registry / tower-studio / 0.2.45

tower-studio@0.2.45

AI Task Orchestration Platform — Kanban + Terminal + Code Editor + MCP

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 19 file(s), 317 KB of source, external domains: github.com

Oversized source lightweight scan

dist/mcp-server.cjs2.27 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsWebSocketHighEntropyStrings

Source & flagged code

6 flagged

package.jsonView file

Lines 35-75json

35 "release": "pnpm build && npm pack",

36 "release:smoke": "node scripts/release-smoke.js",

37 "release:publish": "pnpm build && npm publish",

38 "release:ship": "bash scripts/release.sh",

39 "start": "node bin/tower.mjs",

40 "lint": "eslint",

41 "db:generate": "prisma generate",

42 "db:push": "DATABASE_URL=\"file:$HOME/.tower-dev/database/tower.db\" prisma db push",

43 "db:seed": "DATABASE_URL=\"file:$HOME/.tower-dev/database/tower.db\" tsx prisma/seed.ts",

44 "db:studio": "DATABASE_URL=\"file:$HOME/.tower-dev/database/tower.db\" prisma studio",

45 "db:init": "TOWER_DATA_DIR=\"$HOME/.tower-dev\" DATABASE_URL=\"file:$HOME/.tower-dev/database/tower.db\" tsx scripts/init-db.ts",

46 "db:init-fts": "DATABASE_URL=\"file:$HOME/.tower-dev/database/tower.db\" tsx prisma/init-fts.ts",

47 "db:migrate": "TOWER_DATA_DIR=\"$HOME/.tower-dev\" DATABASE_URL=\"file:$HOME/.tower-dev/database/tower.db\" tsx scripts/run-migrations.ts",

48 "test": "vitest",

49 "test:run": "vitest run",

50 "test:e2e": "NO_PROXY=localhost,127.0.0.1 no_proxy=localhost,127.0.0.1 playwright test",

51 "changelog": "conventional-changelog -p angular -i CHANGELOG.md -s",

52 "mcp": "node dist/mcp-server.cjs",

53 "mcp:build": "esbuild src/mcp/index.ts --bundle --platform=node --target=node18 --format=cjs --outfile=dist/mcp-server.cjs --external:@prisma/client --external:@modelcontextprotocol/sdk --external:@opentelemetry/api --alias:@=./src",

54 "mcp:dev": "tsx src/mcp/index.ts",

55 "postinstall": "node scripts/generate-prisma-client.js && node scripts/link-prisma.js && node scripts/fix-native-permissions.js && node scripts/post-install-banner.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L55

56 },

57 "pnpm": {

58 "onlyBuiltDependencies": [

59 "@prisma/engines",

60 "esbuild",

61 "node-pty",

62 "prisma"

63 ]

64 },

65 "dependencies": {

66 "@modelcontextprotocol/sdk": "^1.28.0",

67 "@prisma/client": "^6.19.2",

68 "@vscode/ripgrep": "1.18.0",

69 "node-pty": "^1.1.0",

70 "prisma": "^6.19.2",

71 "tinykeys": "^4.0.0",

72 "tsx": "^4.21.0",

73 "ws": "^8.20.0"

74 },

75 "devDependencies": {

bin/tower.mjsView file

Lines 9-49javascript

9 * tower --help Show help

10 * tower --version Show version

11 *

12 * Options:

13 * -p, --port <port> Server port (default: 3000)

.next/standalone/.next/server/app/apple-icon.png.bodyView file

•path = .next/standalone/.next/server/app/apple-icon.png.body kind = high_entropy_blob sizeBytes = 61019 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/standalone/.next/server/app/apple-icon.png.bodyView on unpkg

•path = .next/standalone/.next/server/app/apple-icon.png.body kind = payload_in_excluded_dir sizeBytes = 61019 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/standalone/.next/server/app/apple-icon.png.bodyView on unpkg

dist/mcp-server.cjsView file

•path = dist/mcp-server.cjs kind = oversized_source_file sizeBytes = 2375181 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/mcp-server.cjsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/generate-prisma-client.js && node scripts/link-prisma.js && node scripts/fix-native-permissions.js && node scripts/post-install-banner.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/generate-prisma-client.js && node scripts/link-prisma.js && node scripts/fix-native-permissions.js && node scripts/post-install-banner.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/tower.mjsView file

