registry / specrails-desktop / 2.18.2

specrails-desktop@2.18.2

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package is a desktop/CLI manager for Specrails workflows and contains user-invoked local process, browser, shell integration, and localhost API behavior that matches its stated functionality.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `specrails-desktop` commands, desktop manager features, terminal integration, or prerequisite install actions.

Impact

Can run local Claude commands and create user-profile support files when invoked, but no unconsented install-time execution or credential exfiltration was found.

Mechanism

Local CLI bridge, localhost HTTP/WebSocket manager calls, optional Claude subprocess, optional uv installer, and temporary shell shims.

Rationale

Static inspection found high-risk primitives, but they are user-invoked and aligned with a desktop automation manager; there are no lifecycle hooks, external exfiltration, hidden payload loading, or persistence beyond temporary integration shims. The scanner's malicious verdict appears to be a false positive from dual-use CLI/desktop functionality.

Evidence

package.jsoncli/dist/specrails-desktop.jsserver/dist/plugins/prereq-installer.jsserver/dist/terminal-shell-integration.jsserver/dist/browser-context-pool.js~/.specrails/desktop.token~/.specrails/hub.token~/.specrails/projects/<projectSlug>/terminals/<sessionId>/.zshrc~/.specrails/projects/<projectSlug>/terminals/<sessionId>/shim.bash~/.specrails/projects/<projectSlug>/terminals/<sessionId>/profile.ps1~/.specrails/browser-profile

Network endpoints5

127.0.0.1:<port>/api/health127.0.0.1:<port>/api/spawnws://127.0.0.1:<port>astral.sh/uv/install.shastral.sh/uv/install.ps1

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for block

CLI fallback runs local `claude` with `--dangerously-skip-permissions` when manager is absent (`cli/dist/specrails-desktop.js`).
User-invoked prerequisite installer downloads and pipes Astral uv install scripts via curl/PowerShell (`server/dist/plugins/prereq-installer.js`).
Shell integration writes temporary per-session shell rc/profile shims under `~/.specrails/projects` (`server/dist/terminal-shell-integration.js`).

Evidence against

`package.json` has no install/preinstall/postinstall lifecycle hooks; risky behavior is not install-time.
Network use is local manager API/WebSocket on `127.0.0.1:<port>` or user-approved uv installer, aligned with desktop manager functionality.
CLI reads `~/.specrails/desktop.token` only to authenticate to the local manager, not exfiltrate it.
Browser profile under `~/.specrails/browser-profile` supports explicit website capture with Playwright, not background credential harvesting.
No evidence of persistence beyond session shims, destructive actions, obfuscated staged payloads, or external exfiltration endpoints in inspected files.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 541 file(s), 10.3 MB of source, external domains: 127.0.0.1, acme.atlassian.net, astral.sh, bit.ly, brew.sh, bugzilla.mozilla.org, claude.com, code.google.com, dein-unternehmen.atlassian.net, developer.mozilla.org, developers.google.com, developers.openai.com, docs.astral.sh, drafts.csswg.org, en.wikipedia.org, example.atlassian.net, git-scm.com, github.com, googlechrome.github.io, hacks.mozilla.org, help.yahoo.com, html.spec.whatwg.org, nodejs.org, r12a.github.io, radix-ui.com, react.dev, reactflow.dev, reactrouter.com, redux-toolkit.js.org, redux.js.org, registry.npmjs.org, sass-lang.com, schema.org, specrails.dev, stackoverflow.com, sua-empresa.atlassian.net, support.google.com, tools.ietf.org, tu-empresa.atlassian.net, tua-azienda.atlassian.net, votre-entreprise.atlassian.net, wiki.whatwg.org, www.bing.com, www.dmoz.org, www.iana.org, www.ietf.org, www.w3.org, www.whatwg.org, your-company.atlassian.net

Oversized source lightweight scan

client/dist/assets/editor.api2-T7u8kQWG.js3.46 MB file, sampled 256 KB

ChildProcessObfuscatedHighEntropyStringsMinified

client/dist/assets/ts.worker-METxwbDZ.js6.57 MB file, sampled 256 KB

FilesystemNetworkChildProcess

Source & flagged code

5 flagged

server/dist/browser-context-pool.jsView file

Lines 1-37javascript

1"use strict";

2// App-wide owner of a SINGLE persistent Chromium context for "Add Spec from a

3// website". Its profile (cookies, logins, localStorage) lives in ONE GLOBAL dir

4// under $HOME, so the captured browser shares its session across every project —

5// log in once, and any project's capture window sees those cookies.

6//

7// Why a shared singleton (not per-project): a persistent Chromium profile takes

8// an EXCLUSIVE on-disk lock, so exactly one context may open a given userDataDir.

9// Pointing every project at one global dir therefore REQUIRES a single shared

10// context; each per-project BrowserCaptureManager opens its own pages in it

11// (pages are isolated enough for capture, cookies are shared). The context is

12// launched lazily on first use and closed once at app shutdown.

