registry / social-autoposter / 1.7.8

social-autoposter@1.7.8

Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 17 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 647 KB of source, external domains: 127.0.0.1, api.github.com, app.s4l.ai, astral.sh, dl.google.com, github.com, s4l.ai, www.apple.com, www.google.com

Source & flagged code

10 flagged

bin/cookie-helper.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2'use strict';

4/**

5 * Export and import browser cookies for social-autoposter profiles.

6 *

7 * Export: connects to running Playwright browser instances via CDP to extract

8 * cookies. Falls back to launching headless Chrome if no running browser found.

9 *

10 * Import: launches headless Chromium per platform profile, injects cookies

11 * via CDP (Network.setCookies) so they persist to the profile on disk.

12 */

14const { spawn, spawnSync } = require('child_process');

15const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cookie-helper.jsView on unpkg · L13

16const path = require('path');

17const os = require('os');

18const http = require('http');

20const HOME = os.homedir();

21const DEST = path.join(HOME, 'social-autoposter');

22const PROFILES_DIR = path.join(HOME, '.claude', 'browser-profiles');

23const PLATFORMS = ['reddit', 'twitter', 'linkedin'];

25// ── WebSocket ──

27let WS;

28try {

29 if (typeof globalThis.WebSocket !== 'undefined') {

30 WS = globalThis.WebSocket;

31 } else {

32 try { WS = require('ws'); } catch {

33 try { WS = require(path.join('/usr/lib/node_modules', 'ws')); } catch {}

•matchType = normalized_sha256 matchedPackage = social-autoposter@1.7.7 matchedPath = bin/cookie-helper.js matchedIdentity = npm:c29jaWFsLWF1dG9wb3N0ZXI:1.7.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cookie-helper.jsView on unpkg

bin/scheduler/launchd.jsView file

Lines 1-24javascript

1'use strict';

3const path = require('path');

4const fs = require('fs');

5const

bin/cli.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ` generated launchd units at ${outdir}`); } function init() { console.log('setting up social-autoposter in', dest); fs.mkdirsync(dest, { recursive: true }); for (const f of copy_targets) { const src = path.join(pkg_root, f); const dest = path.join(dest, f); if (!fs.existssync(src)) continue; const stat = fs.statsync(src); if (stat.isdirectory()) { copydir(src, dest); } else { fs.copyfilesync(src, dest); } console.log(' copied', f); } generateplists();

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/cli.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = social-autoposter@1.7.7 matchedPath = bin/cli.js matchedIdentity = npm:c29jaWFsLWF1dG9wb3N0ZXI:1.7.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg

skill/dm-outreach-reddit.shView file

•path = skill/dm-outreach-reddit.sh kind = build_helper sizeBytes = 17070 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skill/dm-outreach-reddit.shView on unpkg

mcp/dist/runtime.jsView file

•matchType = normalized_sha256 matchedPackage = social-autoposter@1.7.7 matchedPath = mcp/dist/runtime.js matchedIdentity = npm:c29jaWFsLWF1dG9wb3N0ZXI:1.7.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp/dist/runtime.jsView on unpkg

mcp/dist/screencast.jsView file

•matchType = normalized_sha256 matchedPackage = social-autoposter@1.7.7 matchedPath = mcp/dist/screencast.js matchedIdentity = npm:c29jaWFsLWF1dG9wb3N0ZXI:1.7.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp/dist/screencast.jsView on unpkg

Source & flagged code

10 flagged · loading source

bin/cookie-helper.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code