registry / octomux / 1.2.0

octomux@1.2.0

⚠ Under review

[![CI](https://github.com/ShreyPaharia/octomux/actions/workflows/ci.yml/badge.svg)](https://github.com/ShreyPaharia/octomux/actions/workflows/ci.yml) [![npm version](https://img.shields.io/npm/v/octomux)](https://www.npmjs.com/package/octomux) [![license]

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 24 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

WildcardDependency

scanned 111 file(s), 2.05 MB of source, external domains: 127.0.0.1, acme.atlassian.net, api.github.com, base-ui.com, cdn.jsdelivr.net, claude.ai, cli.github.com, code.claude.com, code.visualstudio.com, cursor.com, docs.anthropic.com, formulae.brew.sh, github.com, react.dev, www.w3.org, your-co.atlassian.net, your-company.atlassian.net

Source & flagged code

14 flagged

package.jsonView file

Lines 40-80json

40 "build:diff-engine": "tsc -b packages/diff-engine",

41 "build:types": "tsc -b packages/types",

42 "build:test-fixtures": "tsc -b packages/test-fixtures",

43 "build:api-client": "tsc -b packages/api-client",

44 "build:server": "tsup --entry.index=server/index.ts --entry.startup=server/startup.ts --entry.cli-review=cli/review/index.ts --entry.orchestrator/mcp/server=server/orchestrator/mcp/server.ts --entry.agent-session/mcp/submit-result-server=server/agent-session/mcp/submit-result-server.ts --format esm --minify --out-dir dist-server --external better-sqlite3 --external node-pty --external ws --external @octomux/tmux-darwin-arm64 --external @octomux/tmux-darwin-x64 --external @octomux/tmux-linux-x64 --external @octomux/tmux-linux-arm64",

45 "start": "NODE_ENV=production node dist-server/index.js",

46 "test": "vitest run",

47 "test:watch": "vitest",

48 "test:e2e": "playwright test",

49 "test:e2e:ui": "playwright test --ui",

50 "test:mobile-terminal": "playwright test e2e/mobile-terminal-scroll.spec.ts",

51 "test:mobile-terminal:watch": "playwright test e2e/mobile-terminal-scroll.spec.ts --ui",

52 "screenshots:docs": "tsx scripts/seed-docs-demo.ts && OCTOMUX_SCREENSHOTS=1 OCTOMUX_DB_PATH=./data/docs-demo/tasks.db playwright test e2e/docs-screenshots.spec.ts",

53 "lint": "eslint .",

54 "lint:fix": "eslint . --fix",

55 "format": "prettier --write .",

56 "format:check": "prettier --check .",

57 "cli:build": "cd cli && tsc",

58 "typecheck": "tsc -b",

59 "prepublishOnly": "bun run build",

60 "postinstall": "bash scripts/postinstall.sh",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L60

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L60

61 "prepare": "husky",

62 "changelog": "conventional-changelog -p conventionalcommits -i CHANGELOG.md -s",

63 "build:electron": "tsc -p electron/tsconfig.json",

64 "dist:electron": "bun run build && bun run build:electron && electron-builder"

65 },

66 "lint-staged": {

67 "*.{ts,tsx}": [

68 "eslint --fix",

69 "prettier --write"

70 ],

71 "*.{json,md,css,html}": [

72 "prettier --write"

73 ]

74 },

75 "trustedDependencies": [

76 "better-sqlite3",

77 "husky",

78 "node-pty"

79 ],

80 "dependencies": {

dist-server/setup-status-PIO3H5GT.jsView file

Lines 1-2javascript

1import{b}from"./chunk-MLCNFNCF.js";import{d as S}from"./chunk-XQ7EQ3DU.js";import{b as p}from"./chunk-M7J44Q6F.js";import{a as d,b as g,c as f}from

dist/assets/editor.worker-DyuDvpVp.jsView file

Lines 1-26javascript

1(function(){"use strict";var Us,$s,Hs,Ws;class zs{constructor(){this.listeners=[],this.unexpectedErrorHandler=function(e){setTimeout(()=>{

bin/octomux.jsView file

Lines 1-46javascript

1#!/usr/bin/env node

3import { execFileSync, exec as execCb } from 'child_process';

4import { readFileSync, existsSync, mkdirSync, readdirSync, cpSync, rmSync } from 'fs';

5import { fileURLToPath } from 'url';

dist-server/chunk-7QEE4QK5.jsView file

Lines 1-15javascript

1import{a as C,b as k,c as S,d as p,e as b,g as w,l as R}from"./chunk-HSYWKRQH.js";import{a as g}from"./chunk-UWUVS7F4.js";import{a as

dist-server/index.jsView file

Lines 1-30javascript

1import{a as Yn,b as Qn,c as L,d as Zn,e as ti,f as ei}from"./chunk-XQ3CJFA4.js";import{c as dn}from"./chunk-KPCVZLAA.js";import{a as un,b as

scripts/rollup-to-feat.shView file

•path = scripts/rollup-to-feat.sh kind = build_helper sizeBytes = 3196 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/rollup-to-feat.shView on unpkg

dist/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View file

•path = dist/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2 kind = high_entropy_blob sizeBytes = 40404 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code