registry / botmux / 3.23.1

botmux@3.23.1

⚠ Under review

Bridge between IM platforms and AI coding CLIs — one topic, one CLI session with live streaming

Static Scan Results

scanned 22d ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 33.7 KB of source, external domains: raw.githubusercontent.com

Source & flagged code

2 flagged

package.jsonView file

Lines 42-82json

42 "test:all": "vitest run",

43 "test:e2e": "vitest run --project e2e",

44 "test:bun": "node scripts/run-bun-tests.mjs",

45 "test:bun:self-check": "node scripts/run-bun-tests.mjs --self-check",

46 "test:bench": "tsx scripts/bench-tests.ts",

47 "test:codex": "vitest run --project e2e test/codex-input.e2e.ts",

48 "test:gemini": "vitest run --project e2e test/gemini-input.e2e.ts",

49 "test:agy": "vitest run --project e2e test/agy-input.e2e.ts",

50 "bench:resource": "node --expose-gc --import tsx scripts/bench-resource.ts",

51 "test:e2e-browser:setup": "tsx test/e2e-browser/setup-login.ts",

52 "test:e2e-browser": "tsx scripts/run-e2e.ts",

53 "report:dashboard": "tsx scripts/report-dashboard.ts",

54 "desktop:bundle": "node scripts/build-desktop-icons.mjs && esbuild src/desktop/main.ts --bundle --outfile=dist/desktop/main.cjs --platform=node --format=cjs --external:electron && esbuild src/desktop/preload.ts --bundle --outfile=dist/desktop/preload.cjs --platform=node --format=cjs --external:electron && esbuild src/desktop/renderer/app.ts --bundle --outfile=dist/desktop/renderer/app.js --platform=browser --format=iife && cp src/desktop/renderer/index.html dist/desktop/renderer/index.html && cp src/desktop/renderer/style.css dist/desktop/renderer/style.css && cp -R src/desktop/assets dist ...

55 "desktop:runtime": "node scripts/prepare-desktop-runtime.mjs",

56 "desktop:smoke": "tsx scripts/desktop-smoke.ts",

57 "desktop:install:local": "bash src/desktop/install-local.sh",

58 "desktop:dev": "bun run build && bun run desktop:bundle && electron dist/desktop/main.cjs",

59 "desktop:pack": "bun run desktop:pack:local",

60 "desktop:pack:local": "node scripts/desktop-pack-local.mjs",

61 "prepublishOnly": "npm run build",

62 "postinstall": "node scripts/postinstall-bin.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L62

63 "prepare": "git config core.hooksPath scripts/git-hooks 2>/dev/null || true"

64 },

65 "dependencies": {

66 "@larksuiteoapi/node-sdk": "^1.64.0",

67 "@modelcontextprotocol/sdk": "^1.29.0",

68 "@xterm/addon-unicode11": "^0.9.0",

69 "@xterm/headless": "^6.0.0",

70 "croner": "^10.0.1",

71 "dotenv": "^17.3.1",

72 "markdown-it": "^14.1.1",

73 "proxy-agent": "^6.5.0",

74 "qrcode-terminal": "^0.12.0",

75 "react": "^19.2.7",

76 "react-dom": "^19.2.7",

77 "ws": "^8.19.0",

78 "yaml": "^2.9.0",

79 "zod": "^3.23.0"

80 },

81 "optionalDependencies": {

82 "@napi-rs/canvas": "^0.1.65",

Long lines were clipped for display.

scripts/install-path-entry.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/install-path-entry.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bin.mjs

botmux@3.23.1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code