registry / portomatic / 0.2.0
portomatic@0.2.0
⚠ Under reviewLocal emulators for the services your agents use. Start with: npx portomatic slack start --share
Static Scan Results
scanned 14d ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 19 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Oversized source lightweight scan
products/slack/client/dist/assets/bv1-13/gantry-v2-async-quip-collab-webapp.1d2e509b82980c2c.min.js5.39 MB file, sampled 256 KB
HighEntropyStringsMinifiedUrlStrings127.0.0.1
Source & flagged code
10 flaggedproducts/slack/dist/src/cli/run.jsView file
1var u=Object.defineProperty;var s=(r,i)=>u(r,"name",{value:i,configurable:!0});import{spawn as E}from"node:child_process";import{runtimeEnvironment as _}from"../testing/runtime.js"...
L2: `),"/_emu/ui/",void 0,async t=>{await e.control("public-origin",{origin:t})}).catch(()=>{process.stderr.write(`${f}
High
Child Process
Package source references child process execution.
products/slack/dist/src/cli/run.jsView on unpkg · L1products/slack/client/dist/assets/bv1-13/gantry-v2-async-lottie-web.0793970c469a4e9b.min.jsView file
13705name = elem.data.nm,
L13706: expression_function = eval(
L13707: "[function _expression_function(){" +
Low
Eval
Package source references a known benign dynamic code generation pattern.
products/slack/client/dist/assets/bv1-13/gantry-v2-async-lottie-web.0793970c469a4e9b.min.jsView on unpkg · L13705Findings
5 High6 Medium8 Low
HighChild Processproducts/slack/dist/src/cli/run.js
HighSame File Env Network Executionproducts/slack/dist/src/testing/index.js
HighCommand Output Exfiltrationproducts/slack/dist/src/testing/index.js
HighTrigger Reachable Command Output Exfiltrationproducts/slack/dist/src/testing/index.js
HighSemantic Analysis Limitedproducts/slack/client/dist/assets/bv1-13/gantry-v2-async-markdown-it.0c787ab8bb3b40bb.min.js
MediumDynamic Requireproducts/slack/dist/src/main.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduleproducts/slack/client/dist/assets/bv1-13/automerge_wasm_bg-ea55425.wasm
MediumOversized Source Fileproducts/slack/client/dist/assets/bv1-13/gantry-v2-async-client-boot-render.b2139ca8c8b0aa10.min.js
Affected versions and remediation
This report applies to portomatic@0.2.0.
See all versions of portomatic for other recorded verdicts.
- Review the evidence and your use of portomatic@0.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.