registry / tide-commander / 1.127.0

tide-commander@1.127.0

⚠ Under review

Visual multi-agent orchestrator and manager for Claude Code with 3D/2D interface

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 353 file(s), 7.12 MB of source, external domains: 127.0.0.1, admin.google.com, api.anthropic.com, api.bitbucket.org, api.github.com, bitbucket.org, claude.ai, commander.local, console.cloud.google.com, example.com, github.com, id.atlassian.com, kenney.nl, kroki.io, ns.adobe.com, react.dev, registry.npmjs.org, wiki.example.com, www.googleapis.com, www.gstatic.com, www.w3.org, www.xfa.org, yourcompany.atlassian.net

Oversized source lightweight scan

dist/assets/main-C50UwZPh.js2.69 MB file, sampled 256 KB

NetworkHighEntropyStringsMinifiedUrlStringsreact.dev

Source & flagged code

8 flagged

dist/assets/index-C0I0uoBu.jsView file

Lines 1-9javascript

1import{bo as ta,u as B,j as e,aV as j,br as Ms,bs as Fs,aW as Ue,s as D,bt as $s,r as m,D as Z,I as F,ab as Us,b3 as Ve,f as na,bu as la,W as ia,S as oa,k as ra,aa as Ks,b4 as He}from"./main-C50UwZPh.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";const ca=[{value:"",labelKey:"terminal:building.colorDefault"},{value:"#2a2a3a",labelKey:"terminal:building.colorDarkGray"},{value:"#3a2a2a",labelKey:"terminal:building.colorDarkRed"},{value:"#2a3a2a",labelKey:"terminal:building.colorDarkGreen"},{value:"#2a2a4a",labelKey:"terminal:building.colorDarkBlue"},{value:"#3a3a2a",la ...

2SERVER_PORT=7201

3NODE_ENV=production`,rows:3})]}),e.jsx("div",{className:"pm2-examples",children:e.jsxs("details",{children:[e.jsx("summary",{children:i("terminal:building.pm2Examples")}),e.jsxs("div",{className:"pm2-examples-content",children:[e.jsxs("div",{className:"pm2-example",children:[e.jsx("strong",{children:"Node.js:"})," Script: ",e.jsx("code",{children:"npm"}),", Args: ",e.jsx("code",{children:"run dev"})]}),e.jsxs("div",{className:"pm2-example",children:[e.jsx("strong",{children:"Symfony:"})," Script: ",e.jsx("code",{children:"symfony"}),", Args: ",e.jsx("code",{children:"serve --no-daemon"}),", In ...

4DATABASE_URL=postgres://...

5NODE_ENV=production`,rows:3})]})]}),q&&(k==null?void 0:k.dockerStatus)&&e.jsxs("div",{className:"docker-status-display",children:[e.jsxs("div",{className:"docker-status-row",children:[e.jsxs("span",{className:"docker-metric",children:[e.jsx("span",{className:"docker-metric-label",children:"ID"}),e.jsx("span",{className:"docker-metric-value",children:k.dockerStatus.containerId||

6`):""),ce(((js=s.docker)==null?void 0:js.mode)||"container"),me(((gs=s.docker)==null?void 0:gs.mode)==="existing"&&((vs=s.docker)==null?void 0:vs.containerName)||""),ue(((Ns=s.docker)==null?void 0:Ns.image)||""),he(((fs=s.docker)==null?void 0:fs.containerName)||""),be(((ks=s.docker)==null?void 0:ks.ports)||[]),ge(((ys=s.docker)==null?void 0:ys.volumes)||[]),ve((Cs=s.docker)!=null&&Cs.env?Object.entries(s.docker.env).map(([Y,Ke])=>`${Y}=${Ke}`).join(`

7`):""),fe(((Ss=s.docker)==null?void 0:Ss.network)||""),ye(((ws=s.docker)==null?void 0:ws.command)||""),Ce(((Ps=s.docker)==null?void 0:Ps.restart)||"unless-stopped"),Se(((Ds=s.docker)==null?void 0:Ds.pull)||"missing"),Pe(((Es=s.docker)==null?void 0:Es.composePath)||""),Ee(((zs=s.docker)==null?void 0:zs.composeProject)||""),Le(((As=(Ls=s.docker)==null?void 0:Ls.services)==null?void 0:As.join(", "))||""),Be(s.subordinateBuildingIds||[]),Re(((Bs=s.database)==null?void 0:Bs.connections)||[]),Ie((Ts=s.database)==null?void 0:Ts.activeConnectionId),Oe(((Rs=s.terminal)==null?void 0:Rs.shell)||""),Me((I ...

