registry / openchamber-sogawugu / 1.21.7
openchamber-sogawugu@1.21.7
⚠ Under review[ {
L54: return `'${String(value).replace(/'/g, "''")}'`;
High
3Trigger-reachable persistence chain: scripts.start -> bin/cli.js -> bin/lib/commands-startup.js -> bin/lib/cli-startup.js
L3: import path from 'path';
L4: import { spawnSync } from 'child_process';
L5: import { DEFAULT_PORT } from './cli-args.js';
...
L13: function getStartupServicePaths() {
L14: if (process.platform === 'darwin') {
L15: return {
L16: platform: 'macos',
L17: servicePath: path.join(os.homedir(), 'Library', 'LaunchAgents', `${STARTUP_SERVICE_ID}.plist`),
L18: };
...
L78: const env = options.envSnapshot === false ? {} : Object.fromEntries(
L79: Object.entries(process.env)
L80: .filter(([key, value]) => shouldPersistStartupEnv(key, value))
Findings
9 High5 Medium7 Low
HighChild Processbin/cli.test.js
HighShellbin/lib/cli-startup.js
HighEntrypoint Build Divergenceserver/index.js
HighSame File Env Network Executionserver/lib/opencode/lifecycle.js
HighSandbox Evasion Gated Capabilityserver/lib/cloudflare-tunnel.js
HighTrigger Reachable External Ai Agent Control Surface Mutationserver/lib/opencode/skills.js
HighTrigger Reachable Persistencebin/lib/cli-startup.js
HighSemantic Analysis Limiteddist/assets/useAppFontEffects-CcjersAw.js
HighPrevious Version Dangerous Deltaserver/lib/git/service.js
MediumDynamic Requirebin/lib/commands-serve.js
MediumNetwork
Medium
Affected versions and remediation
This report applies to openchamber-sogawugu@1.21.7.
See all versions of openchamber-sogawugu for other recorded verdicts.
- Review the evidence and your use of openchamber-sogawugu@1.21.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.