registry / copilotoffice / 2.1.0

copilotoffice@2.1.0

A 2D pixel-art game where you interact with AI agents in a virtual office

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 637 KB of source, external domains: bellard.org, github.com, graph.microsoft.com, ic3.teams.office.com, opensource.org, prunegames.com, steffe.se, teams.cloud.microsoft

Oversized source lightweight scan

dist/game.bundle.js7.73 MB file, sampled 256 KB

HighEntropyStringsMinifiedUrlStringsbellard.orggithub.comopensource.orgprunegames.comsteffe.se

Source & flagged code

4 flagged

bin/copilotoffice.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { spawn } = require('child_process');

4const path = require('path');

High

Child Process

Package source references child process execution.

bin/copilotoffice.jsView on unpkg · L2

6function run() {

7 let electronBinary;

8 try {

9 electronBinary = require('electron');

10 } catch (error) {

11 console.error('[copilotoffice] Electron is not available. Try reinstalling the package.');

12 console.error(error);

13 process.exit(1);

14 }

16 const appRoot = path.resolve(__dirname, '..');

17 const child = spawn(electronBinary, [appRoot], {

18 stdio: 'inherit',

19 windowsHide: false,

20 env: {

21 ...process.env,

22 COPILOT_OFFICE_ENABLE_WATCHER: '0',

dist/electron/main.jsView file

Lines 8-48javascript

8var __copyProps = (to, from, except, desc) => {

9 if (from && typeof from === "object" || typeof from === "function") {

10 for (

dist/game.bundle.jsView file

•path = dist/game.bundle.js kind = oversized_source_file sizeBytes = 8102128 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/game.bundle.jsView on unpkg

Source & flagged code

4 flagged · loading source

bin/copilotoffice.jsView file

2L3: const { spawn } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/copilotoffice.jsView on unpkg · L2

dist/electron/main.jsView file

28var fs7 = __toESM(require("fs")); L29: var import_child_process4 = require("child_process"); L30: ... L44: var START_TIME_GRACE_MS = 2e3; L45: var DEFAULT_REGISTRY_FILE = path.join(process.cwd(), ".data", "pty-pids.json"); L46: function readPtyRegistry(file = DEFAULT_REGISTRY_FILE) { ... L48: const raw = fs.readFileSync(file, "utf8"); L49: const parsed = JSON.parse(raw); L50: if (!Array.isArray(parsed)) return []; ... L154: * 'copilot-turn-end' (agentId), 'copilot-tool-start' (agentId, toolName, toolId, status), L155: * 'session-meta-updated' (agentId, meta), 'terminal-exit' (agentId, exitCode). L156: */

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/electron/main.jsView on unpkg · L28

2509if (fs7.existsSync(path8.join(process.cwd(), "src", "main.ts"))) { L2510: watcherProcess = (0, import_child_process4.spawn)("npx", ["esbuild", "src/main.ts", "--bundle", "--outfile=dist/game.bundle.js", "--platform=browser", "--format=iife", "--global-na... L2511: cwd: process.cwd(),

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/electron/main.jsView on unpkg · L2509

dist/game.bundle.jsView file

•path = dist/game.bundle.js kind = oversized_source_file sizeBytes = 8102128 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/game.bundle.jsView on unpkg

Findings

4 High3 Medium4 Low

HighChild Processbin/copilotoffice.js

HighSandbox Evasion Gated Capabilitydist/electron/main.js

HighRuntime Package Installdist/electron/main.js

HighOversized Source Filedist/game.bundle.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

bin/copilotoffice.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { spawn } = require('child_process');

4const path = require('path');

High

Child Process

Package source references child process execution.

bin/copilotoffice.jsView on unpkg · L2

6function run() {

7 let electronBinary;

8 try {

9 electronBinary = require('electron');

10 } catch (error) {

11 console.error('[copilotoffice] Electron is not available. Try reinstalling the package.');

12 console.error(error);

13 process.exit(1);

14 }

16 const appRoot = path.resolve(__dirname, '..');

17 const child = spawn(electronBinary, [appRoot], {

18 stdio: 'inherit',

19 windowsHide: false,

20 env: {

21 ...process.env,

22 COPILOT_OFFICE_ENABLE_WATCHER: '0',

dist/electron/main.jsView file

Lines 8-48javascript

8var __copyProps = (to, from, except, desc) => {

9 if (from && typeof from === "object" || typeof from === "function") {

10 for (

dist/game.bundle.jsView file

•path = dist/game.bundle.js kind = oversized_source_file sizeBytes = 8102128 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/game.bundle.jsView on unpkg

Lines 2489-2529javascript

2489function killOrphanedProcesses() {

2490 try {

2491 const { reaped, skipped } = reapRegisteredPtys();

2492 if (reaped.length > 0) {

2493 console.log(`[Main] Reaped ${reaped.length} orphaned PTY process tree(s):`, reaped);

2494 }

2495 if (skipped.length > 0) {

2496 console.log(`[Main] Skipped ${skipped.length} already-dead PTY record(s) from registry`);

2497 }

2498 } catch {

2499 }

2500}

2501var mainWindow = null;

2502var watcherProcess = null;

2503var relay = new TerminalRelay(() => mainWindow);

2504var teamsService = null;

2505var pendingHardReload = false;

2506function startFileWatcher() {

2507 const copilotOfficePath = path8.join(process.cwd(), "CopilotOffice");

2508 if (!fs7.existsSync(path8.join(copilotOfficePath, "package.json"))) {

2509 if (fs7.existsSync(path8.join(process.cwd(), "src", "main.ts"))) {

2510 watcherProcess = (0, import_child_process4.spawn)("npx", ["esbuild", "src/main.ts", "--bundle", "--outfile=dist/game.bundle.js", "--platform=browser", "--format=iife", "--global-name=CopilotOffice", "--watch"], {

2511 cwd: process.cwd(),

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/electron/main.jsView on unpkg · L2509

2512 shell: true,

2513 stdio: "pipe"

2514 });

2515 }

2516 } else {

2517 watcherProcess = (0, import_child_process4.spawn)("npx", ["esbuild", "src/main.ts", "--bundle", "--outfile=dist/game.bundle.js", "--platform=browser", "--format=iife", "--global-name=CopilotOffice", "--watch"], {

2518 cwd: copilotOfficePath,

2519 shell: true,

2520 stdio: "pipe"

2521 });

2522 }

2523 if (watcherProcess) {

2524 watcherProcess.stdout?.on("data", (data) => {

2525 const msg = data.toString();

2526 console.log("[Watcher]", msg);

2527 if (msg.includes("watching") || msg.includes("built")) {

2528 if (mainWindow && !mainWindow.isDestroyed()) {

2529 mainWindow.webContents.send("build-complete");