registry / social-autoposter / 1.6.180

social-autoposter@1.6.180

⚠ Under review

Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 432 KB of source, external domains: 127.0.0.1, app.s4l.ai, astral.sh, dl.google.com, github.com, s4l.ai, www.apple.com, www.google.com

Source & flagged code

7 flagged

bin/cookie-helper.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2'use strict';

4/**

5 * Export and import browser cookies for social-autoposter profiles.

6 *

7 * Export: connects to running Playwright browser instances via CDP to extract

8 * cookies. Falls back to launching headless Chrome if no running browser found.

9 *

10 * Import: launches headless Chromium per platform profile, injects cookies

11 * via CDP (Network.setCookies) so they persist to the profile on disk.

12 */

14const { spawn, spawnSync } = require('child_process');

15const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/cookie-helper.jsView on unpkg · L13

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cookie-helper.jsView on unpkg · L13

16const path = require('path');

17const os = require('os');

18const http = require('http');

20const HOME = os.homedir();

21const DEST = path.join(HOME, 'social-autoposter');

22const PROFILES_DIR = path.join(HOME, '.claude', 'browser-profiles');

23const PLATFORMS = ['reddit', 'twitter', 'linkedin'];

25// ── WebSocket ──

27let WS;

28try {

29 if (typeof globalThis.WebSocket !== 'undefined') {

30 WS = globalThis.WebSocket;

31 } else {

32 try { WS = require('ws'); } catch {

33 try { WS = require(path.join('/usr/lib/node_modules', 'ws')); } catch {}

bin/scheduler/launchd.jsView file

Lines 1-24javascript

1'use strict';

3const path = require('path');

4const fs = require('fs');

5const { execSync, spawnSync } = require('child_process'

mcp/dist/screencast.jsView file

Lines 1-32javascript

1/**

2 * Live browser preview via CDP screencast.

3 *

4 * Attaches to a running managed Chrome over the Chrome DevTools Protocol (on the

5 * harness's remote-debugging port) and runs `Page.startScreencast`, buffering the

6 * most recent JPEG frame. The `show_browser_to_user` tool hands that frame to the

7 * panel, which polls for fresh frames and paints them — a low-latency "watch what

8 * the bot is doing" view.

9 *

10 * The frames travel back to the panel through the NORMAL MCP tool-result channel

11 * as a `data:` URL, which the default panel CSP already permits. So this needs no

bin/cli.jsView file

Lines 793-833javascript

793 if (!fs.existsSync(path.join(mcpDest, 'package.json'))) {

794 console.warn(' WARNING: mcp/ missing from install — skipping MCP setup');

795 return;

796 }

797 // Stamp the REAL shipped version (this npm package's version) into the MCP so

798 // it can report itself accurately at runtime. The top-level package.json is

799

skill/dm-outreach-reddit.shView file

•path = skill/dm-outreach-reddit.sh kind = build_helper sizeBytes = 16928 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skill/dm-outreach-reddit.shView on unpkg

mcp/dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = social-autoposter@1.6.173 matchedIdentity = npm:c29jaWFsLWF1dG9wb3N0ZXI:1.6.173 similarity = 0.722 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

mcp/dist/index.jsView on unpkg

Source & flagged code

7 flagged · loading source

bin/cookie-helper.jsView file

13L14: const { spawn, spawnSync } = require('child_process'); L15: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/cookie-helper.jsView on unpkg · L13

13L14: const { spawn, spawnSync } = require('child_process'); L15: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cookie-helper.jsView on unpkg · L13

bin/scheduler/launchd.jsView file

4const fs = require('fs'); L5: const { execSync, spawnSync } = require('child_process'); L6: const platform = require('../platform'); ... L32: \t<array> L33: \t\t<string>/bin/bash</string> L34: \t\t<string>${job.script}</string> ... L38: \t<key>StandardOutPath</key> L39: \t<string>${job.stdoutLog}</string> L40: \t<key>StandardErrorPath</key> ... L80: try { L81: const out = execSync('launchctl list', { stdio: 'pipe', maxBuffer: 8 * 1024 * 1024 }).toString(); L82: for (const line of out.split('\n').slice(1)) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/scheduler/launchd.jsView on unpkg · L4

