registry / codex-multihome / 0.10.0

codex-multihome@0.10.0

A macOS menu bar launcher and hygiene tool for managing multiple Codex homes.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 9.55 KB of source

Source & flagged code

9 flagged

package.jsonView file

Lines 8-48json

8 "repository": {

9 "type": "git",

10 "url": "git+https://github.com/Takhoffman/codex-multihome.git"

11 },

12 "bugs": {

13 "url": "https://github.com/Takhoffman/codex-multihome/issues"

14 },

15 "keywords": [

16 "codex",

17 "macos",

18 "menu-bar",

19 "launcher",

20 "swift"

21 ],

22 "bin": {

23 "homeport": "npm/homeport.js",

24 "multihome": "npm/homeport.js",

25 "codex-multihome": "npm/homeport.js"

26 },

27 "scripts": {

28 "postinstall": "node npm/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 "prepack": "sh scripts/prepare-shim-runtime.sh --all",

30 "build": "swift build -c release --product homeport && swift build -c release --product CodexMultihomeApp",

31 "release:check": "swift test && npm pack --dry-run",

32 "test": "swift test"

33 },

34 "publishConfig": {

35 "access": "public"

36 },

37 "files": [

38 "CHANGELOG.md",

39 "CODE_OF_CONDUCT.md",

40 "CONTRIBUTING.md",

41 "LICENSE",

42 "Package.swift",

43 "README.md",

44 "SECURITY.md",

45 "releases",

46 "scripts",

47 "Sources",

48 "Tests",

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/python3.14/urllib/request.pyView file

Lines 36-76python

37Request -- An object that encapsulates the state of a request. The

38state can be as simple as the URL. It can also include extra HTTP

39headers, e.g. a User-Agent.

41BaseHandler --

43internals:

44BaseHandler and parent

45_call_chain conventions

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/bin/python3.14View file

•path = [redacted]-[redacted].14 kind = native_binary sizeBytes = 18053472 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/bin/python3.14View on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1225 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/tcl9.0/cookiejar0.2/public_suffix_list.dat.gzView file

•path = [redacted]-[redacted].0/cookiejar0.2/public_suffix_list.dat.gz kind = high_entropy_blob sizeBytes = 70835 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/tcl9.0/cookiejar0.2/public_suffix_list.dat.gzView on unpkg

•path = [redacted]-[redacted].0/cookiejar0.2/public_suffix_list.dat.gz kind = compressed_blob sizeBytes = 70835 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/tcl9.0/cookiejar0.2/public_suffix_list.dat.gzView on unpkg

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/python3.14/ensurepip/_bundled/pip-26.1.1-py3-none-any.whlView file

•path = [redacted]-[redacted].14/ensurepip/_bundled/pip-26.1.1-py3-none-any.whl kind = nested_archive_needs_inspection sizeBytes = 1812777 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/python3.14/ensurepip/_bundled/pip-26.1.1-py3-none-any.whlView on unpkg

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/x86_64/python/lib/python3.14/urllib/request.pyView file

Lines 36-76python

37Request -- An object that encapsulates the state of a request. The

38state can be as simple as the URL. It can also include extra HTTP

39headers, e.g. a User-Agent.

41BaseHandler --

43internals:

44BaseHandler and parent

45_call_chain conventions

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node npm/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node npm/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/python3.14/urllib/request.pyView file

56patternName = generic_password severity = medium line = 56 matchedText = passwd='...le')

Medium

Secret Pattern

Package contains a possible secret pattern.

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/python3.14/urllib/request.pyView on unpkg · L56

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/bin/python3.14View file

•path = [redacted]-[redacted].14 kind = native_binary sizeBytes = 18053472 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/bin/python3.14View on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1225 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/tcl9.0/cookiejar0.2/public_suffix_list.dat.gzView file

•path = [redacted]-[redacted].0/cookiejar0.2/public_suffix_list.dat.gz kind = high_entropy_blob sizeBytes = 70835 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/tcl9.0/cookiejar0.2/public_suffix_list.dat.gzView on unpkg

•path = [redacted]-[redacted].0/cookiejar0.2/public_suffix_list.dat.gz kind = compressed_blob sizeBytes = 70835 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/tcl9.0/cookiejar0.2/public_suffix_list.dat.gzView on unpkg

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/python3.14/ensurepip/_bundled/pip-26.1.1-py3-none-any.whlView file

•path = [redacted]-[redacted].14/ensurepip/_bundled/pip-26.1.1-py3-none-any.whl kind = nested_archive_needs_inspection sizeBytes = 1812777 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/python3.14/ensurepip/_bundled/pip-26.1.1-py3-none-any.whlView on unpkg

