registry / openwolf-enhanced / 1.9.4

openwolf-enhanced@1.9.4

Token-conscious AI brain for Claude Code projects — enhanced fork with bounded storage, self-maintenance (openwolf doctor), .wolfignore scoping, and tunable retention.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

CopyleftLicense

scanned 63 file(s), 1017 KB of source, external domains: 127.0.0.1, api.anthropic.com, bit.ly, openwolf.com, react.dev, redux-toolkit.js.org, redux.js.org, www.w3.org

Source & flagged code

6 flagged

package.jsonView file

Lines 1-32json

2 "name": "openwolf-enhanced",

3 "version": "1.9.4",

4 "description": "Token-conscious AI brain for Claude Code projects — enhanced fork with bounded storage, self-maintenance (openwolf doctor), .wolfignore scoping, and tunable retention.",

5 "type": "module",

6 "bin": {

7 "openwolf": "./dist/bin/openwolf.js"

8 },

9 "scripts": {

10 "prebuild": "node -e \"const fs=require('fs');if(fs.existsSync('dist'))fs.rmSync('dist',{recursive:true})\"",

11 "build": "tsc && pnpm build:hooks && pnpm build:dashboard && chmod +x dist/bin/openwolf.js",

12 "postinstall": "chmod +x dist/bin/openwolf.js 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L12

13 "build:hooks": "tsc -p tsconfig.hooks.json",

14 "build:dashboard": "cd src/dashboard/app && npx vite build --outDir ../../../dist/dashboard",

15 "dev": "tsc --watch",

16 "pretest": "tsc && tsc -p tsconfig.hooks.json",

17 "test": "node --test test/*.test.js",

18 "docs:dev": "vitepress dev docs",

19 "docs:build": "vitepress build docs",

20 "prepublishOnly": "node scripts/prepublish-guard.mjs"

21 },

22 "dependencies": {

23 "chokidar": "^5.0.0",

24 "commander": "^15.0.0",

25 "express": "^5.2.1",

26 "node-cron": "^4.0.0",

27 "open": "^11.0.0",

28 "ws": "^8.21.0"

29 },

30 "optionalDependencies": {

31 "puppeteer-core": "^25.0.0"

32 },

dist/src/cli/init.jsView file

Lines 1-23javascript

1import * as fs from "node:fs";

2import * as path from "node:path";

3import { fileURLToPath } from "node:url";

4import { execFileSync } from "node:child_process";

5import

dist/src/designqc/designqc-capture.jsView file

Lines 1-22javascript

1import * as fs from "node:fs";

2import * as path from "node:path";

3import * as http from "node:http";

4import { execSync, spawn } from "node:child_process"

dist/hooks/post-write.jsView file

Lines 174-214javascript

174 const oldLines = oldStr.split("\n");

175 const newLines = newStr.split("\n");

176 const oldCount = oldLines.length;

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = chmod +x dist/bin/openwolf.js 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = chmod +x dist/bin/openwolf.js 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/cli/init.jsView file

3import { fileURLToPath } from "node:url"; L4: import { execFileSync } from "node:child_process"; L5: import { findProjectRoot } from "../scanner/project-root.js";

High

Child Process

Package source references child process execution.

dist/src/cli/init.jsView on unpkg · L3

dist/src/designqc/designqc-capture.jsView file

242cwd: projectRoot, L243: shell: true, L244: stdio: ["ignore", "pipe", "pipe"],

High

Shell

Package source references shell execution.

dist/src/designqc/designqc-capture.jsView on unpkg · L242

2import * as path from "node:path"; L3: import * as http from "node:http"; L4: import { execSync, spawn } from "node:child_process"; L5: export function findChromePath(configPath) { ... L9: const candidates = [ L10: path.join(process.env["PROGRAMFILES"] || "C:\\Program Files", "Google\\Chrome\\Application\\chrome.exe"), L11: path.join(process.env["PROGRAMFILES(X86)"] || "C:\\Program Files (x86)", "Google\\Chrome\\Application\\chrome.exe"),

