registry / fleetlens / 0.15.2

fleetlens@0.15.2

fleetlens — local-only dashboard and usage tracker for Claude Code sessions and agent fleets

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 173 file(s), 2.35 MB of source, external domains: api.anthropic.com, keepachangelog.com, registry.npmjs.org, team.example.com

Source & flagged code

7 flagged

app/apps/web/app/api/ask/route.tsView file

Lines 1-39typescript

1/**

2 * Ask an LLM about a session.

3 *

4 * POST /api/ask

5 * { sessionId: string, question: string, model?: "haiku" | "sonnet" | "opus" }

6 *

7 * Returns a Server-Sent Events stream with:

8 * { type: "delta", text: string } // incremental text chunk

9 * { type: "done", totalTokens?: number } // stream finished

10 * { type: "error", message: string } // fatal error

11 *

12 * Under the hood, spawns `claude -p` as a subprocess using the user's

13 * local keychain auth (Max subscription). Session transcript is

14 * rendered to a compact text summary and injected as system prompt

15 * context. No API key management needed.

16 */

18import { getSession } from "@claude-lens/parser/fs";

19import { summarizeSessionForAI } from "@/lib/ai/session-summary";

20import { spawn } from "node:child_process";

21import {

High

Child Process

Package source references child process execution.

app/apps/web/app/api/ask/route.tsView on unpkg · L19

22 runClaudeUnderTmux,

23 tmuxRunnerAvailable,

24 TmuxRunError,

25 TmuxUnavailableError,

26} from "@claude-lens/entries/node";

28export const dynamic = "force-dynamic";

29export const runtime = "nodejs";

31const SYSTEM_PROMPT = `You are a session analyst for Claude Code transcripts. The user is viewing a session in the fleetlens dashboard and wants your help understanding it.

33You will receive a structured summary of the session, then the user's question about it. Respond directly and concisely in markdown.

35Some common tasks users ask about:

36- **Identify errors**: Find all errors, exceptions, rate limits, or failed operations

37- **Analyze performance**: Review tool execution times, token efficiency, caching ratio

38- **Trace conversation flow**: Follow the logic and key decision points

39- **Suggest improvements**: Recommend better prompting, tool usage, or workflow patterns

app/apps/web/app/api/pdf/[key]/route.tsView file

Lines 63-103typescript

64 try {

65 await renderToPdf(chrome, targetUrl, tmpPath, profileDir);

66 const bytes = await fs.readFile(tmpPath);

67 const today = new Date().toISOString

dist/index.jsView file

4742const dataDir = join2(homedir(), ".claude", "projects"); L4743: const child = spawn(process.execPath, [serverJs], { L4744: detached: true, ... L4746: env: { L4747: ...process.env, L4748: PORT: String(port), ... L4757: writePid(PID_FILE, pid, port, "0.15.2"); L4758: await waitForHealth(`http://localhost:${port}`, 3e4); L4759: return { pid, port };

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L4742

13import { readFileSync, writeFileSync, mkdirSync, unlinkSync } from "node:fs"; L14: import { execFileSync } from "node:child_process"; L15: import { dirname } from "node:path"; ... L913: "<command-name>", L914: "<local-command-stdout>", L915: "<local-command-caveat>", ... L960: try { L961: const parsed = JSON.parse(body); L962: if (parsed.type === "idle_notification") ... L1511: toTeammateId, L1512: body: msg.body, L1513: kind: "message"

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L13

5045try { L5046: execSync(`npm install -g ${PACKAGE_NAME}@latest --prefer-online`, { L5047: stdio: "pipe",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L5045

dist/daemon-worker.jsView file

24Cross-file remote execution chain: dist/daemon-worker.js spawns dist/index.js; helper contains network access plus dynamic code execution. L24: try { L25: snapshots.push(JSON.parse(line)); L26: } catch { ... L879: "<command-name>", L880: "<local-command-stdout>", L881: "<local-command-caveat>", ... L1477: toTeammateId, L1478: body: msg.body, L1479: kind: "message" ... L2487: init_calibration(); L2488: DEFAULT_ROOT = path.join(os.homedir(), ".claude", "projects"); L2489: FLEETLENS_RUNTIME_PROJECT_DIR = encodeProjectDir(path.join(os.homedir(), ".cclens", "runtime"));

