registry / porcelain-daemon / 0.25.0

porcelain-daemon@0.25.0

Headless Porcelain daemon — plain Node backend for remote machines (npx porcelain-daemon@latest serve)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 974 KB of source, external domains: 127.0.0.1, api.anthropic.com, clients2.google.com, react.dev, stuk.github.io

Oversized source lightweight scan

renderer/assets/index-CNFwttUv.js5.51 MB file, sampled 256 KB

HighEntropyStringsUrlStringsreact.dev

Source & flagged code

7 flagged

main/daemon/server.jsView file

Lines 1-23javascript

1"use strict";

2const node_crypto = require("node:crypto");

3const tokenFile = require("../chunks/token-file-B5jXlkQI.js");

4const node_child_process = require("node:child_process");

5const node_fs = require("node:fs");

High

Child Process

Package source references child process execution.

main/daemon/server.jsView on unpkg · L3

6const promises = require("node:fs/promises");

7const node_os = require("node:os");

8const node_path = require("node:path");

9const node_readline = require("node:readline");

10const node_util = require("node:util");

11const zod = require("zod");

12const server$1 = require("@trpc/server");

13const trash = require("trash");

14const node_http = require("node:http");

15const nodePty = require("node-pty");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

main/daemon/server.jsView on unpkg · L3

16const fetch$1 = require("@trpc/server/adapters/fetch");

17const ws = require("ws");

18require("@iarna/toml");

19const _interopDefault = (e) => e && e.__esModule ? e : { default: e };

20const trash__default = /* @__PURE__ */ _interopDefault(trash);

21const listeners = /* @__PURE__ */ new Set();

22function emitAppEvent(event) {

23 for (const listener of listeners) listener(event);

Lines 4412-4452javascript

4412 try {

4413 const server2 = await pending;

4414 const config = await getConfigProviders(server2.baseUrl);

4415 if (config !== null) return mapProvidersConfig(config);

4416 } catch {

main/chunks/index-BlxZmzlT.jsView file

Lines 2597-2637javascript

2597 external = {

2598 Promise: ES6Promise

2599 };

2600 return external;

2601}

2602var setImmediate$1 = {};

2603var hasRequiredSetImmediate;

2604function requireSetImmediate() {

2605 if

bin/porcelain-daemon.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// Headless CLI for the published porcelain-daemon package.

3// Copied into dist-daemon/bin/ by scripts/build-daemon-dist.mjs — not run from

4// the monorepo root (paths resolve relative to the installed package layout).

5//

6// Goal: t3-style one-liner on a remote box —

7// npx porcelain-daemon@latest serve --tailnet

8// instead of scp'ing a dist tarball and wiring systemd.

10const { randomBytes } = require(

renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View file

•path = renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2 kind = high_entropy_blob sizeBytes = 40404 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View on unpkg

renderer/assets/index-CNFwttUv.jsView file

•path = renderer/assets/index-CNFwttUv.js kind = oversized_source_file sizeBytes = 5775450 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

renderer/assets/index-CNFwttUv.jsView on unpkg

Source & flagged code

7 flagged · loading source

main/daemon/server.jsView file

3const tokenFile = require("../chunks/token-file-B5jXlkQI.js"); L4: const node_child_process = require("node:child_process"); L5: const node_fs = require("node:fs");

High

Child Process

Package source references child process execution.

main/daemon/server.jsView on unpkg · L3

4432try { L4433: const res = await fetch(`${baseUrl}/config/providers`); L4434: if (!res.ok) return null; ... L4441: return new Promise((resolve) => { L4442: node_child_process.execFile(bin, ["models"], { env }, (error, stdout) => { L4443: resolve(error ? [] : parseModelsCli(stdout)); ... L4447: function buildDrivers() { L4448: if (process.env.PORCELAIN_AGENT_FAKE === "1") { L4449: return {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

main/daemon/server.jsView on unpkg · L4432

3const tokenFile = require("../chunks/token-file-B5jXlkQI.js"); L4: const node_child_process = require("node:child_process"); L5: const node_fs = require("node:fs"); ... L13: const trash = require("trash"); L14: const node_http = require("node:http"); L15: const nodePty = require("node-pty"); ... L68: function loginShell() { L69: const shell = process.env.SHELL; L70: if (shell?.startsWith("/")) return shell; L71: return process.platform === "darwin" ? "/bin/zsh" : "/bin/bash"; L72: } L73: function parseLoginPath(stdout) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

