registry / clideck / 1.31.28

clideck@1.31.28

One screen for all your AI coding agents — run, monitor, and manage multiple CLI agents from a single browser tab

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 58 file(s), 520 KB of source, external domains: 127.0.0.1, www.w3.org

Source & flagged code

8 flagged

handlers.jsView file

Lines 1-22javascript

1const { readFileSync, writeFileSync, mkdirSync, existsSync, copyFileSync, unlinkSync } = require('fs');

2const { join, dirname } = require('path');

Source & flagged code

8 flagged · loading source

handlers.jsView file

2const { join, dirname } = require('path'); L3: const { execFileSync, execFile } = require('child_process'); L4: const os = require('os');

High

Child Process

Package source references child process execution.

handlers.jsView on unpkg · L2

server.jsView file

36try { L37: execSync('npm install -g clideck', { stdio: 'inherit', shell: true }); L38: console.log('\n \x1b[38;5;44mUpdated to v' + latest + '. Restarting...\x1b[0m\n');

High

Shell

Package source references shell execution.

server.jsView on unpkg · L36

36try { L37: execSync('npm install -g clideck', { stdio: 'inherit', shell: true }); L38: console.log('\n \x1b[38;5;44mUpdated to v' + latest + '. Restarting...\x1b[0m\n');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

server.jsView on unpkg · L36

preset-utils.jsView file

1const { binName } = require('./utils'); L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

preset-utils.jsView on unpkg · L1

plugins/voice-input/python/worker.pyView file

•path = plugins/voice-input/python/worker.py kind = build_helper sizeBytes = 3923 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/voice-input/python/worker.pyView on unpkg

plugins/voice-input/python/mel_filters.npzView file

•path = plugins/voice-input/python/mel_filters.npz kind = compressed_blob sizeBytes = 2240 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

plugins/voice-input/python/mel_filters.npzView on unpkg

•path = plugins/voice-input/python/mel_filters.npz kind = nested_archive_needs_inspection sizeBytes = 2240 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

plugins/voice-input/python/mel_filters.npzView on unpkg

public/fx/space-idle.mp3View file

•path = public/fx/space-idle.mp3 kind = high_entropy_blob sizeBytes = 47276 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/fx/space-idle.mp3View on unpkg

Findings

4 High6 Medium6 Low

HighChild Processhandlers.js

HighShellserver.js

HighRuntime Package Installserver.js

HighShips High Entropy Blobpublic/fx/space-idle.mp3

MediumDynamic Requirepreset-utils.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperplugins/voice-input/python/worker.py

MediumShips Compressed Blobplugins/voice-input/python/mel_filters.npz

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionplugins/voice-input/python/mel_filters.npz

server.jsView file

Lines 16-56javascript

17// --- Self-update check (runs before server starts) ---

18const currentVersion = require('./package.json').version;

19const { execFile, execSync } = require('child_process');

20const shellOpt = process.platform === 'win32';

22function checkSelfUpdate() {

23 return new Promise(ok => {

24 // Skip in non-interactive or local dev contexts

25 if (!process.stdin.isTTY || !process.stdout.isTTY) return ok();

26 if (!__dirname.includes(join('node_modules', 'clideck'))) return ok();

27 execFile('npm', ['view', 'clideck', 'version'], { shell: shellOpt, timeout: 10000 }, (err, stdout) => {

28 if (err) return ok();

29 const latest = stdout.trim();

30 if (!latest || latest === currentVersion) return ok();

31 const rl = require('readline').createInterface({ input: process.stdin, output: process.stdout });

32 rl.question(`\n\x1b[38;5;105m Update available:\x1b[0m \x1b[38;5;245m${currentVersion}\x1b[0m → \x1b[38;5;44m${latest}\x1b[0m\n\n \x1b[38;5;252mUpdate now? [Y/n]\x1b[0m `, answer => {

33 rl.close();

34 if (answer.trim().toLowerCase() === 'n') return ok();

35 console.log('\n \x1b[38;5;245mUpdating...\x1b[0m\n');

36 try {

37 execSync('npm install -g clideck', { stdio: 'inherit', shell: true });

38 console.log('\n \x1b[38;5;44mUpdated to v' + latest + '. Restarting...\x1b[0m\n');

High

Shell

Package source references shell execution.

server.jsView on unpkg · L36

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

server.jsView on unpkg · L36

39 const { spawn } = require('child_process');

40 spawn(process.argv[0], process.argv.slice(1), { stdio: 'inherit', shell: shellOpt }).on('close', code => process.exit(code));

41 return;

42 } catch {

43 console.log('\n \x1b[38;5;196mUpdate failed.\x1b[0m Continuing with v' + currentVersion + '.\n');

44 ok();

45 }

46 });

47 });

48 });

49}

51checkSelfUpdate().then(() => {

53const { acquireServerLock, removeLockIfOwned } = require('./single-instance');

54const serverLock = acquireServerLock();

55if (!serverLock.ok) {

56 const url = serverLock.lock?.url || `http://127.0.0.1:${serverLock.lock?.port || PORT}`;