registry / kandown / 0.17.1

kandown@0.17.1

File-based Kanban engine backed by Markdown. Zero backend, AI-agent friendly.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 338 KB of source, external domains: 127.0.0.1, github.com, react.dev

Oversized source lightweight scan

bin/tui.js2.59 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStringsUrlStrings127.0.0.1github.comreact.dev

Source & flagged code

6 flagged

bin/kandown.jsView file

Lines 24-84javascript

24 * → migrateTasksToTopLevel — silently moves legacy .kandown/tasks/ → ./tasks/

25 * → cmdInit — installs `.kandown` and top-level `tasks/`

26 * → cmdUpdate — refreshes installed kandown.html

27 * → injectServerRoot — injects the CLI server root into single-file HTML

28 * → createServeServer — creates the local zero-dependency HTTP server

29 * → readDaemonMetadata — reads per-project daemon status metadata

30 * → startDaemon — starts/reconnects the per-project web daemon

31 * → stopDaemon — stops the per-project web daemon

32 * → cmdDaemon — daemon lifecycle command router

33 * → cmdServe — starts/reconnects the daemon, opens web UI, and launches the board TUI

34 * → main — dispatches CLI commands

35 *

36 * @exports none

37 */

38/* eslint-disable no-console */

39// 📖 DEV=false prevents Ink from loading react-devtools-core (CJS-only, breaks ESM).

40// Must be set BEFORE any imports because ESM hoists all import statements.

41process.env.DEV = 'false';

42// 📖 Polyfill browser globals that some bundled modules expect.

43if (typeof globalThis.self === 'undefined') Object.defineProperty(globalThis, 'self', { value: globalThis });

44if (typeof globalThis.window === 'undefined') Object.defineProperty(globalThis, 'window', { value: globalThis });

45// 📖 Make require() available in this ESM module so bundled __require() shims work.

46// tsup's __require checks `typeof require !== "undefined"` — this makes it truthy.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kandown.jsView on unpkg · L44

47import { createRequire } from 'node:module';

48globalThis.require = createRequire(import.meta.url);

50import { fileURLToPath } from 'node:url';

51import { createServer } from 'node:http';

52import { dirname, join, resolve } from 'node:path';

53import {

54 existsSync,

55 mkdirSync,

56 copyFileSync,

57 readFileSync,

58 writeFileSync,

59 readdirSync,

60 statSync,

61 unlinkSync,

62 renameSync,

63 rmdirSync,

64} from 'node:fs';

65import { spawnSync, spawn, execSync } from 'node:child_process';

66import { createConnection } from 'node:net';

High

Child Process

Package source references child process execution.

bin/kandown.jsView on unpkg · L64

68const __filename = fileURLToPath(import.meta.url);

69const __dirname = dirname(__filename);

70const PKG_ROOT = resolve(__dirname, '..');

71// 📖 Default localhost range for the zero-config `kandown` web UI server.

72// 📖 Single source of truth for the daemon port range. Each kandown project

73// gets its own daemon on the first free port in this range, so multiple

74// projects can run in parallel (A=2048, B=2050, C=2051, ...).

75const START_PORT_RANGE = 2048;

76const END_PORT_RANGE = 2150;

77const DAEMON_FILE = 'daemon.json';

79/**

80 * 📖 Ports that Chromium/Firefox/Safari refuse to load (net::ERR_UNSAFE_PORT).

81 * These are reserved for well-known services (NFS, ssh, smtp, X11, ...).

82 * Browsers block navigation to them with no recourse, so a daemon listening

83 * on one of these appears dead in the browser even though it serves fine via

84 * curl. We MUST skip them when allocating ports. The most common victim in

Lines 215-255javascript

215 stdio: ['pipe', 'pipe', 'pipe'],

216 env: { ...process.env },

217 detached: false,

218 });

219 child.stderr.on('data', () => {}); // silence npm noise

220 child.stdout.on('data', () => {});

Lines 2049-2089javascript

2049 if (pids.length === 0) return null;

2050 pid = parseInt(pids[0], 10);

2051 if (isNaN(pid) || pid === process.pid) return null;

2052

2053 // Check if it's a kandown process

bin/tui.jsView file

•path = bin/tui.js kind = oversized_source_file sizeBytes = 2712508 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bin/tui.jsView on unpkg

•path = bin/tui.js kind = oversized_cli_entrypoint sizeBytes = 2712508 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/tui.jsView on unpkg

Source & flagged code

6 flagged · loading source

bin/kandown.jsView file

64} from 'node:fs'; L65: import { spawnSync, spawn, execSync } from 'node:child_process'; L66: import { createConnection } from 'node:net';

High

Child Process

Package source references child process execution.

bin/kandown.jsView on unpkg · L64

2069// macOS L2070: cwd = execSync(`lsof -p ${pid} -Fn -a -d cwd 2>/dev/null | grep '^n' | cut -c2-`, { encoding: 'utf8', timeout: 2000, shell: true }).trim(); L2071: }

High

Shell

Package source references shell execution.