mcp/dist/screencast.jsView file

12* CSP widening, no localhost network access from the iframe, and no extra L13: * dependency: it uses Node's built-in global `WebSocket` (Node >= 21) and `fetch`. L14: * ... L18: */ L19: import { execFile } from "node:child_process"; L20: // Untyped indirection: Node ships a global WebSocket at runtime (>=21) but ... L27: const ports = []; L28: const env = process.env.TWITTER_CDP_URL || ""; L29: const m = env.match(/:(\d+)/);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

mcp/dist/screencast.jsView on unpkg · L12

bin/cli.jsView file

813} L814: console.log(' installing MCP runtime deps (npm install --omit=dev in mcp/)'); L815: const npmRes = spawnSync('npm', ['install', '--omit=dev', '--no-audit', '--no-fund'], { L816: cwd: mcpDest,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L813

skill/dm-outreach-reddit.shView file

•path = skill/dm-outreach-reddit.sh kind = build_helper sizeBytes = 16928 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skill/dm-outreach-reddit.shView on unpkg

mcp/dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

mcp/dist/index.jsView on unpkg

Findings

1 Critical4 High6 Medium4 Low

CriticalPrevious Version Dangerous Deltamcp/dist/index.js

HighChild Processbin/cookie-helper.js

HighShell

HighSame File Env Network Executionmcp/dist/screencast.js

HighRuntime Package Installbin/cli.js

MediumDynamic Requirebin/cookie-helper.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/scheduler/launchd.js

MediumShips Build Helperskill/dm-outreach-reddit.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

bin/cookie-helper.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2'use strict';

4/**

5 * Export and import browser cookies for social-autoposter profiles.

6 *

7 * Export: connects to running Playwright browser instances via CDP to extract

8 * cookies. Falls back to launching headless Chrome if no running browser found.

9 *

10 * Import: launches headless Chromium per platform profile, injects cookies

11 * via CDP (Network.setCookies) so they persist to the profile on disk.

12 */

14const { spawn, spawnSync } = require('child_process');

15const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/cookie-helper.jsView on unpkg · L13

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cookie-helper.jsView on unpkg · L13

16const path = require('path');

17const os = require('os');

18const http = require('http');

20const HOME = os.homedir();

21const DEST = path.join(HOME, 'social-autoposter');

22const PROFILES_DIR = path.join(HOME, '.claude', 'browser-profiles');

23const PLATFORMS = ['reddit', 'twitter', 'linkedin'];

25// ── WebSocket ──

27let WS;

28try {

29 if (typeof globalThis.WebSocket !== 'undefined') {

30 WS = globalThis.WebSocket;

31 } else {

32 try { WS = require('ws'); } catch {

33 try { WS = require(path.join('/usr/lib/node_modules', 'ws')); } catch {}

bin/scheduler/launchd.jsView file

Lines 1-24javascript

1'use strict';

3const path = require('path');

4const fs = require('fs');

5const { execSync, spawnSync } = require('child_process'

mcp/dist/screencast.jsView file

Lines 1-32javascript

1/**

2 * Live browser preview via CDP screencast.

3 *

4 * Attaches to a running managed Chrome over the Chrome DevTools Protocol (on the

5 * harness's remote-debugging port) and runs `Page.startScreencast`, buffering the

6 * most recent JPEG frame. The `show_browser_to_user` tool hands that frame to the

7 * panel, which polls for fresh frames and paints them — a low-latency "watch what

8 * the bot is doing" view.

9 *

10 * The frames travel back to the panel through the NORMAL MCP tool-result channel

11 * as a `data:` URL, which the default panel CSP already permits. So this needs no

bin/cli.jsView file

Lines 793-833javascript

793 if (!fs.existsSync(path.join(mcpDest, 'package.json'))) {

794 console.warn(' WARNING: mcp/ missing from install — skipping MCP setup');

795 return;

796 }

797 // Stamp the REAL shipped version (this npm package's version) into the MCP so

798 // it can report itself accurately at runtime. The top-level package.json is

799

skill/dm-outreach-reddit.shView file

•path = skill/dm-outreach-reddit.sh kind = build_helper sizeBytes = 16928 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skill/dm-outreach-reddit.shView on unpkg

mcp/dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

mcp/dist/index.jsView on unpkg