registry / coderaft / 0.0.36

coderaft@0.0.36

[![npm version](https://img.shields.io/npm/v/coderaft?color=blue)](https://npmx.dev/package/coderaft) [![install size](https://packagephobia.com/badge?p=coderaft)](https://packagephobia.com/result?p=coderaft)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

Manifest

NoLicense

scanned 10 file(s), 74.7 KB of source, external domains: 127.0.0.1

Source & flagged code

7 flagged

dist/_chunks/server.mjsView file

Lines 1-40javascript

1import { createProxyServer } from "./libs/httpxy.mjs";

2import { createRequire } from "node:module";

3import { fileURLToPath, pathToFileURL } from "node:url";

4import { createReadStream, readFileSync, readdirSync, unlinkSync } from "node:fs";

5import

Source & flagged code

7 flagged · loading source

dist/_chunks/server.mjsView file

4import { createReadStream, readFileSync, readdirSync, unlinkSync } from "node:fs"; L5: import { fork } from "node:child_process"; L6: import { randomBytes, randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/_chunks/server.mjsView on unpkg · L4

4Cross-file remote execution chain: dist/_chunks/server.mjs spawns dist/_chunks/libs/httpxy.mjs; helper contains network access plus dynamic code execution. L4: import { createReadStream, readFileSync, readdirSync, unlinkSync } from "node:fs"; L5: import { fork } from "node:child_process"; L6: import { randomBytes, randomUUID } from "node:crypto"; L7: import { createServer } from "node:http"; L8: import { extname, join, normalize, sep } from "node:path"; ... L21: var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))(); L22: if (process.platform === "android") { L23: if (process.execPath.includes("linker64") || process.execPath.startsWith("/apex/")) { L24: const resolved = process.env.TERMUX_EXEC__PROC_SELF_EXE || "/data/data/com.termux/files/usr/bin/node"; L25: Object.defineProperty(process, "execPath", { ... L78: ]); L79: const original = _os.networkInterfaces;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/_chunks/server.mjsView on unpkg · L4

20}; L21: var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))(); L22: if (process.platform === "android") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/_chunks/server.mjsView on unpkg · L20

dist/index.mjsView file

87const { spawn: spawnOpts = {}, ...serverOpts } = opts; L88: const { env, execArgv, stdio = "inherit", startupTimeout = 6e4 } = spawnOpts; L89: const workerPath = fileURLToPath(import.meta.resolve("#worker"));

High

Shell

Package source references shell execution.

dist/index.mjsView on unpkg · L87

code.tar.zstView file

•path = code.tar.zst kind = high_entropy_blob sizeBytes = 25850648 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

code.tar.zstView on unpkg

•path = code.tar.zst kind = compressed_blob sizeBytes = 25850648 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

code.tar.zstView on unpkg

package.jsonView file

•Remote tarball dependency specs: code-server@https://github.com/coder/code-server/releases/download/v4.128.0/package.tar.gz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

Findings

4 High6 Medium4 Low

HighChild Processdist/_chunks/server.mjs

HighShelldist/index.mjs

HighCross File Remote Execution Contextdist/_chunks/server.mjs

HighShips High Entropy Blobcode.tar.zst

MediumDynamic Requiredist/_chunks/server.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobcode.tar.zst

MediumStructural Risk Force Deep Review

MediumRemote Tarball Dependencypackage.json

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License

dist/index.mjsView file

Lines 67-107javascript

67 #attachListeners(proc) {

68 const onExit = (code, signal) => this.emit("exit", code, signal);

69 const onError = (err) => this.emit("error", err);

70 const onMessage = (msg) => {

71 if (msg?.type === "error") this.emit("error", new Error(msg.message ?? "worker error"));

72 };

73 proc.on("exit", onExit);

74 proc.on("error", onError);

75 proc.on("message", onMessage);

76 return () => {

77 proc.off("exit", onExit);

78 proc.off("error", onError);

79 proc.off("message", onMessage);

80 };

81 }

82};

83function spawnCodeServer(opts = {}) {

84 return SpawnedCodeServer.spawn(opts);

85}

86async function spawnWorker(opts) {

87 const { spawn: spawnOpts = {}, ...serverOpts } = opts;

88 const { env, execArgv, stdio = "inherit", startupTimeout = 6e4 } = spawnOpts;

89 const workerPath = fileURLToPath(import.meta.resolve("#worker"));

High

Shell

Package source references shell execution.

dist/index.mjsView on unpkg · L87

90 const childEnv = {

91 ...process.env,

92 ...env

93 };

94 delete childEnv.CODE_SERVER_PARENT_PID;

95 const proc = fork(workerPath, {

96 stdio: [

97 "ignore",

98 stdio,

99 stdio,

100 "ipc"

101 ],

102 env: childEnv,

103 ...execArgv !== void 0 ? { execArgv } : {}

104 });

105 const ready = await new Promise((resolve, reject) => {

106 const onMessage = (msg) => {

107 if (msg?.type === "ready") {

package.jsonView file

Lines 10-50json

10 "LICENSE.md",

11 "ThirdPartyNotices.txt",

12 "tar.mjs",

13 "code.mjs",

14 "worker.mjs",

15 "install.mjs",

16 "android-preload.cjs",

17 "code.tar.zst"

18 ],

19 "type": "module",

20 "types": "./dist/index.d.mts",

21 "exports": {

22 ".": "./dist/index.mjs"

23 },

24 "imports": {

25 "#code": "./code.mjs",

26 "#worker": "./worker.mjs",

27 "#install": "./install.mjs",

28 "#android-preload": "./android-preload.cjs"

29 },

30 "scripts": {

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg · L30

31 "build": "obuild"

32 },

33 "devDependencies": {

34 "code-server": "https://github.com/coder/code-server/releases/download/v4.128.0/package.tar.gz",

35 "@github/copilot": "workspace:*",

36 "@github/copilot-sdk": "workspace:*",

37 "@microsoft/1ds-core-js": "workspace:*",

38 "@microsoft/1ds-post-js": "workspace:*",

39 "@microsoft/mxc-sdk": "0.6.1",

40 "@parcel/watcher": "workspace:*",

41 "@vscode/copilot-api": "^0.4.2",

42 "@vscode/deviceid": "workspace:*",

43 "@vscode/fs-copyfile": "workspace:*",

44 "@vscode/iconv-lite-umd": "0.7.1",

45 "@vscode/native-watchdog": "workspace:*",

46 "@vscode/proxy-agent": "workspace:*",

47 "@vscode/ripgrep": "workspace:*",

48 "@vscode/ripgrep-universal": "workspace:*",

49 "@vscode/sandbox-runtime": "0.0.1",

50 "@vscode/spdlog": "workspace:*",