { stdio: ["ignore", "pipe", "pipe"] }); L68: } catch (e) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/chunks/update-UEPNGB6Y.jsView on unpkg · L60

Findings

4 High4 Medium6 Low

HighChild Processdist/chunks/app-DCVVDS5A.js

HighShelldist/chunks/client-Y2PNGYRP.js

HighSame File Env Network Executiondist/chunks/chunk-3JNUWI22.js

HighRuntime Package Installdist/chunks/update-UEPNGB6Y.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/chunks/app-DCVVDS5A.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

2import {

3 detectVoiceTools,

4 tzCity,

5 tzToCoords

6} from "./chunk-HY6ULYGH.js";

7import {

8 DEFAULT_SERVER

9} from "./chunk-YUZORFN4.js";

11// src/radio/app.ts

12import tk from "terminal-kit";

13import { WebSocket } from "ws";

15// src/radio/asciivideo.ts

16import { spawn } from "node:child_process";

17var RAMPS = {

High

Child Process

Package source references child process execution.

dist/chunks/app-DCVVDS5A.jsView on unpkg · L15

18 broadcast: " .'`^\",:;Il!i~+_-?][}{1)(|/tfjrxnuvczXYUJCLQ0OZmwqpdbkhao*#MW&8%B@$",

19 blocks: " \u2591\u2592\u2593\u2588",

20 classic: " .:-=+*#%@"

21};

22function xterm256(r, g, b) {

23 const max = Math.max(r, g, b), min = Math.min(r, g, b);

24 if (max - min < 12) {

25 if (max < 8) return 16;

26 if (max > 248) return 231;

27 return 232 + Math.min(23, Math.round((max - 8) / 230 * 23));

28 }

29 const q = (v) => Math.round(v / 255 * 5);

30 return 16 + 36 * q(r) + 6 * q(g) + q(b);

31}

32function frameToCells(rgb, w, h, ramp2 = RAMPS.broadcast) {

33 const out = new Array(w * h);

34 const last = ramp2.length - 1;

35 for (let i = 0, p = 0; i < w * h; i++, p += 3) {

dist/chunks/client-Y2PNGYRP.jsView file

875{ file: "konsole", mk: (c) => ["-e", "sh", "-c", c] }, L876: { file: "xfce4-terminal", mk: (c) => ["-e", `sh -c '${c}'`] }, L877: { file: "alacritty", mk: (c) => ["-e", "sh", "-c", c] },

High

Shell

Package source references shell execution.

dist/chunks/client-Y2PNGYRP.jsView on unpkg · L875

dist/chunks/chunk-3JNUWI22.jsView file

Lines 115-155javascript

115function saveToken(projectId, agentId, token, baseDir) {

116 const tokens = loadTokens(baseDir);

117 tokens[tokenKey(projectId, agentId)] = token;

118 writeJson(path.join(dirOf(baseDir),

dist/chunks/update-UEPNGB6Y.jsView file

Lines 40-80javascript

40 }

41 if (fresh) return;

42 const ac = new AbortController();

43 const timer = setTimeout(() => ac.abort(), 2500);