registry / tide-commander / 1.129.1

tide-commander@1.129.1

Visual multi-agent orchestrator and manager for Claude Code with 3D/2D interface

Static Scan Results

scanned 11h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 353 file(s), 7.17 MB of source, external domains: 127.0.0.1, admin.google.com, api.anthropic.com, api.bitbucket.org, api.github.com, bitbucket.org, claude.ai, commander.local, console.cloud.google.com, example.com, github.com, id.atlassian.com, kenney.nl, kroki.io, ns.adobe.com, react.dev, registry.npmjs.org, wiki.example.com, www.googleapis.com, www.gstatic.com, www.w3.org, www.xfa.org, yourcompany.atlassian.net

Oversized source lightweight scan

dist/assets/main-ChEsMqV1.js2.71 MB file, sampled 256 KB

NetworkHighEntropyStringsMinifiedUrlStringsreact.dev

Source & flagged code

7 flagged

dist/assets/index-v31fNaZP.jsView file

Lines 1-9javascript

1import{bq as ta,u as B,j as e,aX as j,bt as Ms,bu as Fs,aY as ae,s as D,bv as $s,r as m,D as X,I as F,ab as Us,b5 as qe,f as na,bw as la,W as ia,S as oa,k as ra,aa as Ks,b6 as Ue}from"./main-ChEsMqV1.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";const ca=[{value:"",labelKey:"terminal:building.colorDefault"},{value:"#2a2a3a",labelKey:"terminal:building.colorDarkGray"},{value:"#3a2a2a",labelKey:"terminal:building.colorDarkRed"},{value:"#2a3a2a",labelKey:"terminal:building.colorDarkGreen"},{value:"#2a2a4a",labelKey:"terminal:building.colorDarkBlue"},{value:"#3a3a2a",la ...

2SERVER_PORT=7201

3NODE_ENV=production`,rows:3})]}),e.jsx("div",{className:"pm2-examples",children:e.jsxs("details",{children:[e.jsx("summary",{children:i("terminal:building.pm2Examples")}),e.jsxs("div",{className:"pm2-examples-content",children:[e.jsxs("div",{className:"pm2-example",children:[e.jsx("strong",{children:"Node.js:"})," Script: ",e.jsx("code",{children:"npm"}),", Args: ",e.jsx("code",{children:"run dev"})]}),e.jsxs("div",{className:"pm2-example",children:[e.jsx("strong",{children:"Symfony:"})," Script: ",e.jsx("code",{children:"symfony"}),", Args: ",e.jsx("code",{children:"serve --no-daemon"}),", In ...

4DATABASE_URL=postgres://...

5NODE_ENV=production`,rows:3})]})]}),V&&(k==null?void 0:k.dockerStatus)&&e.jsxs("div",{className:"docker-status-display",children:[e.jsxs("div",{className:"docker-status-row",children:[e.jsxs("span",{className:"docker-metric",children:[e.jsx("span",{className:"docker-metric-label",children:"ID"}),e.jsx("span",{className:"docker-metric-value",children:k.dockerStatus.containerId

6`):""),de(((js=s.docker)==null?void 0:js.mode)||"container"),ue(((gs=s.docker)==null?void 0:gs.mode)==="existing"&&((vs=s.docker)==null?void 0:vs.containerName)||""),pe(((Ns=s.docker)==null?void 0:Ns.image)||""),xe(((fs=s.docker)==null?void 0:fs.containerName)||""),je(((ks=s.docker)==null?void 0:ks.ports)||[]),ve(((ys=s.docker)==null?void 0:ys.volumes)||[]),Ne((Cs=s.docker)!=null&&Cs.env?Object.entries(s.docker.env).map(([Y,He])=>`${Y}=${He}`).join(`

7`):""),ke(((Ss=s.docker)==null?void 0:Ss.network)||""),Ce(((ws=s.docker)==null?void 0:ws.command)||""),Se(((Ps=s.docker)==null?void 0:Ps.restart)||"unless-stopped"),we(((Ds=s.docker)==null?void 0:Ds.pull)||"missing"),De(((Es=s.docker)==null?void 0:Es.composePath)||""),ze(((zs=s.docker)==null?void 0:zs.composeProject)||""),Ae(((As=(Ls=s.docker)==null?void 0:Ls.services)==null?void 0:As.join(", "))||""),Te(s.subordinateBuildingIds||[]),Ie(((Bs=s.database)==null?void 0:Bs.connections)||[]),Oe((Ts=s.database)==null?void 0:Ts.activeConnectionId),_e(((Rs=s.terminal)==null?void 0:Rs.shell)||""),Fe((I ...

