registry / handmux / 0.17.0

handmux@0.17.0

A mobile vibe-coding cockpit — built on tmux: drive your live session, Claude Code / Codex — anything a terminal can run — from your phone.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

Manifest

CopyleftLicense

scanned 71 file(s), 1.68 MB of source, external domains: 127.0.0.1, cpolar.com, dashboard.cpolar.com, github.com, handmux.com, natapp.cn, reactjs.org, www.apple.com, www.cpolar.com, www.w3.org, your.site

Source & flagged code

6 flagged

src/routes/terminal.jsView file

Lines 17-57javascript

17// Covers the plain keys (Up, Tab, …) AND modifier combos on them — C-Up, M-Up, S-Left, C-Tab, C-S-Up, … —

18// so the 按键 editor can bind e.g. Ctrl+Arrow or Ctrl+Tab, not just Ctrl + a letter.

19const NAMED_KEY = new RegExp(`^(?:C-)?(?:M-)?(?:S-)?(?:${NAMED})$`);

20// Ctrl and/or Alt + one letter or digit — C-r, C-a, M-b, C-M-k. Must carry a modifier (never a bare char;

21// Shift+letter folds to the uppercase character, so no S- here).

22const CHAR_KEY = /^(?:C-)?(?:M-)?[a-z0-9]$/;

23export function isAllowedKey(k) {

24 if (typeof k !== 'string') return false;

25 return NAMED_KEY.test(k) || (CHAR_KEY.test(k) && k.includes('-'));

26}

28// Pause between typing the text and pressing Enter on a /send. A TUI like Claude Code needs a

29// beat to ingest the pasted line; without it, the Enter can fold into the input as a newline

30// instead of submitting. 120ms is imperceptible but enough to settle.

31const SUBMIT_GAP_MS = 120;

32const delay = (ms) => new Promise((r) => setTimeout(r, ms));

34export function terminalRoutes({ commands }) {

35 const r = express.Router();

37 r.get('/history', async (req, res, next) => {

38 if (!isPaneId(req.query.pane)) return res.status(400).json({ error: 'bad pane id' });

39 const lines = Math.min(Math.max(Number(req.query.lines) || 1000, 1), 5000);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/routes/terminal.jsView on unpkg · L37

40 try {

41 // Read the pane's state FIRST — whether it's on the alternate screen decides how we capture it.

42 const { width, height, cursorX, cursorY, cursorVisible, altScreen, mouseAware } = await commands.paneInfo(req.query.pane);

43 // An ALT-screen pane (a full-screen app: vim/less/htop) is a fixed height×width screen with NO

44 // scrollback. Asking tmux for history (-S -lines) there bleeds the MAIN screen's scrollback in

45 // ABOVE the app — you'd scroll up into terminal history that isn't the app's — and capping its

46 // trailing blank rows mangles the fixed screen (those blanks are real cells). So capture an alt

47 // pane as exactly its visible screen (lines=0) and skip the blank-trim. A normal pane still pulls

48 // `lines` of scrollback and caps the empty grid below the cursor (fresh shell = "prompt + a wall of

49 // blank rows") so the phone's bottom-anchored render shows content, not blank. See trimCapture.js.

50 const raw = await commands.capturePane(req.query.pane, altScreen ? 0 : lines);

51 const ansi = altScreen ? raw : capTrailingBlankRows(raw);

52 // The cursor's row counted from the BOTTOM of the (trimmed) capture. The live screen is the

53 // capture's last `height` rows, so the cursor sits `height-1-cursorY` rows above the bottom —

54 // less however many trailing blank rows capTrailingBlankRows dropped (all of them below the

55 // cursor). The client re-places xterm's cursor this many rows up from the seed's last row.

56 const rowsOf = (s) => (s.endsWith('\n') ? s.slice(0, -1) : s).split('\n').length;

57 const cur = {

src/cli/service.jsView file

Lines 1-22javascript

1// Boot/login autostart. The OS keeps the handmux SUPERVISOR (`__supervise`) alive; the supervisor

2// keeps server + tunnel alive — same model as a foreground run, just parented by launchd/systemd.

3// The intended config is baked into the service file as a base64 payload (self-contained: no reliance

4// on config.json). Text generators are pure (unit-tested); the launchctl/systemctl calls inject `exec`.

5import fs from 'node:fs';

6import path from 'node:path';

src/cli/tunnelClients.jsView file

Lines 1-22javascript

1// Resolve the natapp / cpolar client binaries, mirroring cloudflared.js. The two providers differ in one

2// hard way: cpolar publishes stable per-OS/arch zips, so we can AUTO-DOWNLOAD it (PATH → ~/.handmux/bin →

3// fetch+unzip); natapp gates its downloads behind a login, so there's no stable URL to fetch — we resolve an

4// already-installed binary and otherwise throw a clear "download it yourself into ~/.handmux/bin" message.

5// Pure mappers (assetForCpolar) are unit-tested offline; `which`/`fetchImpl` are injectable.

6import fs from 'node:fs';

7import path from

hooks/handmux-notify.shView file

•path = hooks/handmux-notify.sh kind = build_helper sizeBytes = 1915 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/handmux-notify.shView on unpkg

public/fonts/TWUnifont.woff2View file

•path = public/fonts/TWUnifont.woff2 kind = high_entropy_blob sizeBytes = 912400 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/fonts/TWUnifont.woff2View on unpkg

bin/handmux.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = handmux@0.15.0 matchedIdentity = npm:aGFuZG11eA:0.15.0 similarity = 0.742 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/handmux.jsView on unpkg

Source & flagged code

6 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code