registry / linkshell-cli / 0.5.28
linkshell-cli@0.5.28
Remote terminal bridge for Claude Code / Codex / Gemini / Copilot — control from your phone
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 22 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedObfuscatedUrlStrings
Source & flagged code
14 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/cli/src/auth.jsView file
39patternName = supabase_service_key
severity = critical
line = 39
matchedText = const SU...P0";
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/cli/src/auth.jsView on unpkg · L39Findings
5 Critical6 High5 Medium6 Low
CriticalCritical Secretdist/cli/src/auth.js
CriticalSecret Patterndist/cli/src/auth.js
CriticalSecret Patterndist/cli/src/auth.d.ts
CriticalSecret Patternweb/assets/index-DABStn7S.js
CriticalSecret Patternsrc/auth.ts
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/cli/src/runtime/acp-relay.js
HighShelldist/cli/src/runtime/screen-fallback.js
HighCommand Output Exfiltrationdist/cli/src/commands/login.js
HighCopied Package Dependency Bridgedist/cli/src/commands/doctor.js
HighRuntime Package Installdist/cli/src/commands/upgrade.js
Affected versions and remediation
This report applies to linkshell-cli@0.5.28.
See all versions of linkshell-cli for other recorded verdicts.
- Review the evidence and your use of linkshell-cli@0.5.28 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.