registry / shraga / 0.1.5

shraga@0.1.5

⚠ Under review

The teammate you delegate coding to — a self-hostable, multi-user AI coding agent web UI (Claude Code, with a pluggable engine seam).

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Manifest

GitDependencyWildcardDependency

scanned 143 file(s), 2.15 MB of source, external domains: 0.0.0.0, 127.0.0.1, accounts.google.com, api.anthropic.com, api.push.apple.com, api.sandbox.push.apple.com, apis.google.com, developers.cloudflare.com, fcm.googleapis.com, firebase.google.com, github.com, oauth2.googleapis.com, react.dev, slack.com, www.apache.org, www.google.com, www.googleapis.com, www.w3.org

Source & flagged code

7 flagged

dist/client/assets/index-BnArwb7g.jsView file

1798`},f]}}const OZ=e=>({IMPORTANT:{scope:"meta",begin:"!important"},BLOCK_COMMENT:e.C_BLOCK_COMMENT_MODE,HEXCOLOR:{scope:"number",begin:/#(([0-9a-fA-F]{3,4})|(([0-9a-fA-F]{2}){3,4}))\... L1799: ]`,w={scope:"string",variants:[h,f,p,g]},y={scope:"number",variants:[{begin:"\\b0[bB][01]+(?:_[01]+)*\\b"},{begin:"\\b0[oO][0-7]+(?:_[0-7]+)*\\b"},{begin:"\\b0[xX][\\da-fA-F]+(?:_[... L1800: https://github.com/highlightjs/highlight.js/issues/2277`),pn=pe,Ot=De),rt===void 0&&(rt=!0);const tr={code:Ot,language:pn};gs("before:highlight",tr);const Pr=tr.result?tr.result:ha...

High

Child Process

Package source references child process execution.

dist/client/assets/index-BnArwb7g.jsView on unpkg · L1798

src/server/scheduler/runner.tsView file

Lines 288-328typescript

288

289 const jobPreview = status === 'ok' ? 'Job completed successfully' : `Job ${status}`;

290 addUnread(schedule.createdBy.uid, sessionId, jobPreview, 'schedule', schedule.name);

291

292 const summary: ScheduleRunSummary = { at: now, sessionId, status, error };

293 onEvent({ type: 'schedule:run_finished', scheduleId: schedule.id, sessionId, summary });

294 return summary;

295}

296

297

298function runCommandWithMarker(command: string, abortController: AbortController, scheduleId: string, onChunk?: (chunk: string) => void, extraEnv?: Record

299 return new Promise((resolve, reject) => {

300 const child = spawn(command, {

301 // Anchor job cwd to the dir CONTAINING the data dir, not the server's launch dir. Builtin +

302 // user job commands are cwd-relative (`bun run data/scripts/X.ts`), so they must resolve

303 // against DATA_DIR regardless of where/how the server was started. `process.cwd()` only worked

304 // by coincidence when the process was launched from dirname(DATA_DIR); a deploy that sets a

305 // different WorkingDirectory (e.g. running the app against a data dir at a different mount, like /some/data-dir) then

306 // silently broke every data/ path. dirname(DATA_DIR) makes it launch-dir-independent.

307 cwd: dirname(DATA_DIR),

308 env: extraEnv ? { ...process.env, ...extraEnv } : process.env,

309 shell: true,

310 stdio: ['ignore', 'pipe', 'pipe'],

High

Shell

Package source references shell execution.

src/server/scheduler/runner.tsView on unpkg · L308

311 });

312

313 if (child.pid) {

314 writeRunningMarker({ pid: child.pid, startedAt: Date.now(), scheduleId });

315 }

316

317 let output = '';

318 const handleData = (chunk: Buffer) => {

319 const text = chunk.toString();

320 output += text;

321 onChunk?.(text);

322 };

323 child.stdout?.on('data', handleData);

324 child.stderr?.on('data', handleData);

325

326 abortController.signal.addEventListener('abort', () => child.kill('SIGTERM'), { once: true });

327 child.on('error', reject);

328 child.on('close', (code) => {

src/server/shraga-config.tsView file

Lines 82-122typescript

82export const CONFIG_FILENAMES = ['shraga.config.ts', 'unclaw.config.ts'] as const;

84/** First config file that exists in the data dir, or null when none is present. */

85export function resolveConfigPath()

src/cli.tsView file

Lines 1-21typescript

1#!/usr/bin/env bun

2import { spawn, type ChildProcess } from 'node:child_process';

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

src/cli.tsView on unpkg · L1

4const args = process.argv.slice(2);

src/server/data-sync.tsView file

Lines 620-660typescript

620 writeFileSync(idPath, localId + '\n');

621 console.log(`${TAG} Wrote deployment identity: ${localId}`);

622 return true;

623 }

defaults/scripts/backfill-slack-usernames.tsView file

Lines 1-29typescript

1#!/usr/bin/env bun

2/**

3 * One-shot backfill: resolve missing userName on DM slack sessions.

4 * Reads slack-sessions.json to find DM channels, calls Slack API to get the user.

5 * Run: bun run scripts/backfill-slack-usernames.ts

6 */

7import { readFileSync, writeFileSync } from 'node:fs';

8import { dataPath } from

src/server/boot.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = shraga@0.1.3 matchedIdentity = npm:c2hyYWdh:0.1.3 similarity = 0.925 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/server/boot.tsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code