29const PROJECT_ROOT = resolve(__dirname, ".."); L30: const require = createRequire(import.meta.url); L31:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tower.mjsView on unpkg · L29

.next/standalone/.next/server/app/apple-icon.png.bodyView file

•path = .next/standalone/.next/server/app/apple-icon.png.body kind = high_entropy_blob sizeBytes = 61019 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/standalone/.next/server/app/apple-icon.png.bodyView on unpkg

•path = .next/standalone/.next/server/app/apple-icon.png.body kind = payload_in_excluded_dir sizeBytes = 61019 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/standalone/.next/server/app/apple-icon.png.bodyView on unpkg

dist/mcp-server.cjsView file

•path = dist/mcp-server.cjs kind = oversized_source_file sizeBytes = 2375181 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/mcp-server.cjsView on unpkg

Findings

4 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blob.next/standalone/.next/server/app/apple-icon.png.body

HighPayload In Excluded Dir.next/standalone/.next/server/app/apple-icon.png.body

HighOversized Source Filedist/mcp-server.cjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/tower.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

package.jsonView file

Lines 35-75json

35 "release": "pnpm build && npm pack",

36 "release:smoke": "node scripts/release-smoke.js",

37 "release:publish": "pnpm build && npm publish",

38 "release:ship": "bash scripts/release.sh",

39 "start": "node bin/tower.mjs",

40 "lint": "eslint",

41 "db:generate": "prisma generate",

42 "db:push": "DATABASE_URL=\"file:$HOME/.tower-dev/database/tower.db\" prisma db push",

43 "db:seed": "DATABASE_URL=\"file:$HOME/.tower-dev/database/tower.db\" tsx prisma/seed.ts",

44 "db:studio": "DATABASE_URL=\"file:$HOME/.tower-dev/database/tower.db\" prisma studio",

45 "db:init": "TOWER_DATA_DIR=\"$HOME/.tower-dev\" DATABASE_URL=\"file:$HOME/.tower-dev/database/tower.db\" tsx scripts/init-db.ts",

46 "db:init-fts": "DATABASE_URL=\"file:$HOME/.tower-dev/database/tower.db\" tsx prisma/init-fts.ts",

47 "db:migrate": "TOWER_DATA_DIR=\"$HOME/.tower-dev\" DATABASE_URL=\"file:$HOME/.tower-dev/database/tower.db\" tsx scripts/run-migrations.ts",

48 "test": "vitest",

49 "test:run": "vitest run",

50 "test:e2e": "NO_PROXY=localhost,127.0.0.1 no_proxy=localhost,127.0.0.1 playwright test",

51 "changelog": "conventional-changelog -p angular -i CHANGELOG.md -s",

52 "mcp": "node dist/mcp-server.cjs",

54 "mcp:dev": "tsx src/mcp/index.ts",

55 "postinstall": "node scripts/generate-prisma-client.js && node scripts/link-prisma.js && node scripts/fix-native-permissions.js && node scripts/post-install-banner.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L55

56 },

57 "pnpm": {

58 "onlyBuiltDependencies": [

59 "@prisma/engines",

60 "esbuild",

61 "node-pty",

62 "prisma"

63 ]

64 },

65 "dependencies": {

66 "@modelcontextprotocol/sdk": "^1.28.0",

67 "@prisma/client": "^6.19.2",

68 "@vscode/ripgrep": "1.18.0",

69 "node-pty": "^1.1.0",

70 "prisma": "^6.19.2",

71 "tinykeys": "^4.0.0",

72 "tsx": "^4.21.0",

73 "ws": "^8.20.0"

74 },

75 "devDependencies": {

bin/tower.mjsView file

Lines 9-49javascript

9 * tower --help Show help

10 * tower --version Show version

11 *

12 * Options:

13 * -p, --port <port> Server port (default: 3000)

.next/standalone/.next/server/app/apple-icon.png.bodyView file

•path = .next/standalone/.next/server/app/apple-icon.png.body kind = high_entropy_blob sizeBytes = 61019 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/standalone/.next/server/app/apple-icon.png.bodyView on unpkg

•path = .next/standalone/.next/server/app/apple-icon.png.body kind = payload_in_excluded_dir sizeBytes = 61019 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/standalone/.next/server/app/apple-icon.png.bodyView on unpkg

dist/mcp-server.cjsView file

•path = dist/mcp-server.cjs kind = oversized_source_file sizeBytes = 2375181 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/mcp-server.cjsView on unpkg