registry / typephone / 0.1.2

typephone@0.1.2

Typephone — turn your Mac into a BLE HID keyboard for iPhone/iPad

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 13 file(s), 67.6 KB of source, external domains: www.apple.com

Source & flagged code

5 flagged

package.jsonView file

Lines 39-79json

39 "node": ">=20"

40 },

41 "os": [

42 "darwin"

43 ],

44 "cpu": [

45 "arm64"

46 ],

47 "scripts": {

48 "version:stamp": "node scripts/version.js stamp",

49 "version:bump-build": "node scripts/version.js bump-build",

50 "version:release": "node scripts/version.js release",

51 "version:print": "node scripts/version.js print",

52 "predev": "node scripts/version.js stamp",

53 "prestart": "node scripts/version.js stamp",

54 "predist:dir": "node scripts/version.js stamp",

55 "build:native": "xcodegen generate && xcodebuild -project MacInput.xcodeproj -scheme MacInput -configuration Debug -sdk macosx -derivedDataPath /tmp/MacInputDerived CODE_SIGNING_ALLOWED=NO build",

56 "build:native:release": "xcodegen generate && xcodebuild -project MacInput.xcodeproj -scheme MacInput -configuration Release -sdk macosx -derivedDataPath build/native CODE_SIGNING_ALLOWED=NO build",

57 "test:native": "xcodegen generate && xcodebuild -project MacInput.xcodeproj -scheme MacInputTests -configuration Debug -sdk macosx -derivedDataPath /tmp/MacInputDerived CODE_SIGNING_ALLOWED=NO test",

58 "check:js": "node --check electron/main.js && node --check electron/preload.js && node --check electron/renderer/app.js && node --check electron/shared/i18n.js && node --check electron/shared/connection-state.js && node --check electron/shared/control-protocol.js && node --check electron/shared/version.js && node --check scripts/version.js && node --check bin/typephone.js && node --check bin/install-macos-app.js && node --check bin/macos-codesign.js && node --check scripts/prepare-npm-package.js && node --test TestsJS/*.test.js",

59 "postinstall": "node bin/install-macos-app.js install",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L59

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L59

60 "start:native": "open /tmp/MacInputDerived/Build/Products/Debug/MacInput.app",

61 "start": "electron electron/main.js",

62 "dev": "npm run build:native && electron electron/main.js",

63 "dist:dir": "npm run build:native:release && CSC_IDENTITY_AUTO_DISCOVERY=false electron-builder --mac dir",

64 "prepare:npm": "node scripts/prepare-npm-package.js",

65 "prepublishOnly": "npm run prepare:npm && npm run check:js",

66 "publish:npm": "npm publish --access public"

67 },

68 "dependencies": {

69 "electron": "^43.1.1"

70 },

71 "devDependencies": {

72 "electron-builder": "^26.0.12",

73 "heroicons": "^2.2.0"

74 },

75 "build": {

76 "appId": "com.viczhang.typephone.electron",

77 "productName": "Typephone",

78 "buildVersion": "3",

79 "files": [

bin/macos-codesign.jsView file

Lines 1-27javascript

1'use strict';

3/**

4 * macOS helpers for npm-installed Typephone.

5 * Launch Services kills unsigned helper binaries spawned from GUI-launched apps;

6 * ad-hoc codesign + clearing quarantine attributes avoids that.

7 */

8const { execFileSync } = require('node:child_process');

vendor/MacInput.app/Contents/MacOS/MacInputView file

•path = vendor/MacInput.app/Contents/MacOS/MacInput kind = native_binary sizeBytes = 898880 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/MacInput.app/Contents/MacOS/MacInputView on unpkg

electron/assets/app-icon.icnsView file

•path = electron/assets/app-icon.icns kind = high_entropy_blob sizeBytes = 767051 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

electron/assets/app-icon.icnsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/install-macos-app.js install

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code