main/daemon/server.jsView on unpkg · L3

main/chunks/index-BlxZmzlT.jsView file

2617if (typeof callback !== "function") { L2618: callback = new Function("" + callback); L2619: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

main/chunks/index-BlxZmzlT.jsView on unpkg · L2617

bin/porcelain-daemon.jsView file

9L10: const { randomBytes } = require('node:crypto') L11: const { mkdirSync, readFileSync, renameSync, writeFileSync, existsSync } = require('node:fs')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/porcelain-daemon.jsView on unpkg · L9

renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View file

•path = renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2 kind = high_entropy_blob sizeBytes = 40404 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View on unpkg

renderer/assets/index-CNFwttUv.jsView file

•path = renderer/assets/index-CNFwttUv.js kind = oversized_source_file sizeBytes = 5775450 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

renderer/assets/index-CNFwttUv.jsView on unpkg

Findings

5 High4 Medium4 Low

HighChild Processmain/daemon/server.js

HighSame File Env Network Executionmain/daemon/server.js

HighSandbox Evasion Gated Capabilitymain/daemon/server.js

HighShips High Entropy Blobrenderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2

HighOversized Source Filerenderer/assets/index-CNFwttUv.js

MediumDynamic Requirebin/porcelain-daemon.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowEvalmain/chunks/index-BlxZmzlT.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

main/daemon/server.jsView file

Lines 1-23javascript

1"use strict";

2const node_crypto = require("node:crypto");

3const tokenFile = require("../chunks/token-file-B5jXlkQI.js");

4const node_child_process = require("node:child_process");

5const node_fs = require("node:fs");

High

Child Process

Package source references child process execution.

main/daemon/server.jsView on unpkg · L3

6const promises = require("node:fs/promises");

7const node_os = require("node:os");

8const node_path = require("node:path");

9const node_readline = require("node:readline");

10const node_util = require("node:util");

11const zod = require("zod");

12const server$1 = require("@trpc/server");

13const trash = require("trash");

14const node_http = require("node:http");

15const nodePty = require("node-pty");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

main/daemon/server.jsView on unpkg · L3

16const fetch$1 = require("@trpc/server/adapters/fetch");

17const ws = require("ws");

18require("@iarna/toml");

19const _interopDefault = (e) => e && e.__esModule ? e : { default: e };

20const trash__default = /* @__PURE__ */ _interopDefault(trash);

21const listeners = /* @__PURE__ */ new Set();

22function emitAppEvent(event) {

23 for (const listener of listeners) listener(event);

Lines 4412-4452javascript

4412 try {

4413 const server2 = await pending;

4414 const config = await getConfigProviders(server2.baseUrl);

4415 if (config !== null) return mapProvidersConfig(config);

4416 } catch {

main/chunks/index-BlxZmzlT.jsView file

Lines 2597-2637javascript

2597 external = {

2598 Promise: ES6Promise

2599 };

2600 return external;

2601}

2602var setImmediate$1 = {};

2603var hasRequiredSetImmediate;

2604function requireSetImmediate() {

2605 if

bin/porcelain-daemon.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// Headless CLI for the published porcelain-daemon package.

3// Copied into dist-daemon/bin/ by scripts/build-daemon-dist.mjs — not run from

4// the monorepo root (paths resolve relative to the installed package layout).

5//

6// Goal: t3-style one-liner on a remote box —

7// npx porcelain-daemon@latest serve --tailnet

8// instead of scp'ing a dist tarball and wiring systemd.

10const { randomBytes } = require(

renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View file

•path = renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2 kind = high_entropy_blob sizeBytes = 40404 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View on unpkg

renderer/assets/index-CNFwttUv.jsView file

•path = renderer/assets/index-CNFwttUv.js kind = oversized_source_file sizeBytes = 5775450 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

renderer/assets/index-CNFwttUv.jsView on unpkg