registry / durindoor / 2.1.0

durindoor@2.1.0

DurinDoor CLI - Start and manage DurinDoor server

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 26 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 671 file(s), 3.82 MB of source, external domains: 01.ai, 127.0.0.1, accounts.google.com, adb-0000000000000000.0.azuredatabricks.net, agent.adapta.one, agent.api5.cursor.sh, agent.tinyfish.ai, agentn.api5.cursor.sh, agentrouter.org, ai-gateway.vercel.sh, ai.360.cn, ai.google.dev, ai.hackclub.com, ai.nube.sh, ai.sumopod.com, aimlapi.com, aiplatform.googleapis.com, aistudio.google.com, amelia.chipotle.com, antigravity.google, api-atlas.nomic.ai, api-dashboard.search.brave.com, api-inference.huggingface.co, api.360.cn, api.ai21.com, api.aimlapi.com, api.airforce, api.anthropic.com, api.assemblyai.com, api.b.ai, api.baichuan-ai.com, api.bfl.ai, api.blackbox.ai, api.bluesminds.com, api.bytez.com, api.cablyai.com, api.cartesia.ai, api.cast.ai, api.cerebras.ai, api.clarifai.com, api.cline.bot, api.cloudflare.com, api.cohere.ai, api.commandcode.ai, api.deepgram.com, api.deepinfra.com, api.deepseek.com, api.dev.runwayml.com, api.dgrid.ai, api.dify.ai

Source & flagged code

17 flagged

package.jsonView file

Lines 1-41json

2 "name": "durindoor",

3 "version": "2.1.0",

4 "description": "DurinDoor CLI - Start and manage DurinDoor server",

5 "bin": {

6 "durindoor": "./cli.js"

7 },

8 "files": [

9 "cli.js",

10 "src",

11 "hooks",

12 "app",

13 "README.md",

14 "LICENSE"

15 ],

16 "scripts": {

17 "dev": "nodemon -I --watch cli.js --watch src --watch hooks --ext js,json cli.js",

18 "build": "node scripts/build-cli.js",

19 "pack:cli": "npm run build && npm pack --pack-destination ../..",

20 "publish:cli": "npm run build && npm publish",

21 "postinstall": "node hooks/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "prepublishOnly": "npm run build"

23 },

24 "dependencies": {

25 "enquirer": "^2.4.1",

26 "node-forge": "^1.4.0",

27 "node-machine-id": "^1.1.12",

28 "react": "19.2.7",

29 "react-dom": "19.2.7"

30 },

31 "comment_sqlite": "sql.js + better-sqlite3 are NOT bundled here. They are installed into <<~/.durindoor>>/runtime/node_modules by hooks/postinstall.js (and re-checked at runtime by cli.js). This avoids Windows EBUSY errors when updating the global CLI, since native .node files no longer live under the locked install dir.",

32 "comment_systray": "systray2 is NOT bundled here. It is lazy-installed into <<~/.durindoor>>/runtime/node_modules by hooks/postinstall.js on macOS/Linux only. Windows uses PowerShell NotifyIcon (zero binary). This avoids shipping unsigned Go binaries that trigger antivirus false positives (Kaspersky). We use the systray2 fork because the legacy systray@1.0.5 ships a 2017 x86_64 binary that fails on modern macOS dyld.",

33 "engines": {

34 "node": "20.20.2"

35 },

36 "keywords": [

37 "durindoor",

38 "cli",

39 "proxy",

40 "ai",

41 "api"

app/.next-cli-build/server/chunks/4306.jsView file

Lines 1-1javascript

1"use strict";exports.id=4306,exports.ids=[4306],exports.modules={37221:(a,b,c)=>{let d;c.

app/open-sse/executors/devin-cli.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import fs from "node:fs";

High

Child Process

Package source references child process execution.

app/open-sse/executors/devin-cli.jsView on unpkg · L1

3import os from "node:os";

app/open-sse/handlers/ttsProviders/localDevice.jsView file

Lines 15-55javascript

15 for (const line of stdout.split("\n")) {

16 const m = line.match(/^(

app/open-sse/utils/kimchiUserAgent.jsView file

Lines 47-87javascript

48 // Prevent fetching more than once per hour to avoid hitting GitHub API rate limits

49 const oneHour = 60 * 60 * 1000;

50 if (Date.now

app/server.jsView file

Lines 1-21javascript

1const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L1

3const dir = path.join(__dirname)

5process.env.