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/x86_64/python/lib/python3.14/urllib/request.pyView file

56patternName = generic_password severity = medium line = 56 matchedText = passwd='...le')

Medium

Secret Pattern

Hardcoded password in Sources/CodexMultihomeApp/Resources/codex-shim/runtime/x86_64/python/lib/python3.14/urllib/request.py

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/x86_64/python/lib/python3.14/urllib/request.pyView on unpkg · L56

Findings

2 High8 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy BlobSources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/tcl9.0/cookiejar0.2/public_suffix_list.dat.gz

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret PatternSources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/python3.14/urllib/request.py

MediumNetwork

MediumShips Native BinarySources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/bin/python3.14

MediumShips Build Helperinstall.sh

MediumShips Compressed BlobSources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/tcl9.0/cookiejar0.2/public_suffix_list.dat.gz

MediumStructural Risk Force Deep Review

MediumSecret PatternSources/CodexMultihomeApp/Resources/codex-shim/runtime/x86_64/python/lib/python3.14/urllib/request.py

LowScripts Present

LowFilesystem

LowNested Archive Needs InspectionSources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/python3.14/ensurepip/_bundled/pip-26.1.1-py3-none-any.whl

Source & flagged code

9 flagged

package.jsonView file

Lines 8-48json

8 "repository": {

9 "type": "git",

10 "url": "git+https://github.com/Takhoffman/codex-multihome.git"

11 },

12 "bugs": {

13 "url": "https://github.com/Takhoffman/codex-multihome/issues"

14 },

15 "keywords": [

16 "codex",

17 "macos",

18 "menu-bar",

19 "launcher",

20 "swift"

21 ],

22 "bin": {

23 "homeport": "npm/homeport.js",

24 "multihome": "npm/homeport.js",

25 "codex-multihome": "npm/homeport.js"

26 },

27 "scripts": {

28 "postinstall": "node npm/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 "prepack": "sh scripts/prepare-shim-runtime.sh --all",

30 "build": "swift build -c release --product homeport && swift build -c release --product CodexMultihomeApp",

31 "release:check": "swift test && npm pack --dry-run",

32 "test": "swift test"

33 },

34 "publishConfig": {

35 "access": "public"

36 },

37 "files": [

38 "CHANGELOG.md",

39 "CODE_OF_CONDUCT.md",

40 "CONTRIBUTING.md",

41 "LICENSE",

42 "Package.swift",

43 "README.md",

44 "SECURITY.md",

45 "releases",

46 "scripts",

47 "Sources",

48 "Tests",

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/python3.14/urllib/request.pyView file

Lines 36-76python

37Request -- An object that encapsulates the state of a request. The

38state can be as simple as the URL. It can also include extra HTTP

39headers, e.g. a User-Agent.

41BaseHandler --

43internals:

44BaseHandler and parent

45_call_chain conventions

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/bin/python3.14View file

•path = [redacted]-[redacted].14 kind = native_binary sizeBytes = 18053472 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/bin/python3.14View on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1225 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/tcl9.0/cookiejar0.2/public_suffix_list.dat.gzView file

•path = [redacted]-[redacted].0/cookiejar0.2/public_suffix_list.dat.gz kind = high_entropy_blob sizeBytes = 70835 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/tcl9.0/cookiejar0.2/public_suffix_list.dat.gzView on unpkg

•path = [redacted]-[redacted].0/cookiejar0.2/public_suffix_list.dat.gz kind = compressed_blob sizeBytes = 70835 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/tcl9.0/cookiejar0.2/public_suffix_list.dat.gzView on unpkg

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/python3.14/ensurepip/_bundled/pip-26.1.1-py3-none-any.whlView file

•path = [redacted]-[redacted].14/ensurepip/_bundled/pip-26.1.1-py3-none-any.whl kind = nested_archive_needs_inspection sizeBytes = 1812777 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/aarch64/python/lib/python3.14/ensurepip/_bundled/pip-26.1.1-py3-none-any.whlView on unpkg

Sources/CodexMultihomeApp/Resources/codex-shim/runtime/x86_64/python/lib/python3.14/urllib/request.pyView file

Lines 36-76python

37Request -- An object that encapsulates the state of a request. The

38state can be as simple as the URL. It can also include extra HTTP

39headers, e.g. a User-Agent.

41BaseHandler --

43internals:

44BaseHandler and parent

45_call_chain conventions