registry / helm-runner / 0.1.0

helm-runner@0.1.0

Télécommande Helm — pilote ta machine (via Claude Agent SDK, sur ton abonnement) depuis l'app Helm.

Static Scan Results

scanned 23h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 30.5 KB of source, external domains: helm-api.omnixapps.workers.dev, www.apple.com

Source & flagged code

6 flagged

bin/helm-runner.mjsView file

Lines 1-49javascript

1#!/usr/bin/env node

2/**

3 * helm-runner — CLI de la télécommande Helm.

4 *

5 * npx helm-runner setup installe le service (auto-start) + affiche le code

6 * helm-runner run lance le runner (utilisé par le service)

7 * helm-runner reset re-paire (nouveau code)

8 * helm-runner uninstall retire le service

9 * helm-runner logs suit les logs

10 */

12import { execSync, spawn } from "node:child_process";

13import fs from "node:fs";

High

Child Process

Package source references child process execution.

bin/helm-runner.mjsView on unpkg · L11

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/helm-runner.mjsView on unpkg · L4

14import os from "node:os";

15import path from "node:path";

16import { fileURLToPath } from "node:url";

18const LABEL = "com.omnixapps.helm-runner";

19const HOME = os.homedir();

20const PLIST = path.join(HOME, "Library/LaunchAgents", `${LABEL}.plist`);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/helm-runner.mjsView on unpkg · L11

21const LOG = path.join(HOME, ".helm-runner.log");

22const CONFIG = path.join(HOME, ".helm-runner.json");

23const SELF = fileURLToPath(import.meta.url);

24const PKG_ROOT = path.join(path.dirname(SELF), "..");

26const cmd = process.argv[2] || "help";

28switch (cmd) {

29 case "run":

30 await import(new URL("../src/index.mjs", import.meta.url).href);

31 break;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/helm-runner.mjsView on unpkg · L29

32 case "setup":

33 setup();

34 break;

35 case "reset":

36 reset();

37 break;

38 case "uninstall":

39 uninstall();

40 break;

41 case "logs":

42 spawn("tail", ["-f", LOG], { stdio: "inherit" });

43 break;

44 default:

45 help();

46}

48function sh(c, opts = {}) {

49 return execSync(c, { stdio: ["ignore", "pipe", "ignore"], ...opts }).toString().trim();

src/index.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * Helm Runner — tourne sur la machine de l'utilisateur.

4 *

5 * 1. Se registre auprès du relais (obtient un code de pairing).

6 * 2. Affiche le code ; l'user le saisit dans l'app Helm → lie la machine à son compte.

7 * 3. Échange son claim contre un token, puis ouvre une WebSocket sortante vers le relais.

8 * 4. Reçoit les prompts/commandes du téléphone, exécute via l'agent, renvoie les logs.

9 *

10 * Conso IA = quota de l'abonnement Claude local (Phase 2, via l'Agent SDK).

Source & flagged code

6 flagged · loading source

bin/helm-runner.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code