bin/kandown.jsView on unpkg · L2069

235tuiDone('✗', `${c.yellow}Auto-update failed${c.reset} — continuing with current version`); L236: log(` Run ${c.cyan}npm install -g kandown${c.reset} to upgrade manually`); L237: log(''); ... L242: const postVersion = await new Promise((resolve) => { L243: const child = spawn('npm', ['view', 'kandown', 'version'], { L244: timeout: 5000,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/kandown.jsView on unpkg · L235

44if (typeof globalThis.window === 'undefined') Object.defineProperty(globalThis, 'window', { value: globalThis }); L45: // 📖 Make require() available in this ESM module so bundled __require() shims work. L46: // tsup's __require checks `typeof require !== "undefined"` — this makes it truthy.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kandown.jsView on unpkg · L44

bin/tui.jsView file

•path = bin/tui.js kind = oversized_source_file sizeBytes = 2712508 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bin/tui.jsView on unpkg

•path = bin/tui.js kind = oversized_cli_entrypoint sizeBytes = 2712508 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/tui.jsView on unpkg

Findings

4 High5 Medium4 Low

HighChild Processbin/kandown.js

HighShellbin/kandown.js

HighRuntime Package Installbin/kandown.js

HighOversized Source Filebin/tui.js

MediumDynamic Requirebin/kandown.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Cli Entrypointbin/tui.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

bin/kandown.jsView file

Lines 24-84javascript

24 * → migrateTasksToTopLevel — silently moves legacy .kandown/tasks/ → ./tasks/

25 * → cmdInit — installs `.kandown` and top-level `tasks/`

26 * → cmdUpdate — refreshes installed kandown.html

27 * → injectServerRoot — injects the CLI server root into single-file HTML

28 * → createServeServer — creates the local zero-dependency HTTP server

29 * → readDaemonMetadata — reads per-project daemon status metadata

30 * → startDaemon — starts/reconnects the per-project web daemon

31 * → stopDaemon — stops the per-project web daemon

32 * → cmdDaemon — daemon lifecycle command router

33 * → cmdServe — starts/reconnects the daemon, opens web UI, and launches the board TUI

34 * → main — dispatches CLI commands

35 *

36 * @exports none

37 */

38/* eslint-disable no-console */

39// 📖 DEV=false prevents Ink from loading react-devtools-core (CJS-only, breaks ESM).

40// Must be set BEFORE any imports because ESM hoists all import statements.

41process.env.DEV = 'false';

42// 📖 Polyfill browser globals that some bundled modules expect.

43if (typeof globalThis.self === 'undefined') Object.defineProperty(globalThis, 'self', { value: globalThis });

44if (typeof globalThis.window === 'undefined') Object.defineProperty(globalThis, 'window', { value: globalThis });

45// 📖 Make require() available in this ESM module so bundled __require() shims work.

46// tsup's __require checks `typeof require !== "undefined"` — this makes it truthy.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kandown.jsView on unpkg · L44

47import { createRequire } from 'node:module';

48globalThis.require = createRequire(import.meta.url);

50import { fileURLToPath } from 'node:url';

51import { createServer } from 'node:http';

52import { dirname, join, resolve } from 'node:path';

53import {

54 existsSync,

55 mkdirSync,

56 copyFileSync,

57 readFileSync,

58 writeFileSync,

59 readdirSync,

60 statSync,

61 unlinkSync,

62 renameSync,

63 rmdirSync,

64} from 'node:fs';

65import { spawnSync, spawn, execSync } from 'node:child_process';

66import { createConnection } from 'node:net';

High

Child Process

Package source references child process execution.

bin/kandown.jsView on unpkg · L64

68const __filename = fileURLToPath(import.meta.url);

69const __dirname = dirname(__filename);

70const PKG_ROOT = resolve(__dirname, '..');

71// 📖 Default localhost range for the zero-config `kandown` web UI server.

72// 📖 Single source of truth for the daemon port range. Each kandown project

73// gets its own daemon on the first free port in this range, so multiple

74// projects can run in parallel (A=2048, B=2050, C=2051, ...).

75const START_PORT_RANGE = 2048;

76const END_PORT_RANGE = 2150;

77const DAEMON_FILE = 'daemon.json';

79/**

80 * 📖 Ports that Chromium/Firefox/Safari refuse to load (net::ERR_UNSAFE_PORT).

81 * These are reserved for well-known services (NFS, ssh, smtp, X11, ...).

82 * Browsers block navigation to them with no recourse, so a daemon listening

83 * on one of these appears dead in the browser even though it serves fine via

84 * curl. We MUST skip them when allocating ports. The most common victim in

Lines 215-255javascript

215 stdio: ['pipe', 'pipe', 'pipe'],

216 env: { ...process.env },

217 detached: false,

218 });

219 child.stderr.on('data', () => {}); // silence npm noise

220 child.stdout.on('data', () => {});

Lines 2049-2089javascript

2049 if (pids.length === 0) return null;

2050 pid = parseInt(pids[0], 10);

2051 if (isNaN(pid) || pid === process.pid) return null;

2052

2053 // Check if it's a kandown process

bin/tui.jsView file

•path = bin/tui.js kind = oversized_source_file sizeBytes = 2712508 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bin/tui.jsView on unpkg

•path = bin/tui.js kind = oversized_cli_entrypoint sizeBytes = 2712508 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/tui.jsView on unpkg