registry / specrails-desktop / 2.17.0

specrails-desktop@2.17.0

AI Security Review

scanned 5d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The package is a desktop manager/CLI bridge that launches local services, local AI CLI jobs, browser capture, plugin installers, and shell integration only during explicit runtime use.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `specrails-desktop` commands or interacts with the local desktop server UI/API.

Impact

Can execute user-requested Claude jobs, install uv prerequisite, and write Specrails state/shims under the user's home directory; no unconsented install-time execution or exfiltration found.

Mechanism

User-invoked local AI/desktop orchestration with localhost APIs and local state files.

Rationale

Static source inspection shows high-risk capabilities, but they are expected for this package's desktop AI orchestration purpose and are activated by explicit CLI/UI/API use rather than npm install or import. I found no credential harvesting, hidden remote exfiltration, persistence outside Specrails-managed state, or unconsented AI-agent control-surface mutation.

Evidence

package.jsoncli/dist/specrails-desktop.jsserver/dist/plugins/prereq-installer.jsserver/dist/browser-context-pool.jsserver/dist/terminal-shell-integration.jsserver/dist/index.jsserver/dist/auth.jsserver/dist/mobile/mobile-gateway.jsclient/dist/assets/html.worker-CQP8QQsS.js~/.specrails/desktop.token~/.specrails/hub.token~/.specrails/manager.pid~/.specrails/desktop.log~/.specrails/browser-profile~/.specrails/projects/<projectSlug>/terminals/<sessionId>/.zshrc~/.specrails/projects/<projectSlug>/terminals/<sessionId>/shim.bash~/.specrails/projects/<projectSlug>/terminals/<sessionId>/profile.ps1

Network endpoints7

127.0.0.1:<port>/api/health127.0.0.1:<port>/api/spawnws://127.0.0.1:<port>astral.sh/uv/install.shastral.sh/uv/install.ps1specrails.dev/companion-signal.phpspecrails.dev

Decision evidence

public snapshot

AI called this Clean at 87.0% confidence as Benign with medium false-positive risk.

Evidence for block

CLI can spawn local `claude` with user-supplied command when invoked directly (`cli/dist/specrails-desktop.js`).
Server plugin prerequisite route can run official uv installer via curl/PowerShell only after explicit API action (`server/dist/plugins/prereq-installer.js`).
Runtime writes local state/shims/tokens under `~/.specrails` (`server/dist/terminal-shell-integration.js`, `server/dist/auth.js`).

Evidence against

`package.json` has no install/postinstall/prepare lifecycle hooks; only user-run scripts and a bin entry.
Network endpoints are localhost manager APIs plus package-aligned `astral.sh` uv installer and `specrails.dev` companion/settings URLs.
CLI HTTP/WebSocket traffic is to `127.0.0.1:<port>` and uses local desktop token, not remote exfiltration.
Shell integration writes per-session rc/profile shims under `~/.specrails/projects/.../terminals`, not persistent user shell profiles.
Scanner Trojan Source hint in `client/dist/assets/html.worker-CQP8QQsS.js` did not match bidi/invisible controls in direct byte search.
Dangerous primitives are aligned with a desktop AI manager/CLI bridge and are user-invoked, not install/import-time behavior.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 527 file(s), 10.0 MB of source, external domains: 127.0.0.1, acme.atlassian.net, astral.sh, bit.ly, brew.sh, bugzilla.mozilla.org, claude.com, code.google.com, dein-unternehmen.atlassian.net, developer.mozilla.org, developers.google.com, developers.openai.com, docs.astral.sh, drafts.csswg.org, en.wikipedia.org, example.atlassian.net, git-scm.com, github.com, googlechrome.github.io, hacks.mozilla.org, help.yahoo.com, html.spec.whatwg.org, nodejs.org, r12a.github.io, radix-ui.com, react.dev, reactflow.dev, reactrouter.com, redux-toolkit.js.org, redux.js.org, registry.npmjs.org, sass-lang.com, schema.org, specrails.dev, stackoverflow.com, sua-empresa.atlassian.net, support.google.com, tools.ietf.org, tu-empresa.atlassian.net, tua-azienda.atlassian.net, votre-entreprise.atlassian.net, wiki.whatwg.org, www.bing.com, www.dmoz.org, www.iana.org, www.ietf.org, www.w3.org, www.whatwg.org, your-company.atlassian.net

Oversized source lightweight scan

client/dist/assets/editor.api2-CrNrMVfe.js3.46 MB file, sampled 256 KB

ChildProcessObfuscatedHighEntropyStringsMinified

client/dist/assets/ts.worker-METxwbDZ.js6.57 MB file, sampled 256 KB

FilesystemNetworkChildProcess

Source & flagged code

5 flagged

server/dist/browser-context-pool.jsView file

Lines 1-37javascript

1"use strict";

2// App-wide owner of a SINGLE persistent Chromium context for "Add Spec from a

3// website". Its profile (cookies, logins, localStorage) lives in ONE GLOBAL dir

4// under $HOME, so the captured browser shares its session across every project —

5// log in once, and any project's capture window sees those cookies.

6//

7// Why a shared singleton (not per-project): a persistent Chromium profile takes

8// an EXCLUSIVE on-disk lock, so exactly one context may open a given userDataDir.

9// Pointing every project at one global dir therefore REQUIRES a single shared

10// context; each per-project BrowserCaptureManager opens its own pages in it

11// (pages are isolated enough for capture, cookies are shared). The context is

12// launched lazily on first use and closed once at app shutdown.

