registry / klaudius / 0.17.5

klaudius@0.17.5

Scaffold and maintain a Klaudius project — an autonomous web agency pipeline that runs on Claude Code (find, build, deploy, outreach end-to-end).

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 3 file(s), 159 KB of source, external domains: account.microsoft.com, accounts.zoho.com, api.cloudflare.com, api.netlify.com, api.supabase.com, api.telegram.org, api.twilio.com, api.vercel.com, app.fastmail.com, app.netlify.com, console.cloud.google.com, console.twilio.com, dash.cloudflare.com, en.wikipedia.org, klaudius.dev, myaccount.google.com, nodejs.org, places.googleapis.com, registry.npmjs.org, supabase.com, vercel.com, www.python.org, xxxx.supabase.co

Source & flagged code

3 flagged

dist/bin.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{a as Z,b as Ve,c as Be,d as b,f as Ye,g as We,i as B,j as ze,k as qe}from"./chunk-F4Q5743K.js";import{Command as Us}from"commander";import{spawn as Je}from"child_process";import C from"picocolors";function Y(){let e=process.version,n=/^v(\d+)\.(\d+)\.(\d+)/.exec(e);if(!n)return{ok:!1,message:`Could not parse the Node.js version string ("${e}"). Klaudius requires Node.js 22.15 or newer \u2014 install from https://nodejs.org/.`};let s=parseInt(n[1],10),t=parseInt(n[2],10),a=parseInt(n[3],10),i=`${s}.${t}.${a}`;return s<22||s===22&&t<15?{ok:!1,version:i,major:s,minor:t,message:`Your instal ...

3`));let n=[];n.push(nn());let s=await ee();n.push(sn(s)),n.push(await on(s.command)),n.push(await an()),n.push(await rn());for(let a of n){let i=a.status==="ok"?C.green("\u2713"):C.red

4`)[0]||"ok"}:{name:"pip available",status:"fail",detail:`${n.join(" ")} -m pip not runnable`,nextAction:`Add pip to your Python: \`${n.join(" ")} -m ensurepip --upgrade\` (or reinstall Python from python.org, which bundles pip).`}}async function an(){let e=process.platform==="win32",n=await xe("npm",["--version"],e);return n.code!==0?{name:"npm / npx available",status:"fail"

5Please share that file so we can trace what happened.`);return t}var ve="claude-code";function Ze(e){if(e==="claude-code"||e==="codex")return e}var Oe="vercel";function et(e){if(e==="vercel"||e==="cloudflare"||e==="netlify")return e}function me(e){let n=[],s=a=>{n.push(""),n.push("# "+"=".repeat(60)),n.push(`# ${a}`),n.push("# "+"=".repeat(60)),n.push("")},t=(a,i)=>{if(i==null||i===""){n.push(`# ${a}=`);return}let l=String(i);if(/[\s"'`$\\#&|<>;()*?\[\]{}!~]/.test

6`)+`

7`}function he(e){let n={mcpServers:{supabase:{command:"npx",args:["-y","@supabase/mcp-server-supabase@latest",`--project-ref=${e.supabaseProjectRef}`],env:{SUPABASE_ACCESS_TOKEN:e.supabasePat,NODE_OPTIONS:"--use-system-ca"}}}};return JSON.stringify(n,null,2)+`

8`}function ge(e){let n=e.supabaseProjectRef,s=un(e.supabasePat);return["# Codex MCP config \u2014 generated by `npx klaudius init` / `configure`.","# Edit freely. NEVER commit this file \u2014 .gitignore already excludes it.","# See `.codex/config.toml.example` for the documented format.","","[mcp_servers.supabase]",'command = "npx"',`args = ["-y", "@supabase/mcp-server-supabase@latest", "--project-ref=${n}"]`,`env = { SUPABASE_ACCESS_TOKEN = "${

9`)}function un(e){return e.replace(/\\/g,"\\\\").replace(/"/g,'\\"')}var tt=[{key:"AI_AGENT",value:"claude-code",comment:"Which AI coding agent drives this install. Pre-codex installs were Claude Code by default \u2014 this records that explicitly so `update` re-fetches the matching template tarball and `doctor` checks the right CLI."},{key:"PRICING_TERMS",value:"one-off, no monthly fees"

10`)?"":`

11`,i=["","# "+"=".repeat(60),"# Backfilled by `klaudius update` (new template env keys)","# "+"=".repeat(60)];for(let l of t)i.push(""),l.comment&&i.push(`# ${l.comment}`),i.push(pn(l.key,l.value));return e+a+i.join(`

12`)+`

13`}function fn(e){return e.length>=2&&e.startsWith('"')&&e.endsWith('"')?e.slice(1,-1).replace(/\\\\/g,"\\").replace(/\\"/g,'"').replace(/\\\$/g,"$").replace(/\\`/g,"`"):e.length>=2&&e.startsWith("'")&&e.endsWith("'")?e.slice(1,-1):e}function

14`)){let t=s.trim();if(!t||t.startsWith("#"))continue;let a=t.indexOf("=");if(a===-1)continue;let i=t.slice(0,a

15`,"utf-8")}function rt(e,n){let s=new Date().toISOString();return{version:1,templateVersion:e,installedAt:s,updatedAt:s,files:n}}async function we(e,n=e){let s=await Pn(e,{withFileTypes:!0}),t=[];for(let a of s){let i=lt(e,a.name);a.isDirectory()?t.push(...await we(i,n)):a.isFile()&&t.push(bn(n,i))}return t}async function ct(e){let n=await we(e),s={};for(let t of n)ye.has(t)||(s[t]=await te(lt(e,t)));return s}import{copyFile as Tn,mkdir as dt,mkdtemp as _n,readdir as ut,rm as pt}from"fs/promises";import{tmpdir as Cn}from"os";import{dirname as In,join as Ae}from"path";import{Readable as Sn}from ...

