registry / cloud-pc-templates / 4.0.0

cloud-pc-templates@4.0.0

Cloud PC Templates is a command-line tool for managing cloud PC configurations and AI operations.

Static Scan Results

scanned 17d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 51.2 KB of source, external domains: cloud-pc-templates.com, docs.docker.com, ollama.ai, raw.githubusercontent.com

Source & flagged code

3 flagged

handlers/ollamalocal.jsView file

Lines 1-24javascript

1const http = require('http');

2const https = require('https');

3const fs = require('fs');

4const path = require('path');

5const { spawn } = require('child_process');

6const os = require('os');

High

Child Process

Package source references child process execution.

handlers/ollamalocal.jsView on unpkg · L4

7

8const OLLAMA_PORT = 11434;

9const PROXY_PORT = 3005;

10

11// Function to check if Ollama is running locally

12function checkOllamaHealth() {

13 return new Promise((resolve) => {

14 const request = http.request(

15 {

16 hostname: 'localhost',

17 port: OLLAMA_PORT,

18 path: '/api/tags',

19 method: 'GET'

20 },

21 (res) => {

22 resolve(res.statusCode === 200);

23 }

24 );

handlers/ollamacloud.jsView file

Lines 1-21javascript

1const http = require('http');

2const https = require('https');

3const fs = require

handlers/agents.jsView file

Lines 1-21javascript

1const { spawn, execSync } = require('child_process');

2const https = require('https');

3const fs =

Source & flagged code

3 flagged · loading source

handlers/ollamalocal.jsView file

4const path = require('path'); L5: const { spawn } = require('child_process'); L6: const os = require('os');

High

Child Process

Package source references child process execution.

handlers/ollamalocal.jsView on unpkg · L4

handlers/ollamacloud.jsView file

1const http = require('http'); L2: const https = require('https'); ... L4: const path = require('path'); L5: const { spawn } = require('child_process'); L6: const os = require('os'); ... L10: return new Promise((resolve) => { L11: process.stdout.write('Enter API Key: '); L12:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

handlers/ollamacloud.jsView on unpkg · L1

handlers/agents.jsView file

1const { spawn, execSync } = require('child_process'); L2: const https = require('https'); L3: const fs = require('fs'); ... L17: } L18: return await response.json(); L19: } catch (error) { ... L106: // Check if bash exists L107: const bashCmd = process.platform === 'win32' ? 'where bash' : 'which bash'; L108: try { ... L144: stdio: 'inherit', L145: cwd: process.cwd() L146: });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

handlers/agents.jsView on unpkg · L1

Findings

3 High3 Medium4 Low

HighChild Processhandlers/ollamalocal.js

HighCommand Output Exfiltrationhandlers/ollamacloud.js

HighSandbox Evasion Gated Capabilityhandlers/agents.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LPM CLI

Source & flagged code

3 flagged

handlers/ollamalocal.jsView file

Lines 1-24javascript

1const http = require('http');

2const https = require('https');

3const fs = require('fs');

4const path = require('path');

5const { spawn } = require('child_process');

6const os = require('os');

High

Child Process

Package source references child process execution.

handlers/ollamalocal.jsView on unpkg · L4

7

8const OLLAMA_PORT = 11434;

9const PROXY_PORT = 3005;

10

11// Function to check if Ollama is running locally

12function checkOllamaHealth() {

13 return new Promise((resolve) => {

14 const request = http.request(

15 {

16 hostname: 'localhost',

17 port: OLLAMA_PORT,

18 path: '/api/tags',

19 method: 'GET'

20 },

21 (res) => {

22 resolve(res.statusCode === 200);

23 }

24 );

handlers/ollamacloud.jsView file

Lines 1-21javascript

1const http = require('http');

2const https = require('https');

3const fs = require

handlers/agents.jsView file

Lines 1-21javascript

1const { spawn, execSync } = require('child_process');

2const https = require('https');

3const fs =

(

'fs'

);

4const path = require('path');

5const { spawn } = require('child_process');

6const os = require('os');

7

8// Function to get masked API key input

9function promptForApiKey() {

10 return new Promise((resolve) => {

11 process.stdout.write('Enter API Key: ');

12

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

handlers/ollamacloud.jsView on unpkg · L1

13 const stdin = process.stdin;

14

15 // Handle both TTY and non-TTY environments

16 if (stdin.isTTY) {

17 stdin.setRawMode(true);

18 }

19 stdin.resume();

20

21 let apiKey = '';

require

(

'fs'

);

4const path = require('path');

5const os = require('os');

6

7const AGENTS_REGISTRY_URL = 'https://raw.githubusercontent.com/devashish234073/cloud-pc-templates-marketplace/refs/heads/main/JS-AGENTS/agent-registry.json';

8const SETUP_SCRIPT_URL = 'https://raw.githubusercontent.com/devashish234073/cloud-pc-templates-marketplace/main/cloud-pc-templates/setup_and_run.sh';

9const TERMUX_SETUP_SCRIPT_URL = 'https://raw.githubusercontent.com/devashish234073/cloud-pc-templates-marketplace/refs/heads/main/cloud-pc-templates/setup_and_run_in_termux.sh';

10const VECTOR_DB_SCRIPT_URL = 'https://raw.githubusercontent.com/devashish234073/cloud-pc-templates-marketplace/refs/heads/main/misc/vectorDb/vectorDbServer.js';

11

12async function fetchAgentsRegistry() {

13 try {

14 const response = await fetch(AGENTS_REGISTRY_URL);

15 if (!response.ok) {

16 throw new Error(`Failed to fetch agents registry: ${response.status} ${response.statusText}`);

17 }

18 return await response.json();

19 } catch (error) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

handlers/agents.jsView on unpkg · L1

20 throw new Error(`Failed to fetch agents registry: ${error.message}`);

21 }