registry / claude-basecamp / 0.4.0

claude-basecamp@0.4.0

⚠ Under review

Zero-config localhost dashboard for Claude Code — sessions, agents, usage, tasks, and connector management across Desktop, Terminal, and API.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 139 KB of source, external domains: 127.0.0.1, api.telegram.org, discord.com, hooks.slack.com

Source & flagged code

2 flagged

public/app.jsView file

Lines 66-106javascript

66}

67const fmtDuration = (start, end) => {

68 if (!start) return '—'

69 const s = Math.round(((end || Date.now()) - start) / 1000)

70 return s < 60 ? `${s}s` : `${Math.floor(s / 60)}m ${s % 60}s`

71}

72const esc = (s) =>

73 String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&', '<': '<', '>': '>', '"': '"', "'": ''' })[c])

74const repoName = (p) => String(p || '').split('/').filter(Boolean).pop() || p

75const shortModel = (m) => m.replace(/^claude-/, '').replace(/-\d{8}$/, '')

77function md(text) {

78 let html = esc(text)

79 html = html.replace(/```(\w*)\n([\s\S]*?)```/g, (_, _lang, code) => `<pre>${code}</pre>`)

80 html = html.replace(/`([^`\n]+)`/g, '<code>$1</code>')

81 html = html.replace(/\*\*([^*\n]+)\*\*/g, '$1')

82 html = html.replace(/(https?:\/\/[^\s<)]+)/g, '<a href="$1" target="_blank" rel="noopener">$1</a>')

83 return html

84}

86async function api(path, options = {}) {

87 const res = await fetch(path, {

88 ...options,

89 headers: options.body ? { 'Content-Type': 'application/json' } : {},

90 body: options.body ? JSON.stringify(options.body) : undefined,

91 })

92 const data = await res.json().catch(() => ({}))

93 if (!res.ok) throw new Error(data.error || res.statusText)

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

public/app.jsView on unpkg · L86

94 return data

95}

97const statusChip = (status) =>

98 ({

99 running: `running`,

100 succeeded: `${icon('check', 12)}done`,

101 failed: `${icon('x', 12)}failed`,

102 stopped: `stopped`,

103 })[status] || `${esc(status)}`

104

105/** Animated count-up for stat numbers. */

106function countUp(el, target, format = fmt.format.bind(fmt)) {

src/lib/notify.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process'

2import { getSettings } from './settings.js'

4const FETCH_TIMEOUT_MS = 8000

6function post(url, body) {

7 return fetch

Source & flagged code

2 flagged · loading source

public/app.jsView file

86async function api(path, options = {}) { L87: const res = await fetch(path, { L88: ...options, L89: headers: options.body ? { 'Content-Type': 'application/json' } : {}, L90: body: options.body ? JSON.stringify(options.body) : undefined, L91: }) L92: const data = await res.json().catch(() => ({})) L93: if (!res.ok) throw new Error(data.error || res.statusText) ... L886: const hookUrl = `${location.origin}/api/hooks/${el.dataset.hook}` L887: await navigator.clipboard.writeText(`curl -X POST ${hookUrl}`) L888: el.textContent = 'Copied'

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

public/app.jsView on unpkg · L86

src/lib/notify.jsView file

1import { spawn } from 'node:child_process' L2: import { getSettings } from './settings.js' ... L6: function post(url, body) { L7: return fetch(url, { L8: method: 'POST', L9: headers: { 'Content-Type': 'application/json' }, L10: body: JSON.stringify(body), L11: signal: AbortSignal.timeout(FETCH_TIMEOUT_MS), ... L51: } L52: if (settings.macosNotifications && process.platform === 'darwin') { L53: attempts.push(

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/lib/notify.jsView on unpkg · L1

Findings

1 Critical1 High3 Medium4 Low

CriticalCredential Exfiltrationpublic/app.js

HighSandbox Evasion Gated Capabilitysrc/lib/notify.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

public/app.jsView file

Lines 66-106javascript

66}

67const fmtDuration = (start, end) => {

68 if (!start) return '—'

69 const s = Math.round(((end || Date.now()) - start) / 1000)

70 return s < 60 ? `${s}s` : `${Math.floor(s / 60)}m ${s % 60}s`

71}

72const esc = (s) =>

73 String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&', '<': '<', '>': '>', '"': '"', "'": ''' })[c])

74const repoName = (p) => String(p || '').split('/').filter(Boolean).pop() || p

75const shortModel = (m) => m.replace(/^claude-/, '').replace(/-\d{8}$/, '')

77function md(text) {

78 let html = esc(text)

79 html = html.replace(/```(\w*)\n([\s\S]*?)```/g, (_, _lang, code) => `<pre>${code}</pre>`)

80 html = html.replace(/`([^`\n]+)`/g, '<code>$1</code>')

81 html = html.replace(/\*\*([^*\n]+)\*\*/g, '$1')

82 html = html.replace(/(https?:\/\/[^\s<)]+)/g, '<a href="$1" target="_blank" rel="noopener">$1</a>')

83 return html

84}

86async function api(path, options = {}) {

87 const res = await fetch(path, {

88 ...options,

89 headers: options.body ? { 'Content-Type': 'application/json' } : {},

90 body: options.body ? JSON.stringify(options.body) : undefined,

91 })

92 const data = await res.json().catch(() => ({}))

93 if (!res.ok) throw new Error(data.error || res.statusText)

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

public/app.jsView on unpkg · L86

94 return data

95}

97const statusChip = (status) =>

98 ({

99 running: `running`,

100 succeeded: `${icon('check', 12)}done`,

101 failed: `${icon('x', 12)}failed`,

102 stopped: `stopped`,

103 })[status] || `${esc(status)}`

104

105/** Animated count-up for stat numbers. */

106function countUp(el, target, format = fmt.format.bind(fmt)) {

src/lib/notify.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process'

2import { getSettings } from './settings.js'

4const FETCH_TIMEOUT_MS = 8000

6function post(url, body) {

7 return fetch