registry / splatty / 0.1.0

splatty@0.1.0

Platty — Syncplay-compatible watch-together client with a terminal (Ink) GUI

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 59 file(s), 285 KB of source

Source & flagged code

2 flagged

dist/config/iniStructure.jsView file

Lines 120-160javascript

120 { key: "showDurationNotification", section: "GUI (Syncplay)", label: "Show duration notification", type: "boolean" },

121 { key: "showContactInfo", section: "GUI (Syncplay)", label: "Show contact info", type: "boolean" },

122 { key: "chatInputEnabled", section: "GUI (Syncplay)", label: "Chat input enabled", type: "boolean" },

123 { key: "chatOutputEnabled", section: "GUI (Syncplay)", label: "Chat output enabled", type: "boolean" },

124 { key: "chatDirectInput", section: "GUI (Syncplay)", label: "Chat direct input", type: "boolean" },

125 { key: "chatOutputMode", section: "GUI (Syncplay)", label: "Chat output mode", type: "string" },

126 { key: "chatMaxLines", section: "GUI (Syncplay)", label: "Chat max lines", type: "number" },

127 { key: "notificationTimeout", section: "GUI (Syncplay)", label: "Notification timeout (s)", type: "number" },

128 { key: "alertTimeout", section: "GUI (Syncplay)", label: "Alert timeout (s)", type: "number" },

129 { key: "chatTimeout", section: "GUI (Syncplay)", label: "Chat timeout (s)", type: "number" },

130];

131/** Aliases for /set and CLI — maps user-facing names to config keys. */

132export const CONFIG_ALIASES = {

133 name: "name",

134 username: "name",

135 user: "name",

136 host: "host",

137 server: "host",

138 port: "port",

139 room: "room",

140 password: "password",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/config/iniStructure.jsView on unpkg · L140

141 pass: "password",

142 player: "playerKind",

143 playerkind: "playerKind",

144 "player-path": "playerPath",

145 playerpath: "playerPath",

146 media: "mediaSearchDirectories",

147 "media-dirs": "mediaSearchDirectories",

148 mediadirs: "mediaSearchDirectories",

149 "media-directories": "mediaSearchDirectories",

150 mediasearchdirectories: "mediaSearchDirectories",

151 ready: "readyAtStart",

152 readyatstart: "readyAtStart",

153 language: "language",

154 lang: "language",

155 rooms: "roomList",

156 "room-list": "roomList",

157 servers: "publicServers",

158 "public-servers": "publicServers",

159 "player-args": "perPlayerArguments",

160 playerargs: "perPlayerArguments",

dist/server/SyncServer.jsView file

Lines 1-31javascript

1// The server-wide singleton (factory equivalent). See ../../spec/server/overview-and-cli.md.

2//

3// Implements: room isolation, managed/controlled rooms, playlist validation, MOTD templating

4// (including the old-client warning and userIp substitution), chat/username/filename/room-name

5// truncation, the 1.2.255 handshake compatibility hack, the full ignoringOnTheFly flow control,

6// room/playlist persistence (--rooms-db-file), permanent rooms (--permanent-rooms-file), basic

7// version-adoption stats (--stats-db-file), in-band STARTTLS (--tls), and dual-stack/env-var CLI

8// options. See the doc comments on the individual options below for known simplifications vs.

9// the reference implementation (mostly: no byte-identical DB format, no TLS cert hot-reload).

10import

Source & flagged code

2 flagged · loading source

dist/config/iniStructure.jsView file

140patternName = generic_password severity = medium line = 140 matchedText = password...rd",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/config/iniStructure.jsView on unpkg · L140

dist/server/SyncServer.jsView file

11import { readFileSync } from "node:fs"; L12: import { createServer } from "node:net"; L13: import { generateServerSalt } from "../protocol/roomPassword.js"; ... L144: * `version` uses the protocol realversion (REAL_VERSION) rather than this rewrite's own L145: * package.json semver - historically `$version` in a Syncplay MOTD template resolves to the L146: * app/protocol version users recognize (e.g. "1.7.6"), which REAL_VERSION mirrors; the

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/SyncServer.jsView on unpkg · L11

Findings

2 Medium6 Low

MediumSecret Patterndist/config/iniStructure.js

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/server/SyncServer.js

LowFilesystem

LowHigh Entropy Strings

LowNo License