registry / ringly / 0.9.1

ringly@0.9.1

Ringly — native cross-platform notifications for Claude Code with i18n (pt-BR / en-US)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 560 KB of source, external domains: github.com, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

6 flagged

dist/hook.jsView file

Lines 1-21javascript

1import {join,dirname,basename}from'path';import {fileURLToPath,pathToFileURL}from'url';import {appendFileSync,existsSync,readFileSync,mkdirSync,statSync,renameSync,writeFileSync,unlinkSync,rmdirSync}from'fs';import Do from'env-paths';import {tmpdir,homedir}from'os';import {spawn}from'child_process';var it=Object.defineProperty;var T=(e,t)=>()=>(e&&(t=e(e=0)),t);var Z=(e,t)=>{for(var o in t)it(e,o,{get:t[o],enumerable:true});};var r=T(()=>{});function C(e,t,o={}){let{encoding:n="utf8"}=o,i=dirname(e);mkdirSync(i,{recursive:true});let a=`${e}.tmp.${process.pid}.${Date.now().toString(36)}${Math.r ...

2`;try{let s=se();yt(dirname(s)),ht(s),appendFileSync(s,a,{encoding:"utf8"});}catch{try{let s=join(tmpdir(),"ringly-fallback.log");appendFileSync(s,a,{encoding:"utf8"});}catch{}}}function bt(e){try{return JSON.stringify(e)}catch{return String(e)}}var c={debug:(e,t)=>R("debug",e,t),info:(e,t)=>R("info",e,t),warn:(e,t)=>R("warn",e,t),error:(e,t)=>R("error",e,t),getLogFile:()=>se(),isDebugEnabled:le};r();var I=["model","task","dirname","context","lastCommand","git","lines","rateLimits"];var x="Claude.Code.CLI";function St(e){return `statusline_segment_${e}`}var Tt="ringly";function wt(){return joi ...

High

Child Process

Package source references child process execution.

dist/hook.jsView on unpkg · L1

3`)),{delivered:false,blocked:false,reason:"platform_not_implemented"}}r();var me=false;async function fe(e){return c.warn("macOS toast not implemented yet; planned for a future release"),me||(me=true,process.stderr.write(`[Ringly] macOS toast notifications are not implemented yet. Track progress at https://github.com/nickdevcode/Ringly/issues

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hook.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/hook.jsView on unpkg · L1

4`)),{delivered:false,blocked:false,reason:"platform_not_implemented"}}r();var Lt="ringly.png";var U;function ge(){return U!==void 0||(U=Ut(Lt)),U??void 0}function Ut(e){for(let t of Dt(e))try{if(existsSync(t))return t}catch{}return null}function Dt(e){let t=[],o=process.env.CLAUDE_PLUGIN_ROOT;o&&o.trim().length>0&&t.push(join(o,"assets",e));try{let n=dirname(fileURLToPath(import.meta.url));for(let i of [join(n,".."),join(n,"..","..","..")])t.push(join(i,"plugin","assets",e));}catch{}return t}r();r();function D(e){if(!e)return "";let t="";for(let o=0;o<e.length;o++){let n=e.charAt(o),i=e.charCo ...

5$ErrorActionPreference = 'SilentlyContinue'

6try { [Console]::InputEncoding = New-Object System.Text.UTF8Encoding($false) } catch { }

7try { [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false) } catch { }

9try {

10 [void][Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType=WindowsRuntime]

11 [void][Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType=WindowsRuntime]

12 [void][Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType=WindowsRuntime]

14 $xml = New-Object Windows.Data.Xml.Dom.XmlDocument

15 $xml.LoadXml('${n}')

17 $appId = '${i}'

18 $notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier($appId)

20 $settingInt = $null

21 try { $settingInt = [int]$notifier.Setting.value__ } catch { }

Long lines were clipped for display.

dist/cli.jsView file

Lines 585-625javascript

585 "tui.footer.continue": "continue",

586 "tui.footer.cancel": "cancel",

587 "tui.footer.move": "move",

588 "tui.footer.select": "select",

589 "tui.footer.toggle": "toggle",

590 "tui.footer.confirm": "confirm"

bin/ringly.jsView file

Lines 1-12javascript

1#!/usr/bin/env node

2import { dirname, resolve } from "node:path";

3import { fileURLToPath, pathToFileURL } from "node:url";

5const __dirname = dirname(fileURLToPath(import.meta.url));

6const distDir

plugin/assets/ringly.icoView file

•path = plugin/assets/ringly.ico kind = high_entropy_blob sizeBytes = 23765 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

plugin/assets/ringly.icoView on unpkg

Source & flagged code

6 flagged · loading source

dist/hook.jsView file

1import {join,dirname,basename}from'path';import {fileURLToPath,pathToFileURL}from'url';import {appendFileSync,existsSync,readFileSync,mkdirSync,statSync,renameSync,writeFileSync,un... L2: `;try{let s=se();yt(dirname(s)),ht(s),appendFileSync(s,a,{encoding:"utf8"});}catch{try{let s=join(tmpdir(),"ringly-fallback.log");appendFileSync(s,a,{encoding:"utf8"});}catch{}}}fu...

