registry / tide-commander / 1.149.0

tide-commander@1.149.0

Visual multi-agent orchestrator and manager for Claude Code with 3D/2D interface

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 365 file(s), 7.36 MB of source, external domains: 127.0.0.1, admin.google.com, api.anthropic.com, api.bitbucket.org, api.github.com, bitbucket.org, claude.ai, commander.local, console.cloud.google.com, example.com, github.com, id.atlassian.com, kenney.nl, kroki.io, ns.adobe.com, raw.githubusercontent.com, react.dev, registry.npmjs.org, wiki.example.com, www.googleapis.com, www.gstatic.com, www.w3.org, www.xfa.org, yourcompany.atlassian.net

Oversized source lightweight scan

dist/assets/main-B0UlZnfk.js2.81 MB file, sampled 256 KB

NetworkHighEntropyStringsMinifiedUrlStringsgithub.comraw.githubusercontent.comreact.dev

Source & flagged code

8 flagged

dist/assets/index-C6Kf4ewu.jsView file

Lines 1-9javascript

1import{bM as ta,u as A,j as e,bb as j,bS as Ms,bT as Fs,bc as X,s as D,bU as $s,r as m,D as Q,I as F,ag as Us,bm as qe,m as na,bn as la,l as ia,bV as oa,_ as ra,S as ca,n as da,af as Ks,bo as Ue}from"./main-B0UlZnfk.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";const ma=[{value:"",labelKey:"terminal:building.colorDefault"},{value:"#2a2a3a",labelKey:"terminal:building.colorDarkGray"},{value:"#3a2a2a",labelKey:"terminal:building.colorDarkRed"},{value:"#2a3a2a",labelKey:"terminal:building.colorDarkGreen"},{value:"#2a2a4a",labelKey:"terminal:building.colorDarkBlue"},{va ...

2SERVER_PORT=7201

3NODE_ENV=production`,rows:3})]}),e.jsx("div",{className:"pm2-examples",children:e.jsxs("details",{children:[e.jsx("summary",{children:i("terminal:building.pm2Examples")}),e.jsxs("div",{className:"pm2-examples-content",children:[e.jsxs("div",{className:"pm2-example",children:[e.jsx("strong",{children:"Node.js:"})," Script: ",e.jsx("code",{children:"npm"}),", Args: ",e.jsx("code",{children:"run dev"})]}),e.jsxs("div",{className:"pm2-example",children:[e.jsx("strong",{children:"Symfony:"})," Script: ",e.jsx("code",{children:"symfony"}),", Args: ",e.jsx("code",{children:"serve --no-daemon"}),", In ...

4DATABASE_URL=postgres://...

5NODE_ENV=production`,rows:3})]})]}),V&&(k==null?void 0:k.dockerStatus)&&e.jsxs("div",{className:"docker-status-display",children:[e.jsxs("div",{className:"docker-status-row",children:[e.jsxs("span",{className:"docker-metric",children:[e.jsx("span",{className:"docker-metric-label",children:"ID"}),e.jsx("span",{className:"docker-metric-value",children:k.dockerStatus.containerId

6`):""),de(((js=s.docker)==null?void 0:js.mode)||"container"),ue(((gs=s.docker)==null?void 0:gs.mode)==="existing"&&((vs=s.docker)==null?void 0:vs.containerName)||""),pe(((fs=s.docker)==null?void 0:fs.image)||""),xe(((Ns=s.docker)==null?void 0:Ns.containerName)||""),je(((ks=s.docker)==null?void 0:ks.ports)||[]),ve(((ys=s.docker)==null?void 0:ys.volumes)||[]),fe((Cs=s.docker)!=null&&Cs.env?Object.entries(s.docker.env).map(([Y,He])=>`${Y}=${He}`).join(`

7`):""),ke(((Ss=s.docker)==null?void 0:Ss.network)||""),Ce(((ws=s.docker)==null?void 0:ws.command)||""),Se(((Ps=s.docker)==null?void 0:Ps.restart)||"unless-stopped"),we(((Ds=s.docker)==null?void 0:Ds.pull)||"missing"),De(((Es=s.docker)==null?void 0:Es.composePath)||""),Le(((Ls=s.docker)==null?void 0:Ls.composeProject)||""),Be(((Bs=(zs=s.docker)==null?void 0:zs.services)==null?void 0:Bs.join(", "))||""),Te(s.subordinateBuildingIds||[]),Ie(((As=s.database)==null?void 0:As.connections)||[]),Oe((Ts=s.database)==null?void 0:Ts.activeConnectionId),_e(((Rs=s.terminal)==null?void 0:Rs.shell)||""),Fe((I ...