8`).map(f=>f.trim()).filter(f=>f&&f.includes("=")).map(f=>{const w=f.indexOf("=");return[f.slice(0,w),f.slice(w+1)]}))},Js=c=>{c.preventDefault();

Long lines were clipped for display.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView file

24* pdfjsBuild = ada343803 L25: */const e=!("object"!=typeof process||process+""!="[object process]"||process.versions.nw||process.versions.electron&&process.type&&"browser"!==process.type),t=[.001,0,0,.001,0,0],... L26: /*webpackIgnore: true*/

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView on unpkg · L24

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView on unpkg · L24

dist/src/packages/server/integrations/whatsapp/whatsapp-trigger-handler.jsView file

Lines 114-154javascript

114 client.close();

115 client = null;

116 }

117 dedupe.clear();

118 contactNames.clear();

119 groupNames.clear();

120 }

121 function

scripts/krunner/install-krunner-integration.shView file

•path = scripts/krunner/install-krunner-integration.sh kind = build_helper sizeBytes = 1784 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/krunner/install-krunner-integration.shView on unpkg

dist/assets/main-ChEsMqV1.jsView file

•path = dist/assets/main-ChEsMqV1.js kind = oversized_source_file sizeBytes = 2838638 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/main-ChEsMqV1.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/assets/index-v31fNaZP.jsView file

5patternName = private_key_openssh severity = critical line = 5 matchedText = NODE_ENV...in(`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/assets/index-v31fNaZP.jsView on unpkg · L5

5patternName = private_key_openssh severity = critical line = 5 matchedText = NODE_ENV...in(`

Critical

Secret Pattern

OpenSSH private key in dist/assets/index-v31fNaZP.js

dist/assets/index-v31fNaZP.jsView on unpkg · L5

dist/assets/pdf.worker.min-FHbmGBN0.mjsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView on unpkg · L24

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView on unpkg · L24

dist/src/packages/server/integrations/whatsapp/whatsapp-trigger-handler.jsView file

134direction: payload.direction, L135: body: payload.body, L136: messageType: payload.mediaType ?? 'text', ... L573: // Protocol-relative; pick scheme from baseUrl. L574: const scheme = baseUrl.startsWith('https://') ? 'https:' : 'http:'; L575: return scheme + url;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/packages/server/integrations/whatsapp/whatsapp-trigger-handler.jsView on unpkg · L134

scripts/krunner/install-krunner-integration.shView file

•path = scripts/krunner/install-krunner-integration.sh kind = build_helper sizeBytes = 1784 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/krunner/install-krunner-integration.shView on unpkg

dist/assets/main-ChEsMqV1.jsView file

•path = dist/assets/main-ChEsMqV1.js kind = oversized_source_file sizeBytes = 2838638 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/main-ChEsMqV1.jsView on unpkg

Findings

2 Critical1 High6 Medium7 Low

CriticalCritical Secretdist/assets/index-v31fNaZP.js

CriticalSecret Patterndist/assets/index-v31fNaZP.js

HighOversized Source Filedist/assets/main-ChEsMqV1.js

MediumDynamic Requiredist/assets/pdf.worker.min-FHbmGBN0.mjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Build Helperscripts/krunner/install-krunner-integration.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/assets/pdf.worker.min-FHbmGBN0.mjs

LowWeak Cryptodist/src/packages/server/integrations/whatsapp/whatsapp-trigger-handler.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/assets/index-v31fNaZP.jsView file

Lines 1-9javascript

2SERVER_PORT=7201

4DATABASE_URL=postgres://...

8`).map(f=>f.trim()).filter(f=>f&&f.includes("=")).map(f=>{const w=f.indexOf("=");return[f.slice(0,w),f.slice(w+1)]}))},Js=c=>{c.preventDefault();

Long lines were clipped for display.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView on unpkg · L24

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView on unpkg · L24

dist/src/packages/server/integrations/whatsapp/whatsapp-trigger-handler.jsView file

Lines 114-154javascript

114 client.close();

115 client = null;

116 }

117 dedupe.clear();

118 contactNames.clear();

119 groupNames.clear();

120 }

121 function

scripts/krunner/install-krunner-integration.shView file

•path = scripts/krunner/install-krunner-integration.sh kind = build_helper sizeBytes = 1784 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/krunner/install-krunner-integration.shView on unpkg

dist/assets/main-ChEsMqV1.jsView file

•path = dist/assets/main-ChEsMqV1.js kind = oversized_source_file sizeBytes = 2838638 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/main-ChEsMqV1.jsView on unpkg