16`+W.bold(W.cyan(e))),detail:e=>console.log(W.dim(" "+e))};var vn="https://registry.npmjs.org/klaudius/latest";async function On(e=1500){let n=new AbortController,

17`)};try{let i=await fetch("https://places.googleapis.com/v1/places:searchText",{method:"POST",headers:{"Content-Type":"application/json","X-Goog-Api-Key":t,"X-Goog-FieldMask":"places.id"},body:JSON.stringify({textQuery:"x"})});if(i.ok)return{ok:!0};if(i.status===429)return{ok:!0};let l={};try{l=await i.json()}catch{}let c=l.error?.message??"",p=l.error?.status??"";return i.status===400&&(p==="PERMISSION_DENIED"||/Places API $New$ has not been enabled|API_KEY_SERVICE_BLOCKED/i.test(c))?{ok:!1,message:"Key is valid, but Places API (New) is not enabled on its Cloud project. Open https://console ...

18 \u2022 The app password is wrong, expired, or for a different provider.

19 \u2022 The email address doesn't match the account that issued the password.

20 \u2022 2FA is required but no app-specific password was generated.`:t.includes("etimedout")||t.includes("timeout")?`${n} server didn't respond in time. Check the host/port, or your network.`:t.includes("enotfound")||t.includes("getaddrinfo")?`${n} host could not be resolved. Check the host setting.`:`${n} check failed: ${s}`}async

21`+n;return Yn.some(t=>t.test(s))}function St(e){return new Promise(n=>setTimeout(n,e))}function Wn(e,n,s){return new Promise(t=>{let a=s.shell?Le([e,...n].join(" "),{cwd:s.cwd,stdio:["ignore","pipe","pipe"],shell:!0,env:s.env??process.env}):Le(e,n,{cwd:s.cwd,stdio:["ignore","pipe","pipe"],shell:!1,env:s.env??process.env}),i="",l="";a.stdout?.on("data",c=>{let p=c.toString();i+=p,process.stdout.write(p)}),a.stderr?.on("data",c=>{let p=c.toString();l+=p,process.stderr.write(p)}),a.on("close",c=>t({code:c??1,stdout:i,stderr:l})),a.on("error",c=>t({code:1,stdout:i,stderr:l+c.message}))})}async fun ...

Long lines were clipped for display.

Source & flagged code

3 flagged · loading source

dist/bin.jsView file

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin.jsView on unpkg · L1

1#!/usr/bin/env node L2: import{a as Z,b as Ve,c as Be,d as b,f as Ye,g as We,i as B,j as ze,k as qe}from"./chunk-F4Q5743K.js";import{Command as Us}from"commander";import{spawn as Je}from"child_process";im... L3: `));let n=[];n.push(nn());let s=await ee();n.push(sn(s)),n.push(await on(s.command)),n.push(await an()),n.push(await rn());for(let a of n){let i=a.status==="ok"?C.green("\u2713"):C... ... L14: `)){let t=s.trim();if(!t||t.startsWith("#"))continue;let a=t.indexOf("=");if(a===-1)continue;let i=t.slice(0,a).trim(),l=fn(t.slice(a+1).trim());n[i]=l}return n}function st(e){let ... L15: `,"utf-8")}function rt(e,n){let s=new Date().toISOString();return{version:1,templateVersion:e,installedAt:s,updatedAt:s,files:n}}async function we(e,n=e){let s=await Pn(e,{withFile... L16: `+W.bold(W.cyan(e))),detail:e=>console.log(W.dim(" "+e))};var vn="https://registry.npmjs.org/klaudius/latest";async function On(e=1500){let n=new AbortController,s=setTimeout(()=...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin.jsView on unpkg · L1

Findings

3 High3 Medium5 Low

HighChild Processdist/bin.js

HighSame File Env Network Executiondist/bin.js

HighCommand Output Exfiltrationdist/bin.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/bin.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

3`));let n=[];n.push(nn());let s=await ee();n.push(sn(s)),n.push(await on(s.command)),n.push(await an()),n.push(await rn());for(let a of n){let i=a.status==="ok"?C.green("\u2713"):C.red

6`)+`

10`)?"":`

12`)+`

14`)){let t=s.trim();if(!t||t.startsWith("#"))continue;let a=t.indexOf("=");if(a===-1)continue;let i=t.slice(0,a

16`+W.bold(W.cyan(e))),detail:e=>console.log(W.dim(" "+e))};var vn="https://registry.npmjs.org/klaudius/latest";async function On(e=1500){let n=new AbortController,

18 \u2022 The app password is wrong, expired, or for a different provider.

19 \u2022 The email address doesn't match the account that issued the password.

Long lines were clipped for display.