registry / open-controller / 1.1.9

open-controller@1.1.9

OpenCode plugin for Windows PC control via MCP

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 10.9 KB of source

Source & flagged code

3 flagged

dist/updater.jsView file

Lines 1-21javascript

1import { execSync, spawn } from "child_process";

2import { existsSync, readFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/updater.jsView on unpkg · L1

3import { join, dirname } from "path";

4import { homedir } from "os";

5const NPM_TIMEOUT_MS = 60_000;

6const CHECK_TIMEOUT_MS = 30_000;

7const PKG_NAME = "open-controller";

8const isDisabled = () => {

9 const v = process.env.OPENCONTROLLER_DISABLE_UPDATER;

10 return v === "1" || v === "true";

11};

12const isCI = () => !!(process.env.CI ||

13 process.env.CONTINUOUS_INTEGRATION ||

14 process.env.GITHUB_ACTIONS ||

15 process.env.GITLAB_CI);

16const readLocalVersion = () => {

17 try {

18 const pkgPath = join(dirname(new URL(import.meta.url).pathname.replace(/^\//, "")), "..", "package.json");

19 const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));

20 if (pkg.name === PKG_NAME && pkg.version)

21 return pkg.version;

Lines 34-78javascript

34 }

35 catch {

36 return null;

37 }

38};

39const compareSemver = (a, b) => {

40 const pa = a.replace(/^v/

Source & flagged code

3 flagged · loading source

dist/updater.jsView file

1import { execSync, spawn } from "child_process"; L2: import { existsSync, readFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/updater.jsView on unpkg · L1

58windowsHide: true, L59: shell: "cmd.exe", L60: });

High

Shell

Package source references shell execution.

dist/updater.jsView on unpkg · L58

54try { L55: execSync(`npm install -g ${PKG_NAME} --silent --no-audit --no-fund --no-progress`, { L56: encoding: "utf8",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/updater.jsView on unpkg · L54

Findings

3 High2 Medium4 Low

HighChild Processdist/updater.js

HighShelldist/updater.js

HighRuntime Package Installdist/updater.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

dist/updater.jsView file

Lines 1-21javascript

1import { execSync, spawn } from "child_process";

2import { existsSync, readFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/updater.jsView on unpkg · L1

3import { join, dirname } from "path";

4import { homedir } from "os";

5const NPM_TIMEOUT_MS = 60_000;

6const CHECK_TIMEOUT_MS = 30_000;

7const PKG_NAME = "open-controller";

8const isDisabled = () => {

9 const v = process.env.OPENCONTROLLER_DISABLE_UPDATER;

10 return v === "1" || v === "true";

11};

12const isCI = () => !!(process.env.CI ||

13 process.env.CONTINUOUS_INTEGRATION ||

14 process.env.GITHUB_ACTIONS ||

15 process.env.GITLAB_CI);

16const readLocalVersion = () => {

17 try {

18 const pkgPath = join(dirname(new URL(import.meta.url).pathname.replace(/^\//, "")), "..", "package.json");

19 const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));

20 if (pkg.name === PKG_NAME && pkg.version)

21 return pkg.version;

Lines 34-78javascript

34 }

35 catch {

36 return null;

37 }

38};

39const compareSemver = (a, b) => {

40 const pa = a.replace(/^v/