registry / specrails-desktop / 2.18.0

specrails-desktop@2.18.0

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Risky primitives are user-invoked desktop/AI-agent features aligned with the package purpose, with no install-time execution or covert exfiltration found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs specrails-desktop commands or uses desktop server/plugin UI actions.

Impact

User-authorized local automation; no confirmed unauthorized persistence, credential theft, or destructive behavior.

Mechanism

local desktop manager, AI CLI spawning, optional plugin/prerequisite setup

Rationale

Static inspection found dangerous capabilities, but they are exposed as explicit desktop/CLI product features and not as install-time/import-time or covert behavior. No credential harvesting, external exfiltration, dependency confusion, or unconsented AI-agent control-surface mutation was confirmed.

Evidence

package.jsoncli/dist/specrails-desktop.jsserver/dist/plugins/prereq-installer.jsserver/dist/terminal-shell-integration.jsserver/dist/browser-context-pool.jsserver/dist/plugins/claude-approval.js.claude/commands/specrails/batch-implement.mdclient/dist/assets/html.worker-CQP8QQsS.js~/.specrails/desktop.token~/.specrails/hub.token~/.specrails/manager.pid~/.specrails/desktop.log~/.specrails/projects/<slug>/terminals/<sessionId>~/.claude/settings.json

Network endpoints4

127.0.0.1:<port>ws://127.0.0.1:<port>astral.sh/uv/install.shastral.sh/uv/install.ps1

Decision evidence

public snapshot

AI called this Clean at 82.0% confidence as Benign with medium false-positive risk.

Evidence for block

cli/dist/specrails-desktop.js can spawn claude with --dangerously-skip-permissions on user command fallback.
server/dist/plugins/prereq-installer.js can run Astral uv curl/PowerShell installer via explicit API route.
server/dist/terminal-shell-integration.js writes per-session shell shims under ~/.specrails/projects.
server/dist/plugins/claude-approval.js can disable Claude marketplace plugin entries via explicit route.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks.
cli/dist/specrails-desktop.js only contacts http://127.0.0.1:<port> manager APIs/WebSocket and reads local desktop.token for auth.
server/dist/plugins/prereq-installer.js installer is restricted to prereq name 'uv' and official astral.sh URLs.
server/dist/browser-context-pool.js uses a Playwright profile for app browser capture, not credential harvesting/exfiltration.
client/dist/assets/html.worker-CQP8QQsS.js appears to be bundled editor worker code, not an active payload.
Packaged .claude/commands are product command prompts for specrails workflows, not lifecycle mutation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 541 file(s), 10.3 MB of source, external domains: 127.0.0.1, acme.atlassian.net, astral.sh, bit.ly, brew.sh, bugzilla.mozilla.org, claude.com, code.google.com, dein-unternehmen.atlassian.net, developer.mozilla.org, developers.google.com, developers.openai.com, docs.astral.sh, drafts.csswg.org, en.wikipedia.org, example.atlassian.net, git-scm.com, github.com, googlechrome.github.io, hacks.mozilla.org, help.yahoo.com, html.spec.whatwg.org, nodejs.org, r12a.github.io, radix-ui.com, react.dev, reactflow.dev, reactrouter.com, redux-toolkit.js.org, redux.js.org, registry.npmjs.org, sass-lang.com, schema.org, specrails.dev, stackoverflow.com, sua-empresa.atlassian.net, support.google.com, tools.ietf.org, tu-empresa.atlassian.net, tua-azienda.atlassian.net, votre-entreprise.atlassian.net, wiki.whatwg.org, www.bing.com, www.dmoz.org, www.iana.org, www.ietf.org, www.w3.org, www.whatwg.org, your-company.atlassian.net

Oversized source lightweight scan

client/dist/assets/editor.api2-T7u8kQWG.js3.46 MB file, sampled 256 KB

ChildProcessObfuscatedHighEntropyStringsMinified

client/dist/assets/ts.worker-METxwbDZ.js6.57 MB file, sampled 256 KB

FilesystemNetworkChildProcess

Source & flagged code

5 flagged

server/dist/browser-context-pool.jsView file

Lines 1-37javascript

1"use strict";

2// App-wide owner of a SINGLE persistent Chromium context for "Add Spec from a

3// website". Its profile (cookies, logins, localStorage) lives in ONE GLOBAL dir

4// under $HOME, so the captured browser shares its session across every project —

5// log in once, and any project's capture window sees those cookies.

6//

7// Why a shared singleton (not per-project): a persistent Chromium profile takes

8// an EXCLUSIVE on-disk lock, so exactly one context may open a given userDataDir.

9// Pointing every project at one global dir therefore REQUIRES a single shared

10// context; each per-project BrowserCaptureManager opens its own pages in it

11// (pages are isolated enough for capture, cookies are shared). The context is

12// launched lazily on first use and closed once at app shutdown.