8`).map(f=>f.trim()).filter(f=>f&&f.includes("=")).map(f=>{const w=f.indexOf("=");return[f.slice(0,w),f.slice(w+1)]}))},Js=d=>{d.preventDefault();

Long lines were clipped for display.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView file

24* pdfjsBuild = ada343803 L25: */const e=!("object"!=typeof process||process+""!="[object process]"||process.versions.nw||process.versions.electron&&process.type&&"browser"!==process.type),t=[.001,0,0,.001,0,0],... L26: /*webpackIgnore: true*/

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView on unpkg · L24

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView on unpkg · L24

dist/src/packages/server/integrations/whatsapp/whatsapp-trigger-handler.jsView file

Lines 114-154javascript

114 client.close();

115 client = null;

116 }

117 dedupe.clear();

118 contactNames.clear();

119 groupNames.clear();

120 }

121 function

scripts/krunner/install-krunner-integration.shView file

•path = scripts/krunner/install-krunner-integration.sh kind = build_helper sizeBytes = 1784 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/krunner/install-krunner-integration.shView on unpkg

dist/assets/main-C50UwZPh.jsView file

•path = dist/assets/main-C50UwZPh.js kind = oversized_source_file sizeBytes = 2818947 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/main-C50UwZPh.jsView on unpkg

dist/src/packages/server/data/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = tide-commander@1.126.0 matchedIdentity = npm:dGlkZS1jb21tYW5kZXI:1.126.0 similarity = 0.958 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/src/packages/server/data/index.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/assets/index-C0I0uoBu.jsView file

5patternName = private_key_openssh severity = critical line = 5 matchedText = NODE_ENV...in(`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/assets/index-C0I0uoBu.jsView on unpkg · L5

5patternName = private_key_openssh severity = critical line = 5 matchedText = NODE_ENV...in(`

Critical

Secret Pattern

OpenSSH private key in dist/assets/index-C0I0uoBu.js

dist/assets/index-C0I0uoBu.jsView on unpkg · L5

dist/assets/pdf.worker.min-FHbmGBN0.mjsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView on unpkg · L24

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView on unpkg · L24

dist/src/packages/server/integrations/whatsapp/whatsapp-trigger-handler.jsView file

134direction: payload.direction, L135: body: payload.body, L136: messageType: payload.mediaType ?? 'text', ... L573: // Protocol-relative; pick scheme from baseUrl. L574: const scheme = baseUrl.startsWith('https://') ? 'https:' : 'http:'; L575: return scheme + url;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/packages/server/integrations/whatsapp/whatsapp-trigger-handler.jsView on unpkg · L134

scripts/krunner/install-krunner-integration.shView file

•path = scripts/krunner/install-krunner-integration.sh kind = build_helper sizeBytes = 1784 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/krunner/install-krunner-integration.shView on unpkg

dist/assets/main-C50UwZPh.jsView file

•path = dist/assets/main-C50UwZPh.js kind = oversized_source_file sizeBytes = 2818947 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/main-C50UwZPh.jsView on unpkg

dist/src/packages/server/data/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/src/packages/server/data/index.jsView on unpkg

Findings

3 Critical1 High6 Medium7 Low

CriticalCritical Secretdist/assets/index-C0I0uoBu.js

CriticalPrevious Version Dangerous Deltadist/src/packages/server/data/index.js

CriticalSecret Patterndist/assets/index-C0I0uoBu.js

HighOversized Source Filedist/assets/main-C50UwZPh.js

MediumDynamic Requiredist/assets/pdf.worker.min-FHbmGBN0.mjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Build Helperscripts/krunner/install-krunner-integration.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/assets/pdf.worker.min-FHbmGBN0.mjs

LowWeak Cryptodist/src/packages/server/integrations/whatsapp/whatsapp-trigger-handler.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

dist/assets/index-C0I0uoBu.jsView file

Lines 1-9javascript

2SERVER_PORT=7201

4DATABASE_URL=postgres://...

8`).map(f=>f.trim()).filter(f=>f&&f.includes("=")).map(f=>{const w=f.indexOf("=");return[f.slice(0,w),f.slice(w+1)]}))},Js=d=>{d.preventDefault();

Long lines were clipped for display.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView on unpkg · L24

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView on unpkg · L24

dist/src/packages/server/integrations/whatsapp/whatsapp-trigger-handler.jsView file

Lines 114-154javascript

114 client.close();

115 client = null;

116 }

117 dedupe.clear();

118 contactNames.clear();

119 groupNames.clear();

120 }

121 function

scripts/krunner/install-krunner-integration.shView file

•path = scripts/krunner/install-krunner-integration.sh kind = build_helper sizeBytes = 1784 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/krunner/install-krunner-integration.shView on unpkg

dist/assets/main-C50UwZPh.jsView file

•path = dist/assets/main-C50UwZPh.js kind = oversized_source_file sizeBytes = 2818947 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/main-C50UwZPh.jsView on unpkg

dist/src/packages/server/data/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/src/packages/server/data/index.jsView on unpkg