openchamber-sogawugu@1.21.3
[ {
L54: return `'${String(value).replace(/'/g, "''")}'`;
High
3Trigger-reachable persistence chain: scripts.start -> bin/cli.js -> bin/lib/commands-startup.js -> bin/lib/cli-startup.js
L3: import path from 'path';
L4: import { spawnSync } from 'child_process';
L5: import { DEFAULT_PORT } from './cli-args.js';
...
L13: function getStartupServicePaths() {
L14: if (process.platform === 'darwin') {
L15: return {
L16: platform: 'macos',
L17: servicePath: path.join(os.homedir(), 'Library', 'LaunchAgents', `${STARTUP_SERVICE_ID}.plist`),
L18: };
...
L78: const env = options.envSnapshot === false ? {} : Object.fromEntries(
L79: Object.entries(process.env)
L80: .filter(([key, value]) => shouldPersistStartupEnv(key, value))
Findings
8 High5 Medium8 Low
HighChild Processbin/cli.test.js
HighShellbin/lib/cli-startup.js
HighEntrypoint Build Divergenceserver/index.js
HighSame File Env Network Executionserver/lib/opencode/lifecycle.js
HighSandbox Evasion Gated Capabilityserver/lib/cloudflare-tunnel.js
HighTrigger Reachable External Ai Agent Control Surface Mutationserver/lib/opencode/skills.js
HighTrigger Reachable Persistencebin/lib/cli-startup.js
HighSemantic Analysis Limiteddist/assets/useAppFontEffects--1LC5lcx.js
MediumDynamic Requirebin/lib/commands-serve.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencebin/lib/cli-startup.js
Affected versions and remediation
This report applies to openchamber-sogawugu@1.21.3.
See all versions of openchamber-sogawugu for other recorded verdicts.
- Review the evidence and your use of openchamber-sogawugu@1.21.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.