13var __importDefault = (this && this.__importDefault) || function (mod) {

14 return (mod && mod.__esModule) ? mod : { "default": mod };

15};

16Object.defineProperty(exports, "__esModule", { value: true });

17exports.SharedBrowserContextPool = void 0;

18const os_1 = __importDefault(require("os"));

19const path_1 = __importDefault(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/dist/browser-context-pool.jsView on unpkg · L17

20const browser_capture_types_1 = require("./browser-capture-types");

21const browser_playwright_1 = require("./browser-playwright");

22const DEFAULT_VIEWPORT = { width: 1280, height: 800 };

23class SharedBrowserContextPool {

24 launcher;

25 _profileDir;

26 context = null;

27 contextPromise = null;

28 disposed = false;

29 constructor(opts = {}) {

30 this.launcher = opts.launcher ?? (0, browser_playwright_1.createPlaywrightLauncher)();

31 this._profileDir =

32 opts.profileDir ?? path_1.default.join(opts.homeDir ?? os_1.default.homedir(), '.specrails', 'browser-profile');

33 }

34 /** The global profile dir backing the shared cookies/logins. */

35 get profileDir() {

36 return this._profileDir;

37 }

server/dist/terminal-shell-integration.jsView file

Lines 3-43javascript

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.NO_SHELL_INTEGRATION = void 0;

server/dist/plugins/prereq-installer.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.installPrerequisite = installPrerequisite;

4const child_process_1 = require("child_process");

5const win_spawn_1 =

client/dist/assets/html.worker-CQP8QQsS.jsView file

29contains invisible/control Unicode U+2060 (word joiner) `,"nexist;":`∄`,"nexists;":`∄`,"Nfr;":`𝔑`,"nfr;":`𝔫`,"ngE;":`≧̸`,"nge;":`≱`,"ngeq;":`≱`,"ngeqq;":`≧̸`,"ngeqslant;":`⩾̸`,"nges;":`⩾̸`,"nGg;":`⋙̸`,"ngsim;":`≵`,"nGt;":`≫⃒`,"ngt;":`≯`,"ngtr;":`≯`,"nGtv;":`≫̸`,"nhArr;":`⇎`,"nharr;":`↮`,"nhpar;"

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

client/dist/assets/html.worker-CQP8QQsS.jsView on unpkg · L29

client/dist/assets/editor.api2-CrNrMVfe.jsView file

•path = client/dist/assets/editor.api2-CrNrMVfe.js kind = oversized_source_file sizeBytes = 3626915 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

client/dist/assets/editor.api2-CrNrMVfe.jsView on unpkg

Source & flagged code

5 flagged · loading source

server/dist/browser-context-pool.jsView file

17exports.SharedBrowserContextPool = void 0; L18: const os_1 = __importDefault(require("os")); L19: const path_1 = __importDefault(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/dist/browser-context-pool.jsView on unpkg · L17

server/dist/terminal-shell-integration.jsView file

23* Resolve the shell basename for our switch logic. We accept full paths or bare L24: * basenames (e.g. "/bin/zsh", "C:\\Program Files\\PowerShell\\7\\pwsh.exe"). L25: */ ... L34: const candidates = [ L35: path_1.default.resolve(__dirname, 'shell-integration', name), L36: // Desktop bundle: shims ship under binaries/shell-integration (declared in ... L88: return exports.NO_SHELL_INTEGRATION; L89: const userZdotdirZshrc = path_1.default.join(shimDir, '.zshrc'); L90: const shimContent = `# Specrails auto-generated zsh entry — do not edit\nsource '${bundled.replace(/'/g, `'\\''`)}'\n`; ... L96: // zsh skip the login files and lose PATH/Homebrew/nvm setup. L97: env: { ZDOTDIR: shimDir, SPECRAILS_REAL_ZDOTDIR: process.env.ZDOTDIR ?? '' }, L98: shimDir,

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

server/dist/terminal-shell-integration.jsView on unpkg · L23

server/dist/plugins/prereq-installer.jsView file

3exports.installPrerequisite = installPrerequisite; L4: const child_process_1 = require("child_process"); L5: const win_spawn_1 = require("../util/win-spawn"); ... L13: return null; L14: if (process.platform === 'darwin' || process.platform === 'linux') { L15: return { L16: label: 'Astral uv installer (curl)', L17: shell: 'curl -LsSf https://astral.sh/uv/install.sh | sh', L18: }; ... L31: /** L32: * Run the platform-appropriate installer for `name` and stream stdout+stderr L33: * to `broadcast` as `plugin.prereq_install_progress` events. Resolves once the

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

server/dist/plugins/prereq-installer.jsView on unpkg · L3

client/dist/assets/html.worker-CQP8QQsS.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

client/dist/assets/html.worker-CQP8QQsS.jsView on unpkg · L29

client/dist/assets/editor.api2-CrNrMVfe.jsView file

•path = client/dist/assets/editor.api2-CrNrMVfe.js kind = oversized_source_file sizeBytes = 3626915 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

client/dist/assets/editor.api2-CrNrMVfe.jsView on unpkg

Findings

1 Critical2 High6 Medium5 Low

CriticalTrojan Source Unicodeclient/dist/assets/html.worker-CQP8QQsS.js

HighSandbox Evasion Gated Capabilityserver/dist/plugins/prereq-installer.js

HighOversized Source Fileclient/dist/assets/editor.api2-CrNrMVfe.js

MediumDynamic Requireserver/dist/browser-context-pool.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistenceserver/dist/terminal-shell-integration.js

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings