registry / clideck / 1.31.25

clideck@1.31.25

One screen for all your AI coding agents — run, monitor, and manage multiple CLI agents from a single browser tab

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 58 file(s), 516 KB of source, external domains: 127.0.0.1, www.w3.org

Source & flagged code

8 flagged

handlers.jsView file

Lines 1-22javascript

1const { readFileSync, writeFileSync, mkdirSync, existsSync, copyFileSync, unlinkSync } = require('fs');

2const { join, dirname } = require('path');

3const { execFileSync, execFile } = require('child_process');

4const os = require('os');

High

Child Process

Package source references child process execution.

handlers.jsView on unpkg · L2

5const config = require('./config');

6const sessions = require('./sessions');

7const themes = require('./themes');

8const presets = JSON.parse(readFileSync(join(__dirname, 'agent-presets.json'), 'utf8'));

9const { listDirs, binName, defaultShell } = require('./utils');

10const { presetForCommand: findPresetForCommand } = require('./preset-utils');

11const { PORT } = require('./runtime');

12for (const p of presets) if (p.presetId === 'shell') p.command = defaultShell;

13function isPresetEnabled(preset) {

14 if (!preset?.enabledIfEnv) return true;

15 const value = String(process.env[preset.enabledIfEnv] || '').trim().toLowerCase();

16 return value === '1' || value === 'true' || value === 'yes';

17}

18function clientPresets() {

19 return presets.filter(isPresetEnabled);

20}

21function filterClientCommands(commands) {

22 const allowedPresetIds = new Set(clientPresets().map(p => p.presetId));

server.jsView file

Lines 16-56javascript

17// --- Self-update check (runs before server starts) ---

18const currentVersion = require('./package.json').version;

19const { execFile, execSync } = require('child_process');

20const shellOpt = process.platform === 'win32'

preset-utils.jsView file

Lines 1-14javascript

1const { binName } = require('./utils');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

preset-utils.jsView on unpkg · L1

3function presetForCommand(cmd, presets, options = {}) {

4 const usePresetId =

plugins/voice-input/python/worker.pyView file

•path = plugins/voice-input/python/worker.py kind = build_helper sizeBytes = 3923 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/voice-input/python/worker.pyView on unpkg

plugins/voice-input/python/mel_filters.npzView file

•path = plugins/voice-input/python/mel_filters.npz kind = compressed_blob sizeBytes = 2240 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

plugins/voice-input/python/mel_filters.npzView on unpkg

•path = plugins/voice-input/python/mel_filters.npz kind = nested_archive_needs_inspection sizeBytes = 2240 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

plugins/voice-input/python/mel_filters.npzView on unpkg

public/fx/space-idle.mp3View file

•path = public/fx/space-idle.mp3 kind = high_entropy_blob sizeBytes = 47276 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/fx/space-idle.mp3View on unpkg

Source & flagged code

8 flagged · loading source

handlers.jsView file

2const { join, dirname } = require('path'); L3: const { execFileSync, execFile } = require('child_process'); L4: const os = require('os');

High

Child Process

Package source references child process execution.

handlers.jsView on unpkg · L2

server.jsView file

36try { L37: execSync('npm install -g clideck', { stdio: 'inherit', shell: true }); L38: console.log('\n \x1b[38;5;44mUpdated to v' + latest + '. Restarting...\x1b[0m\n');

High

Shell

Package source references shell execution.

server.jsView on unpkg · L36

36try { L37: execSync('npm install -g clideck', { stdio: 'inherit', shell: true }); L38: console.log('\n \x1b[38;5;44mUpdated to v' + latest + '. Restarting...\x1b[0m\n');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

server.jsView on unpkg · L36

preset-utils.jsView file

1const { binName } = require('./utils'); L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

preset-utils.jsView on unpkg · L1

plugins/voice-input/python/worker.pyView file

•path = plugins/voice-input/python/worker.py kind = build_helper sizeBytes = 3923 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/voice-input/python/worker.pyView on unpkg

plugins/voice-input/python/mel_filters.npzView file

•path = plugins/voice-input/python/mel_filters.npz kind = compressed_blob sizeBytes = 2240 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

plugins/voice-input/python/mel_filters.npzView on unpkg

•path = plugins/voice-input/python/mel_filters.npz kind = nested_archive_needs_inspection sizeBytes = 2240 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

plugins/voice-input/python/mel_filters.npzView on unpkg

public/fx/space-idle.mp3View file

•path = public/fx/space-idle.mp3 kind = high_entropy_blob sizeBytes = 47276 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/fx/space-idle.mp3View on unpkg

Findings

4 High6 Medium6 Low

HighChild Processhandlers.js

HighShellserver.js

HighRuntime Package Installserver.js

HighShips High Entropy Blobpublic/fx/space-idle.mp3

MediumDynamic Requirepreset-utils.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperplugins/voice-input/python/worker.py

MediumShips Compressed Blobplugins/voice-input/python/mel_filters.npz

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionplugins/voice-input/python/mel_filters.npz

Source & flagged code

8 flagged

handlers.jsView file

Lines 1-22javascript

1const { readFileSync, writeFileSync, mkdirSync, existsSync, copyFileSync, unlinkSync } = require('fs');

2const { join, dirname } = require('path');

3const { execFileSync, execFile } = require('child_process');

4const os = require('os');

High

Child Process

Package source references child process execution.

handlers.jsView on unpkg · L2

5const config = require('./config');

6const sessions = require('./sessions');

7const themes = require('./themes');

8const presets = JSON.parse(readFileSync(join(__dirname, 'agent-presets.json'), 'utf8'));

9const { listDirs, binName, defaultShell } = require('./utils');

10const { presetForCommand: findPresetForCommand } = require('./preset-utils');

11const { PORT } = require('./runtime');

12for (const p of presets) if (p.presetId === 'shell') p.command = defaultShell;

13function isPresetEnabled(preset) {

14 if (!preset?.enabledIfEnv) return true;

15 const value = String(process.env[preset.enabledIfEnv] || '').trim().toLowerCase();

16 return value === '1' || value === 'true' || value === 'yes';

17}

18function clientPresets() {

19 return presets.filter(isPresetEnabled);

20}

21function filterClientCommands(commands) {

22 const allowedPresetIds = new Set(clientPresets().map(p => p.presetId));

server.jsView file

Lines 16-56javascript

17// --- Self-update check (runs before server starts) ---

18const currentVersion = require('./package.json').version;

19const { execFile, execSync } = require('child_process');

20const shellOpt = process.platform === 'win32'

preset-utils.jsView file

Lines 1-14javascript

1const { binName } = require('./utils');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

preset-utils.jsView on unpkg · L1

3function presetForCommand(cmd, presets, options = {}) {

4 const usePresetId =

plugins/voice-input/python/worker.pyView file

•path = plugins/voice-input/python/worker.py kind = build_helper sizeBytes = 3923 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/voice-input/python/worker.pyView on unpkg

plugins/voice-input/python/mel_filters.npzView file

•path = plugins/voice-input/python/mel_filters.npz kind = compressed_blob sizeBytes = 2240 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

plugins/voice-input/python/mel_filters.npzView on unpkg

•path = plugins/voice-input/python/mel_filters.npz kind = nested_archive_needs_inspection sizeBytes = 2240 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

plugins/voice-input/python/mel_filters.npzView on unpkg

public/fx/space-idle.mp3View file

•path = public/fx/space-idle.mp3 kind = high_entropy_blob sizeBytes = 47276 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/fx/space-idle.mp3View on unpkg