registry / codex-mobile-re / 0.1.105

codex-mobile-re@0.1.105

⚠ Under review

Mobile-first web interface and gateway for Codex app-server (fork rebuild of codexapp)

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 22 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 2.12 MB of source, external domains: 0.0.0.0, 127.0.0.1, api.example.com, api.github.com, api.openai.com, api.telegram.org, apis.google.com, auth.openai.com, backend.composio.dev, cdnjs.cloudflare.com, chatgpt.com, composio.dev, dashboard.composio.dev, github.com, opencode.ai, openrouter.ai, raw.githubusercontent.com, skills.anyclaw.store, vuejs.org, www.google.com, www.w3.org

Source & flagged code

13 flagged

package.jsonView file

Lines 34-74json

34 "dist-cli/",

35 "scripts/dev.cjs",

36 "scripts/dev-random-home.cjs",

37 "scripts/fix-pty-native-build.cjs"

38 ],

39 "pnpm": {

40 "onlyBuiltDependencies": [

41 "@firebase/util",

42 "esbuild",

43 "node-pty",

44 "protobufjs"

45 ]

46 },

47 "scripts": {

48 "dev": "node scripts/dev.cjs",

49 "dev2": "node scripts/dev-random-home.cjs",

50 "dev:open": "pnpm run build:cli && sh -c 'pnpm run dev & VPID=$!; node dist-cli/index.js --open-project \"${1:-.}\"; wait $VPID' --",

51 "build:frontend": "vue-tsc --noEmit && vite build",

52 "build:cli": "tsup",

53 "build": "pnpm run build:frontend && pnpm run build:cli",

54 "postinstall": "node scripts/fix-pty-native-build.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

55 "test:unit": "vitest run",

56 "preview": "vite preview",

57 "prepublishOnly": "pnpm run build",

58 "profile:browser": "node scripts/profile-browser-runtime.cjs",

59 "profile:thread": "PROFILE_ROUTE='#/thread/019da7c0-4e12-7a91-837c-f7c11cc8ab6c' node scripts/profile-browser-runtime.cjs"

60 },

61 "dependencies": {

62 "@composio/client": "0.1.0-alpha.66",

63 "@xterm/addon-fit": "^0.11.0",

64 "@xterm/xterm": "^6.0.0",

65 "commander": "^13.1.0",

66 "express": "^5.1.0",

67 "firebase": "^12.2.1",

68 "highlight.js": "^11.11.1",

69 "qrcode-terminal": "^0.12.0",

70 "ws": "^8.18.3"

71 },

72 "optionalDependencies": {

73 "node-pty": "^1.1.0"

74 },

dist/assets/DirectoryHub-DRq_Hv0a.jsView file

Lines 1-3javascript

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/index.esm-Cxn_LBGD.js","assets/index.esm-Bx2Y2PLG.js","assets/index.esm-DYMAm9mq.js"])))=>i.map(i

scripts/dev-random-home.cjsView file

Lines 1-22javascript

1const { mkdtempSync } = require('node:fs')

2const { tmpdir } = require('node:os')

3const { join } =

dist-cli/index.jsView file

3Source sends the broad process environment to a literal external destination. L3: // src/cli/index.ts L4: import { createServer as createServer2 } from "http"; L5: import { chmodSync as chmodSync2, createWriteStream, existsSync as existsSync14, mkdirSync as mkdirSync2 } from "fs"; ... L8: import { isAbsolute as isAbsolute13, join as join31, resolve as resolve8 } from "path"; L9: import { spawn as spawn9 } from "child_process"; L10: import { createInterface as createInterface2 } from "readline/promises"; ... L34: function needsCmdExeWrapper(command) { L35: if (process.platform !== "win32") { L36: return false; ... L50: return { L51: command: "cmd.exe", L52: args: ["/d", "/s", "/c", [quoteCmdExeArg(command), ...args.map((arg) => quoteCmdExeArg(arg))].join(" ")]

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist-cli/index.jsView on unpkg · L3

3Trigger-reachable chain: manifest.bin -> dist-cli/index.js L3: // src/cli/index.ts L4: import { createServer as createServer2 } from "http"; L5: import { chmodSync as chmodSync2, createWriteStream, existsSync as existsSync14, mkdirSync as mkdirSync2 } from "fs"; ... L8: import { isAbsolute as isAbsolute13, join as join31, resolve as resolve8 } from "path"; L9: import { spawn as spawn9 } from "child_process"; L10: import { createInterface as createInterface2 } from "readline/promises"; ... L34: function needsCmdExeWrapper(command) { L35: if (process.platform !== "win32") { L36: return false; ... L50: return { L51: command: "cmd.exe", L52: args: ["/d", "/s", "/c", [quoteCmdExeArg(command), ...args.map((arg) => quoteCmdExeArg(arg))].join(" ")]

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist-cli/index.jsView on unpkg · L3

codex-mobile-re@0.1.105

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code