Loading npm security reports…

codex-overleaf-link@1.6.3: Clean npm security report (Allow) | LPM Firewall

registry / codex-overleaf-link / 1.6.3

codex-overleaf-link@1.6.3

Cross-platform Chrome bridge that connects Codex to the active Overleaf project.

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 6 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 52 file(s), 771 KB of source, external domains: github.com

Source & flagged code

1 flagged

native-host/src/subagentBroker.jsView file

Lines 125-165javascript

125 if (!name.endsWith('.json') || name.startsWith('.tmp-') || seenFiles.has(name)) {

126 continue;

127 }

128 seenFiles.add(name);

129 admitJobFile(name);

130 }

131 }

132

133 function admitJobFile(name) {

134 const filePath = path.join(jobsDir, name);

135 let stat;

136 try {

137 stat = fs.statSync(filePath);

138 } catch (_error) {

139 return;

140 }

141 if (stat.size > MAX_JOB_FILE_BYTES) {

142 return writeRejection({ id: idFromFileName(name), reason: 'job_too_large' });

143 }

144 let job;

145 try {

146 job = JSON.parse(fs.readFileSync(filePath, 'utf8'));

147 } catch (_error) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

native-host/src/subagentBroker.jsView on unpkg · L145

148 return writeRejection({ id: idFromFileName(name), reason: 'invalid_json' });

149 }

150 const rejection = validateJob(job);

151 if (rejection) {

152 return writeRejection({ id: jobIdOrFallback(job, name), ...rejection });

153 }

154 acceptedCount += 1;

155 jobs.set(job.id, { job, status: 'queued' });

156 queued.push(job.id);

157 emit('codex.subagent.queued', job.title || job.id, { jobId: job.id, files: job.files }, 'running');

158 }

159

160 function idFromFileName(name) {

161 return name.replace(/\.json$/, '').slice(0, 32) || 'unknown';

162 }

163

164 function jobIdOrFallback(job, name) {

165 return typeof job?.id === 'string' && job.id ? job.id.slice(0, 32) : idFromFileName(name);

Source & flagged code

1 flagged · loading source

native-host/src/subagentBroker.jsView file

145try { L146: job = JSON.parse(fs.readFileSync(filePath, 'utf8')); L147: } catch (_error) {

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code