app/open-sse/shared/qoder/cosy.jsView file

Lines 23-63javascript

23 QODER_LOGIN_VERSION,

24 QODER_MACHINE_OS,

25 QODER_MACHINE_TYPE,

26 QODER_RSA_PUBLIC_KEY,

27} from "./constants.js";

29// AES-128 wants a 16-byte key. Match qodercli/Veria: take the first 16 chars

30// of a fresh UUID's canonical string (hyphens included). The key is fresh

src/cli/tray/autostart.jsView file

3const os = require("os"); L4: const { execSync } = require("child_process"); L5: ... L36: } L37: const computed = path.resolve(__dirname, "..", "..", "..", "cli.js"); L38: if (fs.existsSync(computed)) return computed; ... L47: function enableAutoStart(cliPath) { L48: const platform = process.platform; L49: L50: if (!["darwin", "win32", "linux"].includes(platform)) return false; L51: if (platform === "linux" && !process.env.DISPLAY) return false; L52:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli/tray/autostart.jsView on unpkg · L3

app/src/mitm/server.jsView file

13`+t.substr(i)):t=t.substr(0,i)+`\r L14: `+o+t.substr(i+1),s=n-i-1,i=-1,++n}else(t[n]===" "||t[n]===" "||t[n]===",")&&(i=n);return t}function a0(e){return e.replace(/^\s+/,"")}});var xr=M((Pp,Si)=>{var ye=Y();Or();wa();ae... L15: `;s+="Encryption: "+n+`\r ... L21: Private-MAC: `+B.digest().toHex()+`\r L22: `,s};ha.publicKeyToOpenSSH=function(e,t){var a="ssh-rsa";t=t||"";var r=xe.util.createBuffer();return yr(r,a),Et(r,e.e),Et(r,e.n),a+" "+xe.util.encode64(r.bytes())+" "+t};ha.private... L23: HEADERS: ${JSON.stringify(y,null,2)}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

app/src/mitm/server.jsView on unpkg · L13

app/open-sse/utils/outboundUrlGuard.jsView file

10* - "none" → no checks (explicit power-user full opt-in). L11: * - "public-only" → reject every private/LAN host. L12: * - "block-metadata" → allow private/LAN (local-first default) but reject ... L43: */ L44: import { isIP } from "node:net"; L45: import {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

app/open-sse/utils/outboundUrlGuard.jsView on unpkg · L10

app/src/lib/updater/updater.jsView file

1// Standalone detached updater process. L2: // Spawns `npm i -g <pkg>@latest`, exposes progress via tiny HTTP server. L3: // Survives after parent Next server exits (detached + unref by spawner). L4: L5: const { spawn } = require("child_process"); L6: const http = require("http");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

app/src/lib/updater/updater.jsView on unpkg · L1

src/cli/tray/tray.ps1View file

•path = src/cli/tray/tray.ps1 kind = build_helper sizeBytes = 4003 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/cli/tray/tray.ps1View on unpkg

app/.next-cli-build/server/app/favicon.ico.bodyView file

•path = app/.next-cli-build/server/app/favicon.ico.body kind = high_entropy_blob sizeBytes = 171663 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

app/.next-cli-build/server/app/favicon.ico.bodyView on unpkg

•path = app/.next-cli-build/server/app/favicon.ico.body kind = payload_in_excluded_dir sizeBytes = 171663 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

app/.next-cli-build/server/app/favicon.ico.bodyView on unpkg

app/.next-cli-build/server/chunks/8971.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in app/.next-cli-build/server/chunks/8971.js

app/.next-cli-build/server/chunks/8971.jsView on unpkg · L1

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node hooks/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node hooks/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

app/.next-cli-build/server/chunks/4306.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

app/.next-cli-build/server/chunks/4306.jsView on unpkg · L1

Findings

3 Critical8 High7 Medium8 Low

CriticalCritical Secretapp/.next-cli-build/server/chunks/4306.js

CriticalSecret Patternapp/.next-cli-build/server/chunks/4306.js

CriticalSecret Patternapp/.next-cli-build/server/chunks/8971.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processapp/open-sse/executors/devin-cli.js

HighShellapp/open-sse/handlers/ttsProviders/localDevice.js

HighSame File Env Network Executionapp/src/mitm/server.js

HighCloud Metadata Accessapp/open-sse/utils/outboundUrlGuard.js

HighRuntime Package Installapp/src/lib/updater/updater.js

HighShips High Entropy Blobapp/.next-cli-build/server/app/favicon.ico.body

High