registry / codbash-app / 7.14.1

codbash-app@7.14.1

Dashboard + CLI for AI coding agents — Claude Code, Codex, Cursor, OpenCode, Kiro. View, search, resume, convert, sync sessions.

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 32 file(s), 1.28 MB of source, external domains: claude.ai, cli.kiro.dev, cloud.neuraldeep.ru, code.claude.com, developer.mozilla.org, fonts.googleapis.com, fonts.gstatic.com, github.com, iterm2.com, kilo.ai, kiro.dev, leaderboard.neuraldeep.ru, nodejs.org, omp.sh, opencode.ai, registry.npmjs.org, rustdesk.com, www.w3.org

Source & flagged code

4 flagged

bin/cli.jsView file

Lines 312-352javascript

312 const match = allConv.find(s => s.id === sid || s.id.startsWith(sid));

313 if (!match) {

314 console.error(` Session not found: ${sid}`);

315 process.exit(1);

316 }

317 console.log(`\n Converting ${match.tool} session \x1b[1m${match.id.slice(0, 12)}\x1b[0m → ${target}...`);

318 const result = convertSession(match.id, match.project, target);

319 if (!result.ok) {

320 console.error(` \x1b[31mError:\x1b[0m ${result.error}\n`);

321 process.exit(1);

322 }

323 console.log(` \x1b[32mDone!\x1b[0m`);

324 console.log(` New session: ${result.target.sessionId}`);

325 console.log(` Messages: ${result.target.messages}`);

326 console.log(` File: ${result.target.file}`);

327 console.log(` Resume: \x1b[2m${result.target.resumeCmd}\x1b[0m\n`);

328 break;

329 }

330

331 case 'update':

332 case 'upgrade': {

333 const { execSync: execU } = require('child_process');

334 console.log('\n \x1b[36m\x1b[1mUpdating codbash...\x1b[0m\n');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L332

335 try {

336 execU('npm i -g codbash-app@latest', { stdio: 'inherit' });

337 const newPkg = require('../package.json');

338 console.log(`\n \x1b[32mUpdated to v${newPkg.version}!\x1b[0m`);

339 console.log(' Run \x1b[2mcodbash restart\x1b[0m to apply.\n');

340 } catch (e) {

341 console.error(' \x1b[31mUpdate failed.\x1b[0m Try: npm i -g codbash-app@latest\n');

342 }

343 break;

344 }

345

346 case 'restart': {

347 const { execSync } = require('child_process');

348 const portArg = args.find(a => a.startsWith('--port='));

349 const port = portArg ? parseInt(portArg.split('=')[1]) : DEFAULT_PORT;

350 const hostArg = args.find(a => a.startsWith('--host='));

351 const host = hostArg ? hostArg.split('=')[1] : (process.env.CODEDASH_HOST || DEFAULT_HOST);

352 console.log(`\n Stopping codbash on port ${port}...`);

src/terminals.jsView file

Lines 1-28javascript

1'use strict';

3const fs = require('fs');

4const path = require('path');

5const

src/terminal.jsView file

Lines 1-28javascript

1'use strict';

3// ── Browser terminal (Workspace) — B-0 walking skeleton ─────────────────────

4//

5// Optional feature. The core dashboard stays dependency-free; this module lazily

6// loads @lydell/node-pty (prebuilt-only, never invokes node-gyp) and, if it is

7// unavailable, reports the feature as disabled instead of crashing.

8//

9// Transport is a hand-rolled WebSocket on the stdlib http.Server 'upgrade' event

10// (so `ws` is NOT a dependency). Framing convention:

src/server.jsView file

Lines 855-895javascript

855 // ── Version check ────────────────────────

856 else if (req.method === 'GET' && pathname === '/api/version') {

857 const pkg = require(

Source & flagged code

4 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code