8`).map(N=>N.trim()).filter(N=>N&&N.includes("=")).map(N=>{const w=N.indexOf("=");return[N.slice(0,w),N.slice(w+1)]}))},Ws

Long lines were clipped for display.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView file

24* pdfjsBuild = ada343803 L25: */const e=!("object"!=typeof process||process+""!="[object process]"||process.versions.nw||process.versions.electron&&process.type&&"browser"!==process.type),t=[.001,0,0,.001,0,0],... L26: /*webpackIgnore: true*/

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView on unpkg · L24

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView on unpkg · L24

dist/src/packages/server/integrations/whatsapp/whatsapp-trigger-handler.jsView file

Lines 114-154javascript

114 client.close();

115 client = null;

116 }

117 dedupe.clear();

118 contactNames.clear();

119 groupNames.clear();

120 }

121 function

scripts/krunner/install-krunner-integration.shView file

•path = scripts/krunner/install-krunner-integration.sh kind = build_helper sizeBytes = 1784 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/krunner/install-krunner-integration.shView on unpkg

dist/assets/main-B0UlZnfk.jsView file

•path = dist/assets/main-B0UlZnfk.js kind = oversized_source_file sizeBytes = 2949490 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/main-B0UlZnfk.jsView on unpkg

dist/src/packages/server/data/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = tide-commander@1.148.0 matchedIdentity = npm:dGlkZS1jb21tYW5kZXI:1.148.0 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/packages/server/data/index.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/assets/index-C6Kf4ewu.jsView file

5patternName = private_key_openssh severity = critical line = 5 matchedText = NODE_ENV...in(`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/assets/index-C6Kf4ewu.jsView on unpkg · L5

5patternName = private_key_openssh severity = critical line = 5 matchedText = NODE_ENV...in(`

Critical

Secret Pattern

OpenSSH private key in dist/assets/index-C6Kf4ewu.js

dist/assets/index-C6Kf4ewu.jsView on unpkg · L5

dist/assets/pdf.worker.min-FHbmGBN0.mjsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView on unpkg · L24

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView on unpkg · L24

dist/src/packages/server/integrations/whatsapp/whatsapp-trigger-handler.jsView file

134direction: payload.direction, L135: body: payload.body, L136: messageType: payload.mediaType ?? 'text', ... L573: // Protocol-relative; pick scheme from baseUrl. L574: const scheme = baseUrl.startsWith('https://') ? 'https:' : 'http:'; L575: return scheme + url;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/packages/server/integrations/whatsapp/whatsapp-trigger-handler.jsView on unpkg · L134

scripts/krunner/install-krunner-integration.shView file

•path = scripts/krunner/install-krunner-integration.sh kind = build_helper sizeBytes = 1784 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/krunner/install-krunner-integration.shView on unpkg

dist/assets/main-B0UlZnfk.jsView file

•path = dist/assets/main-B0UlZnfk.js kind = oversized_source_file sizeBytes = 2949490 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/main-B0UlZnfk.jsView on unpkg

dist/src/packages/server/data/index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/packages/server/data/index.jsView on unpkg

Findings

2 Critical2 High6 Medium7 Low

CriticalCritical Secretdist/assets/index-C6Kf4ewu.js

CriticalSecret Patterndist/assets/index-C6Kf4ewu.js

HighOversized Source Filedist/assets/main-B0UlZnfk.js

HighPrevious Version Dangerous Deltadist/src/packages/server/data/index.js

MediumDynamic Requiredist/assets/pdf.worker.min-FHbmGBN0.mjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Build Helperscripts/krunner/install-krunner-integration.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/assets/pdf.worker.min-FHbmGBN0.mjs

LowWeak Cryptodist/src/packages/server/integrations/whatsapp/whatsapp-trigger-handler.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

dist/assets/index-C6Kf4ewu.jsView file

Lines 1-9javascript

2SERVER_PORT=7201

4DATABASE_URL=postgres://...

8`).map(N=>N.trim()).filter(N=>N&&N.includes("=")).map(N=>{const w=N.indexOf("=");return[N.slice(0,w),N.slice(w+1)]}))},Ws

Long lines were clipped for display.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView on unpkg · L24

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/pdf.worker.min-FHbmGBN0.mjsView on unpkg · L24

dist/src/packages/server/integrations/whatsapp/whatsapp-trigger-handler.jsView file

Lines 114-154javascript

114 client.close();

115 client = null;

116 }

117 dedupe.clear();

118 contactNames.clear();

119 groupNames.clear();

120 }

121 function

scripts/krunner/install-krunner-integration.shView file

•path = scripts/krunner/install-krunner-integration.sh kind = build_helper sizeBytes = 1784 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/krunner/install-krunner-integration.shView on unpkg

dist/assets/main-B0UlZnfk.jsView file

•path = dist/assets/main-B0UlZnfk.js kind = oversized_source_file sizeBytes = 2949490 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/main-B0UlZnfk.jsView on unpkg

dist/src/packages/server/data/index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/packages/server/data/index.jsView on unpkg