High

Child Process

Package source references child process execution.

dist/hook.jsView on unpkg · L1

1import {join,dirname,basename}from'path';import {fileURLToPath,pathToFileURL}from'url';import {appendFileSync,existsSync,readFileSync,mkdirSync,statSync,renameSync,writeFileSync,un... L2: `;try{let s=se();yt(dirname(s)),ht(s),appendFileSync(s,a,{encoding:"utf8"});}catch{try{let s=join(tmpdir(),"ringly-fallback.log");appendFileSync(s,a,{encoding:"utf8"});}catch{}}}fu... L3: `)),{delivered:false,blocked:false,reason:"platform_not_implemented"}}r();var me=false;async function fe(e){return c.warn("macOS toast not implemented yet; planned for a future rel...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hook.jsView on unpkg · L1

1import {join,dirname,basename}from'path';import {fileURLToPath,pathToFileURL}from'url';import {appendFileSync,existsSync,readFileSync,mkdirSync,statSync,renameSync,writeFileSync,un... L2: `;try{let s=se();yt(dirname(s)),ht(s),appendFileSync(s,a,{encoding:"utf8"});}catch{try{let s=join(tmpdir(),"ringly-fallback.log");appendFileSync(s,a,{encoding:"utf8"});}catch{}}}fu... L3: `)),{delivered:false,blocked:false,reason:"platform_not_implemented"}}r();var me=false;async function fe(e){return c.warn("macOS toast not implemented yet; planned for a future rel...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/hook.jsView on unpkg · L1

dist/cli.jsView file

605"cli.doctor.check.node.hint": "Node 20 or newer is required. Upgrade from nodejs.org or via nvm/volta.", L606: "cli.doctor.check.powershell": "PowerShell", L607: "cli.doctor.check.powershell.unreachable": "PowerShell not reachable",

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L605

bin/ringly.jsView file

10L11: await import(pathToFileURL(resolve(distDir, entry)).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/ringly.jsView on unpkg · L10

plugin/assets/ringly.icoView file

•path = plugin/assets/ringly.ico kind = high_entropy_blob sizeBytes = 23765 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

plugin/assets/ringly.icoView on unpkg

Findings

5 High4 Medium5 Low

HighChild Processdist/hook.js

HighShelldist/cli.js

HighSame File Env Network Executiondist/hook.js

HighCommand Output Exfiltrationdist/hook.js

HighShips High Entropy Blobplugin/assets/ringly.ico

MediumDynamic Requirebin/ringly.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/hook.jsView file

Lines 1-21javascript

High

Child Process

Package source references child process execution.

dist/hook.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hook.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/hook.jsView on unpkg · L1

5$ErrorActionPreference = 'SilentlyContinue'

6try { [Console]::InputEncoding = New-Object System.Text.UTF8Encoding($false) } catch { }

7try { [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false) } catch { }

9try {

10 [void][Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType=WindowsRuntime]

11 [void][Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType=WindowsRuntime]

12 [void][Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType=WindowsRuntime]

14 $xml = New-Object Windows.Data.Xml.Dom.XmlDocument

15 $xml.LoadXml('${n}')

17 $appId = '${i}'

18 $notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier($appId)

20 $settingInt = $null

21 try { $settingInt = [int]$notifier.Setting.value__ } catch { }

Long lines were clipped for display.

dist/cli.jsView file

Lines 585-625javascript

585 "tui.footer.continue": "continue",

586 "tui.footer.cancel": "cancel",

587 "tui.footer.move": "move",

588 "tui.footer.select": "select",

589 "tui.footer.toggle": "toggle",

590 "tui.footer.confirm": "confirm"

bin/ringly.jsView file

Lines 1-12javascript

1#!/usr/bin/env node

2import { dirname, resolve } from "node:path";

3import { fileURLToPath, pathToFileURL } from "node:url";

5const __dirname = dirname(fileURLToPath(import.meta.url));

6const distDir

plugin/assets/ringly.icoView file

•path = plugin/assets/ringly.ico kind = high_entropy_blob sizeBytes = 23765 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

plugin/assets/ringly.icoView on unpkg