registry / elephant-tusk-runner / 1.0.2

elephant-tusk-runner@1.0.2

⚠ Under review

CLI Terminal Dashboard using Tusk runner. With user interface built into it - 'elephant tusk <port>' for UI.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 222 KB of source, external domains: apache.org, apache.orglicense-2.0, coodesrc.com, github.com, githubusercontent.com, opensource.org, shields.io

Source & flagged code

6 flagged

bin/tusk.jsView file

Lines 1-59javascript

1#!/usr/bin/env node

3/**

4 * Elephant Project Orchestration Studio - Unified CLI Runner Platform

5 * Location: bin/tusk.js

6 * Feature: Resolved asynchronous control flow bypassing via explicit top-level

7 * async main wrapper constraints.

8 */

10import { spawn, execSync, exec } from 'node:child_process';

11import path from 'node:path';

High

Child Process

Package source references child process execution.

bin/tusk.jsView on unpkg · L9

12import fs from 'node:fs/promises';

13import { fileURLToPath } from 'node:url';

14import { promisify } from 'node:util';

15import readline from 'node:readline';

17import {

18 displayLiveSystemDiagnostics,

19 purgeDevelopmentSystemClutter,

20 generateSecureKeysAndCopyToClipboard,

21 establishAbsoluteSymbolicLinks,

22 identifyHeavyStorageDirectories,

23 triggerConventionalCommitWizard,

24 pruneMergedTrackingBranches,

25 executeFastProgressTimestampCommit,

26 executeAdminTerminalCommandAddition,

27 extractCodebaseTechnicalDebt,

28 decoupleSubroutines,

29 exploreLocalMysqlDatabaseLayers,

30 processDeveloperBugSubmissionFlow,

31 compressTargetWorkspaceEntity,

32 // runThreatSignaturesScanMatrix,

33 locateForgottenFileWithWildcard,

34 diagnoseAndManageSystemPerformanceStress,

35 runBinarySandboxHeuristicsAudit

36 } from './utils.js';

38import {runThreatSignaturesScanMatrix} from './threat.js';

40const execAsync = promisify(exec);

41const __filename = fileURLToPath(import.meta.url);

High

Shell

Package source references shell execution.

bin/tusk.jsView on unpkg · L39

42const __dirname = path.dirname(__filename);

43const rootDirectory = path.resolve(__dirname, '..');

45const consoleArgumentsMatrix = process.argv.slice(2);

46const structuralSubcommandToken = consoleArgumentsMatrix[0] ? consoleArgumentsMatrix[0].toLowerCase().trim() : '';

48const MASTER_SERVER_PORT = 4201;

50/**

51 * PRIMARY TASK RUNNER CONTEXT ENTRY POINT

52 * Wraps validation metrics securely to isolate and block command slip-through.

53 */

54async function main() {

55 // 1. Initialize Interception Mappings & Resolve Local Token References

56 let localLicenseTokenValue = '';

57 const remoteLicenseServerEndpoint = 'https://coodesrc.com/tusk/status.php';

58 const localLicenseFilePath = path.join(process.env.HOME || process.env.USERPROFILE || '.', '.tusk-license');

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

bin/tusk.jsView on unpkg · L9

Lines 703-743javascript

703

704// const { spawn } = require('child_process');

705

706function dispatchInteractiveScaffoldBootstrapTransaction(frameworkKey) {

707 const key = frameworkKey.toLowerCase();

708 const targetUrl = frameworkBoilerplateRepositoryRoutes[key];

server.jsView file

Lines 1-21javascript

1// process.env.NODE_PTY_FORCE_WINPTY = '1';

2import express from 'express';

3// import { exec } from 'child_process';

4import { spawn, exec, execSync } from 'child_process';

5import path from 'path';

6import

bin/threat.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = elephant-tusk-runner@1.0.1 matchedIdentity = npm:ZWxlcGhhbnQtdHVzay1ydW5uZXI:1.0.1 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/threat.jsView on unpkg

Source & flagged code

6 flagged · loading source

bin/tusk.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code