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/daemon-worker.jsView on unpkg · L24

Source & flagged code

7 flagged · loading source

app/apps/web/app/api/ask/route.tsView file

19import { summarizeSessionForAI } from "@/lib/ai/session-summary"; L20: import { spawn } from "node:child_process"; L21: import {

High

Child Process

Package source references child process execution.

app/apps/web/app/api/ask/route.tsView on unpkg · L19

app/apps/web/app/api/pdf/[key]/route.tsView file

83L84: function digestExists(match: RegExpExecArray): boolean { L85: const monday = match[2];

High

Shell

Package source references shell execution.

app/apps/web/app/api/pdf/[key]/route.tsView on unpkg · L83

dist/index.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L4742

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L13

5045try { L5046: execSync(`npm install -g ${PACKAGE_NAME}@latest --prefer-online`, { L5047: stdio: "pipe",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L5045

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L13

dist/daemon-worker.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/daemon-worker.jsView on unpkg · L24

Findings

6 High4 Medium4 Low

HighChild Processapp/apps/web/app/api/ask/route.ts

HighShellapp/apps/web/app/api/pdf/[key]/route.ts

HighSame File Env Network Executiondist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

HighCross File Remote Execution Contextdist/daemon-worker.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

app/apps/web/app/api/ask/route.tsView file

Lines 1-39typescript

1/**

2 * Ask an LLM about a session.

3 *

4 * POST /api/ask

5 * { sessionId: string, question: string, model?: "haiku" | "sonnet" | "opus" }

6 *

7 * Returns a Server-Sent Events stream with:

8 * { type: "delta", text: string } // incremental text chunk

9 * { type: "done", totalTokens?: number } // stream finished

10 * { type: "error", message: string } // fatal error

11 *

12 * Under the hood, spawns `claude -p` as a subprocess using the user's

13 * local keychain auth (Max subscription). Session transcript is

14 * rendered to a compact text summary and injected as system prompt

15 * context. No API key management needed.

16 */

18import { getSession } from "@claude-lens/parser/fs";

19import { summarizeSessionForAI } from "@/lib/ai/session-summary";

20import { spawn } from "node:child_process";

21import {

High

Child Process

Package source references child process execution.

app/apps/web/app/api/ask/route.tsView on unpkg · L19

22 runClaudeUnderTmux,

23 tmuxRunnerAvailable,

24 TmuxRunError,

25 TmuxUnavailableError,

26} from "@claude-lens/entries/node";

28export const dynamic = "force-dynamic";

29export const runtime = "nodejs";

31const SYSTEM_PROMPT = `You are a session analyst for Claude Code transcripts. The user is viewing a session in the fleetlens dashboard and wants your help understanding it.

33You will receive a structured summary of the session, then the user's question about it. Respond directly and concisely in markdown.

35Some common tasks users ask about:

36- **Identify errors**: Find all errors, exceptions, rate limits, or failed operations

37- **Analyze performance**: Review tool execution times, token efficiency, caching ratio

38- **Trace conversation flow**: Follow the logic and key decision points

39- **Suggest improvements**: Recommend better prompting, tool usage, or workflow patterns

app/apps/web/app/api/pdf/[key]/route.tsView file

Lines 63-103typescript

64 try {

65 await renderToPdf(chrome, targetUrl, tmpPath, profileDir);

66 const bytes = await fs.readFile(tmpPath);

67 const today = new Date().toISOString

dist/index.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L4742

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L13

5045try { L5046: execSync(`npm install -g ${PACKAGE_NAME}@latest --prefer-online`, { L5047: stdio: "pipe",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L5045

dist/daemon-worker.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/daemon-worker.jsView on unpkg · L24