registry / ravenry-app / 0.3.0
ravenry-app@0.3.0
A local board for following every Claude Code session on your Mac, answering agents from one page (cmux or iTerm2), and keeping project briefs.
AI Security Review
scanned 12h ago · by lpm-firewall-aiThe package has no install lifecycle hook, and its inspected outbound requests serve alert delivery to destinations configured by the user. The scanner's credential and webhook leads were consistent with those documented alert flows.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The CLI starts the local board; configured alerts are sent when a project needs the user's attention.
Impact
Expected alert delivery; no automatic collection of unrelated credentials or host data was identified.
Mechanism
The board sends alert text to the user's configured Telegram, Slack, Discord, or ntfy destination.
AI rationale
The package has no install lifecycle hook, and its inspected outbound requests serve alert delivery to destinations configured by the user. The scanner's credential and webhook leads were consistent with those documented alert flows.
Network endpoints3
api.telegram.orgntfy.shUser-configured Slack or Discord webhook
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and declares no preinstall, install, or postinstall lifecycle script.
- The CLI starts the board or runs setup only through explicit command dispatch.
- Phone alerts use the Telegram token and chat configured by the user.
- Alerts contain short status text and are triggered by a project changing into a state that needs the user.
- Discord or Slack alerts are sent to a user-configured webhook URL.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggedtools/open-in-iterm.mjsView file
53import path from 'node:path';
L54: import { execFile } from 'node:child_process';
L55: import { fileURLToPath } from 'node:url';
High
Child Process
Package source references child process execution.
tools/open-in-iterm.mjsView on unpkg · L5353import path from 'node:path';
L54: import { execFile } from 'node:child_process';
L55: import { fileURLToPath } from 'node:url';
...
L59: const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
L60: const env = process.env;
L61: const OSASCRIPT = env.ITERM_OSASCRIPT_BIN || '/usr/bin/osascript';
...
L68: export const portOf = (e = env) => Number(e.PORT || 4600);
L69: export const boardUrl = (port) => `http://localhost:${port}/`;
L70: export const pageName = (port) => (port === 4600 ? 'Ravenry board' : `Ravenry board :${port}`);
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
tools/open-in-iterm.mjsView on unpkg · L53server/handoff.mjsView file
Findings
2 Critical5 High4 Medium5 Low
CriticalCredential Exfiltrationpublic/app.js
CriticalPrevious Version Dangerous Deltabin/ravenry.mjs
HighChild Processtools/open-in-iterm.mjs
HighSame File Env Network Executiontools/open-in-iterm.mjs
HighFixed Authenticated Webhook Data Exfiltrationserver/channels.mjs
HighSandbox Evasion Gated Capabilitybin/ravenry.mjs
HighSemantic Analysis Limitedserver/codexexec.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpertools/iterm-board-split.py
MediumStructural Risk Force Deep Review
LowScripts Present
Low
Affected versions and remediation
This report applies to ravenry-app@0.3.0.
See all versions of ravenry-app for other recorded verdicts.
- Review the evidence and your use of ravenry-app@0.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.