13var __importDefault = (this && this.__importDefault) || function (mod) {

14 return (mod && mod.__esModule) ? mod : { "default": mod };

15};

16Object.defineProperty(exports, "__esModule", { value: true });

17exports.SharedBrowserContextPool = void 0;

18const os_1 = __importDefault(require("os"));

19const path_1 = __importDefault(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/dist/browser-context-pool.jsView on unpkg · L17

20const browser_capture_types_1 = require("./browser-capture-types");

21const browser_playwright_1 = require("./browser-playwright");

22const DEFAULT_VIEWPORT = { width: 1280, height: 800 };

23class SharedBrowserContextPool {

24 launcher;

25 _profileDir;

26 context = null;

27 contextPromise = null;

28 disposed = false;

29 constructor(opts = {}) {

30 this.launcher = opts.launcher ?? (0, browser_playwright_1.createPlaywrightLauncher)();

31 this._profileDir =

32 opts.profileDir ?? path_1.default.join(opts.homeDir ?? os_1.default.homedir(), '.specrails', 'browser-profile');

33 }

34 /** The global profile dir backing the shared cookies/logins. */

35 get profileDir() {

36 return this._profileDir;

37 }

server/dist/terminal-shell-integration.jsView file

Lines 3-43javascript

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.NO_SHELL_INTEGRATION = void 0;

server/dist/plugins/prereq-installer.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.installPrerequisite = installPrerequisite;

4const child_process_1 = require("child_process");

5const win_spawn_1 =

client/dist/assets/html.worker-CQP8QQsS.jsView file

29contains invisible/control Unicode U+2060 (word joiner) `,"nexist;":`∄`,"nexists;":`∄`,"Nfr;":`𝔑`,"nfr;":`𝔫`,"ngE;":`≧̸`,"nge;":`≱`,"ngeq;":`≱`,"ngeqq;":`≧̸`,"ngeqslant;":`⩾̸`,"nges;":`⩾̸`,"nGg;":`⋙̸`,"ngsim;":`≵`,"nGt;":`≫⃒`,"ngt;":`≯`,"ngtr;":`≯`,"nGtv;":`≫̸`,"nhArr;":`⇎`,"nharr;":`↮`,"nhpar;"

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

client/dist/assets/html.worker-CQP8QQsS.jsView on unpkg · L29

client/dist/assets/ts.worker-METxwbDZ.jsView file

•path = client/dist/assets/ts.worker-METxwbDZ.js kind = oversized_source_file sizeBytes = 6894230 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

client/dist/assets/ts.worker-METxwbDZ.jsView on unpkg

Source & flagged code

5 flagged · loading source

server/dist/browser-context-pool.jsView file

17exports.SharedBrowserContextPool = void 0; L18: const os_1 = __importDefault(require("os")); L19: const path_1 = __importDefault(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/dist/browser-context-pool.jsView on unpkg · L17

server/dist/terminal-shell-integration.jsView file

23* Resolve the shell basename for our switch logic. We accept full paths or bare L24: * basenames (e.g. "/bin/zsh", "C:\\Program Files\\PowerShell\\7\\pwsh.exe"). L25: */ ... L34: const candidates = [ L35: path_1.default.resolve(__dirname, 'shell-integration', name), L36: // Desktop bundle: shims ship under binaries/shell-integration (declared in ... L88: return exports.NO_SHELL_INTEGRATION; L89: const userZdotdirZshrc = path_1.default.join(shimDir, '.zshrc'); L90: const shimContent = `# Specrails auto-generated zsh entry — do not edit\nsource '${bundled.replace(/'/g, `'\\''`)}'\n`; ... L96: // zsh skip the login files and lose PATH/Homebrew/nvm setup. L97: env: { ZDOTDIR: shimDir, SPECRAILS_REAL_ZDOTDIR: process.env.ZDOTDIR ?? '' }, L98: shimDir,

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

server/dist/terminal-shell-integration.jsView on unpkg · L23

server/dist/plugins/prereq-installer.jsView file

3exports.installPrerequisite = installPrerequisite; L4: const child_process_1 = require("child_process"); L5: const win_spawn_1 = require("../util/win-spawn"); ... L13: return null; L14: if (process.platform === 'darwin' || process.platform === 'linux') { L15: return { L16: label: 'Astral uv installer (curl)', L17: shell: 'curl -LsSf https://astral.sh/uv/install.sh | sh', L18: }; ... L31: /** L32: * Run the platform-appropriate installer for `name` and stream stdout+stderr L33: * to `broadcast` as `plugin.prereq_install_progress` events. Resolves once the

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

server/dist/plugins/prereq-installer.jsView on unpkg · L3

client/dist/assets/html.worker-CQP8QQsS.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

client/dist/assets/html.worker-CQP8QQsS.jsView on unpkg · L29

client/dist/assets/ts.worker-METxwbDZ.jsView file

•path = client/dist/assets/ts.worker-METxwbDZ.js kind = oversized_source_file sizeBytes = 6894230 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

client/dist/assets/ts.worker-METxwbDZ.jsView on unpkg

Findings

1 Critical2 High6 Medium5 Low

CriticalTrojan Source Unicodeclient/dist/assets/html.worker-CQP8QQsS.js

HighSandbox Evasion Gated Capabilityserver/dist/plugins/prereq-installer.js

HighOversized Source Fileclient/dist/assets/ts.worker-METxwbDZ.js

MediumDynamic Requireserver/dist/browser-context-pool.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistenceserver/dist/terminal-shell-integration.js

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings