registry / claude-cwc / 0.11.8

claude-cwc@0.11.8

Visual composer for Claude Code multi-agent workflows

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 69 file(s), 905 KB of source, external domains: github.com, hooks.slack.com, pro.reactflow.dev, react.dev, reactflow.dev, www.w3.org

Source & flagged code

2 flagged

dist/bin/cwc.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import * as fs from 'node:fs/promises';

3import * as path from 'node:path';

4import * as os from 'node:os';

5import * as child_process from 'node:child_process';

6import * as fsSync from 'node:fs';

7import * as readline from 'node:readline';

8import { startCwc, describeIdleStop, probePortState, portInUse, serverResponding, waitForServer, resolveOccupant, } from '../src/server/launcher.js';

9import { fileURLToPath } from 'node:url';

10import open from 'open';

11import { SERVICE_LABEL, buildServerPlist } from '../src/server/service-plist.js';

12import { runDoctor } from '../src/detection/doctor.js';

13const PORT = 3579;

14const CWC_DIR = path.join(os.homedir(), '.cwc');

15const PID_FILE = path.join(CWC_DIR, 'server.pid');

16const SKILL_VERSION_FILE = path.join(CWC_DIR, '.skill-version');

17const SKILL_DECLINED_FILE = path.join(CWC_DIR, '.skill-declined');

18const CLAUDE_SKILLS_DIR = path.join(os.homedir(), '.claude', 'skills');

19const SKILL_DEST = path.join(CLAUDE_SKILLS_DIR, 'cwc-generate-workflow', 'SKILL.md');

20const LAUNCH_AGENTS_DIR = path.join(os.homedir(), 'Library', 'LaunchAgents');

21const PLIST_PATH = path.join(LAUNCH_AGENTS_DIR, `${SERVICE_LABEL}.plist`);

22const SERVICE_LOG_DIR = path.join(CWC_DIR, 'logs');

23const SERVICE_STDOUT = path.join(SERVICE_LOG_DIR, 'server.out.log');

24const SERVICE_STDERR = path.join(SERVICE_LOG_DIR, 'server.err.log');

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/bin/cwc.jsView on unpkg · L4

•matchType = previous_version_dangerous_delta matchedPackage = claude-cwc@0.11.7 matchedIdentity = npm:Y2xhdWRlLWN3Yw:0.11.7 similarity = 0.701 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/cwc.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/bin/cwc.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/cwc.jsView on unpkg

4import * as os from 'node:os'; L5: import * as child_process from 'node:child_process'; L6: import * as fsSync from 'node:fs'; ... L13: const PORT = 3579; L14: const CWC_DIR = path.join(os.homedir(), '.cwc'); L15: const PID_FILE = path.join(CWC_DIR, 'server.pid'); ... L22: const SERVICE_LOG_DIR = path.join(CWC_DIR, 'logs'); L23: const SERVICE_STDOUT = path.join(SERVICE_LOG_DIR, 'server.out.log'); L24: const SERVICE_STDERR = path.join(SERVICE_LOG_DIR, 'server.err.log'); ... L143: async function isServiceInstalled() { L144: if (process.platform !== 'darwin') L145: return false;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/bin/cwc.jsView on unpkg · L4

Findings

1 High4 Medium6 Low

HighPrevious Version Dangerous Deltadist/bin/cwc.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/bin/cwc.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License