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/designqc/designqc-capture.jsView on unpkg · L2

dist/hooks/post-write.jsView file

194if (newImports > oldImports && Math.abs(newCount - oldCount) <= newImports - oldImports + 1) { L195: return `added ${newImports - oldImports} import(s)`; L196: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/hooks/post-write.jsView on unpkg · L194

Findings

4 High5 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/src/cli/init.js

HighShelldist/src/designqc/designqc-capture.js

HighSame File Env Network Executiondist/src/designqc/designqc-capture.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/hooks/post-write.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

6 flagged

package.jsonView file

Lines 1-32json

2 "name": "openwolf-enhanced",

3 "version": "1.9.4",

4 "description": "Token-conscious AI brain for Claude Code projects — enhanced fork with bounded storage, self-maintenance (openwolf doctor), .wolfignore scoping, and tunable retention.",

5 "type": "module",

6 "bin": {

7 "openwolf": "./dist/bin/openwolf.js"

8 },

9 "scripts": {

10 "prebuild": "node -e \"const fs=require('fs');if(fs.existsSync('dist'))fs.rmSync('dist',{recursive:true})\"",

11 "build": "tsc && pnpm build:hooks && pnpm build:dashboard && chmod +x dist/bin/openwolf.js",

12 "postinstall": "chmod +x dist/bin/openwolf.js 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L12

13 "build:hooks": "tsc -p tsconfig.hooks.json",

14 "build:dashboard": "cd src/dashboard/app && npx vite build --outDir ../../../dist/dashboard",

15 "dev": "tsc --watch",

16 "pretest": "tsc && tsc -p tsconfig.hooks.json",

17 "test": "node --test test/*.test.js",

18 "docs:dev": "vitepress dev docs",

19 "docs:build": "vitepress build docs",

20 "prepublishOnly": "node scripts/prepublish-guard.mjs"

21 },

22 "dependencies": {

23 "chokidar": "^5.0.0",

24 "commander": "^15.0.0",

25 "express": "^5.2.1",

26 "node-cron": "^4.0.0",

27 "open": "^11.0.0",

28 "ws": "^8.21.0"

29 },

30 "optionalDependencies": {

31 "puppeteer-core": "^25.0.0"

32 },

dist/src/cli/init.jsView file

Lines 1-23javascript

1import * as fs from "node:fs";

2import * as path from "node:path";

3import { fileURLToPath } from "node:url";

4import { execFileSync } from "node:child_process";

5import

dist/src/designqc/designqc-capture.jsView file

Lines 1-22javascript

1import * as fs from "node:fs";

2import * as path from "node:path";

3import * as http from "node:http";

4import { execSync, spawn } from "node:child_process"

dist/hooks/post-write.jsView file

Lines 174-214javascript

174 const oldLines = oldStr.split("\n");

175 const newLines = newStr.split("\n");

176 const oldCount = oldLines.length;

Lines 222-262javascript

222 runner = "bun run";

223 return { command: `${runner} ${key}`, expectedPort: port };

224 }

225 }

226 }

227 catch { }

228 return null;

229}

230/**

231 * Start the dev server, wait for it to be ready, return the process handle.

232 * Caller is responsible for killing the process.

233 */

234export async function startDevServer(projectRoot) {

235 const devCmd = detectDevCommand(projectRoot);

236 if (!devCmd) {

237 console.error(" No dev script found in package.json (looked for: dev, start, serve)");

238 return null;

239 }

240 console.log(` Starting dev server: ${devCmd.command}`);

241 const proc = spawn(devCmd.command, {

242 cwd: projectRoot,

243 shell: true,

244 stdio: ["ignore", "pipe", "pipe"],

High

Shell

Package source references shell execution.

dist/src/designqc/designqc-capture.jsView on unpkg · L242

245 windowsHide: true,

246 });

247 // Wait for server to be ready (poll port)

248 const port = devCmd.expectedPort;

249 const maxWait = 30_000;

250 const start = Date.now();

251 let ready = false;

252 while (Date.now() - start < maxWait) {

253 // Check if process died

254 if (proc.exitCode !== null) {

255 console.error(` Dev server exited with code ${proc.exitCode}`);

256 return null;

257 }

258 if (await probePort(port)) {

259 ready = true;

260 break;

261 }

262 await new Promise((r) => setTimeout(r, 1000));