registry / getleash / 0.8.0

getleash@0.8.0

See what your Claude Code agents did last night. Fleet report, costs, loops, dead crons — in 10 seconds. Free cloud dashboard across machines.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 79.0 KB of source, external domains: api.cloudflare.com, api.github.com, api.render.com, api.vercel.com, backboard.railway.app, dash.cloudflare.com, dashboard.render.com, getleash.vercel.app, github.com, vercel.com

Source & flagged code

1 flagged

dist/index.jsView file

Lines 23-63javascript

23 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

24 }

25 return to;

26};

27var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

28 // If the importer is in node compatibility mode or this is not an ESM

29 // file that has been converted to a CommonJS file using a Babel-

30 // compatible transform (i.e. "__esModule" has not been set), then set

31 // "default" to the CommonJS "module.exports" for node compatibility.

32 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

33 mod

34));

36// src/scan/github.ts

37var github_exports = {};

38__export(github_exports, {

39 cronIntervalSec: () => cronIntervalSec,

40 enrichCloudAgents: () => enrichCloudAgents,

41 resolveGithubToken: () => resolveGithubToken

42});

43function resolveGithubToken() {

44 for (const env of [process.env.GITHUB_TOKEN, process.env.GH_TOKEN]) {

45 if (env && TOKEN_RE.test(env.trim())) return env.trim();

46 }

47 for (const bin of GH_CANDIDATES) {

48 try {

49 const out = (0, import_node_child_process4.execFileSync)(bin, ["auth", "token"], { encoding: "utf8", timeout: 3e3, stdio: ["ignore", "pipe", "ignore"] }).trim();

50 if (TOKEN_RE.test(out)) return out;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L43

51 } catch {

52 continue;

53 }

54 }

55 return null;

56}

57function cronIntervalSec(cron) {

58 const parts = cron.trim().split(/\s+/);

59 if (parts.length < 5) return null;

60 const [, hour, dom, mon, dow] = parts;

61 if (mon !== "*") return 35 * 86400;

62 if (dom !== "*") return 32 * 86400;

63 if (dow !== "*") return 8 * 86400;

Source & flagged code

1 flagged · loading source

dist/index.jsView file

43function resolveGithubToken() { L44: for (const env of [process.env.GITHUB_TOKEN, process.env.GH_TOKEN]) { L45: if (env && TOKEN_RE.test(env.trim())) return env.trim(); ... L48: try { L49: const out = (0, import_node_child_process4.execFileSync)(bin, ["auth", "token"], { encoding: "utf8", timeout: 3e3, stdio: ["ignore", "pipe", "ignore"] }).trim(); L50: if (TOKEN_RE.test(out)) return out; ... L70: async function api(pathname, token) { L71: const res = await fetch("https://api.github.com" + pathname, { L72: headers: { ... L79: if (!res.ok) throw new Error(`github ${res.status}`); L80: return res.json(); L81: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L43

Findings

3 Medium4 Low

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/index.jsView file

Lines 23-63javascript

23 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

24 }

25 return to;

26};

27var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

28 // If the importer is in node compatibility mode or this is not an ESM

29 // file that has been converted to a CommonJS file using a Babel-

30 // compatible transform (i.e. "__esModule" has not been set), then set

31 // "default" to the CommonJS "module.exports" for node compatibility.

32 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

33 mod

34));

36// src/scan/github.ts

37var github_exports = {};

38__export(github_exports, {

39 cronIntervalSec: () => cronIntervalSec,

40 enrichCloudAgents: () => enrichCloudAgents,

41 resolveGithubToken: () => resolveGithubToken

42});

43function resolveGithubToken() {

44 for (const env of [process.env.GITHUB_TOKEN, process.env.GH_TOKEN]) {

45 if (env && TOKEN_RE.test(env.trim())) return env.trim();

46 }

47 for (const bin of GH_CANDIDATES) {

48 try {

49 const out = (0, import_node_child_process4.execFileSync)(bin, ["auth", "token"], { encoding: "utf8", timeout: 3e3, stdio: ["ignore", "pipe", "ignore"] }).trim();

50 if (TOKEN_RE.test(out)) return out;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L43

51 } catch {

52 continue;

53 }

54 }

55 return null;

56}

57function cronIntervalSec(cron) {

58 const parts = cron.trim().split(/\s+/);

59 if (parts.length < 5) return null;

60 const [, hour, dom, mon, dow] = parts;

61 if (mon !== "*") return 35 * 86400;

62 if (dom !== "*") return 32 * 86400;

63 if (dow !== "*") return 8 * 86400;