13var __importDefault = (this && this.__importDefault) || function (mod) {

14 return (mod && mod.__esModule) ? mod : { "default": mod };

15};

16Object.defineProperty(exports, "__esModule", { value: true });

17exports.SharedBrowserContextPool = void 0;

18const os_1 = __importDefault(require("os"));

19const path_1 = __importDefault(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/dist/browser-context-pool.jsView on unpkg · L17

20const browser_capture_types_1 = require("./browser-capture-types");

21const browser_playwright_1 = require("./browser-playwright");

22const DEFAULT_VIEWPORT = { width: 1280, height: 800 };

23class SharedBrowserContextPool {

24 launcher;

25 _profileDir;

26 context = null;

27 contextPromise = null;

28 disposed = false;

29 constructor(opts = {}) {

30 this.launcher = opts.launcher ?? (0, browser_playwright_1.createPlaywrightLauncher)();

31 this._profileDir =

32 opts.profileDir ?? path_1.default.join(opts.homeDir ?? os_1.default.homedir(), '.specrails', 'browser-profile');

33 }

34 /** The global profile dir backing the shared cookies/logins. */

35 get profileDir() {

36 return this._profileDir;

37 }

server/dist/terminal-shell-integration.jsView file

Lines 3-43javascript

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.NO_SHELL_INTEGRATION = void 0;

server/dist/plugins/prereq-installer.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.installPrerequisite = installPrerequisite;

4const child_process_1 = require("child_process");

5const win_spawn_1 =

client/dist/assets/html.worker-CQP8QQsS.jsView file

29contains invisible/control Unicode U+2060 (word joiner) `,"nexist;":`∄`,"nexists;":`∄`,"Nfr;":`𝔑`,"nfr;":`𝔫`,"ngE;":`≧̸`,"nge;":`≱`,"ngeq;":`≱`,"ngeqq;":`≧̸`,"ngeqslant;":`⩾̸`,"nges;":`⩾̸`,"nGg;":`⋙̸`,"ngsim;":`≵`,"nGt;":`≫⃒`,"ngt;":`≯`,"ngtr;":`≯`,"nGtv;":`≫̸`,"nhArr;":`⇎`,"nharr;":`↮`,"nhpar;"

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

client/dist/assets/html.worker-CQP8QQsS.jsView on unpkg · L29

client/dist/assets/ts.worker-METxwbDZ.jsView file

•path = client/dist/assets/ts.worker-METxwbDZ.js kind = oversized_source_file sizeBytes = 6894230 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

client/dist/assets/ts.worker-METxwbDZ.jsView on unpkg

Source & flagged code

5 flagged · loading source

server/dist/browser-context-pool.jsView file

17exports.SharedBrowserContextPool = void 0; L18: const os_1 = __importDefault(require("os")); L19: const path_1 = __importDefault(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/dist/browser-context-pool.jsView on unpkg · L17

server/dist/terminal-shell-integration.jsView file

23* Resolve the shell basename for our switch logic. We accept full paths or bare L24: * basenames (e.g. "/bin/zsh", "C:\\Program Files\\PowerShell\\7\\pwsh.exe"). L25: */ ... L34: const candidates = [ L35: path_1.default.resolve(__dirname, 'shell-integration', name), L36: // Desktop bundle: shims ship under binaries/shell-integration (declared in ... L88: return exports.NO_SHELL_INTEGRATION; L89: const userZdotdirZshrc = path_1.default.join(shimDir, '.zshrc'); L90: const shimContent = `# Specrails auto-generated zsh entry — do not edit\nsource '${bundled.replace(/'/g, `'\\''`)}'\n`; ... L96: // zsh skip the login files and lose PATH/Homebrew/nvm setup. L97: env: { ZDOTDIR: shimDir, SPECRAILS_REAL_ZDOTDIR: process.env.ZDOTDIR ?? '' }, L98: shimDir,

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

server/dist/terminal-shell-integration.jsView on unpkg · L23

server/dist/plugins/prereq-installer.jsView file

3exports.installPrerequisite = installPrerequisite; L4: const child_process_1 = require("child_process"); L5: const win_spawn_1 = require("../util/win-spawn"); ... L13: return null; L14: if (process.platform === 'darwin' || process.platform === 'linux') { L15: return { L16: label: 'Astral uv installer (curl)', L17: shell: 'curl -LsSf https://astral.sh/uv/install.sh | sh', L18: }; ... L31: /** L32: * Run the platform-appropriate installer for `name` and stream stdout+stderr L33: * to `broadcast` as `plugin.prereq_install_progress` events. Resolves once the

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

server/dist/plugins/prereq-installer.jsView on unpkg · L3

client/dist/assets/html.worker-CQP8QQsS.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

client/dist/assets/html.worker-CQP8QQsS.jsView on unpkg · L29

client/dist/assets/ts.worker-METxwbDZ.jsView file

•path = client/dist/assets/ts.worker-METxwbDZ.js kind = oversized_source_file sizeBytes = 6894230 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

client/dist/assets/ts.worker-METxwbDZ.jsView on unpkg

Findings

1 Critical2 High6 Medium5 Low

CriticalTrojan Source Unicodeclient/dist/assets/html.worker-CQP8QQsS.js

HighSandbox Evasion Gated Capabilityserver/dist/plugins/prereq-installer.js

HighOversized Source Fileclient/dist/assets/ts.worker-METxwbDZ.js

MediumDynamic Requireserver/dist/browser-context-pool.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistenceserver/dist/terminal-shell-integration.js

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings