registry / unbrowse / 12.1.0

unbrowse@12.1.0

⚠ Under review

Call websites as APIs: a thin CLI over the Unbrowse API.

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 27.4 KB of source, external domains: 127.0.0.1, unbrowse.ai

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 326-366javascript

326 continue;

327 let msg;

328 try {

329 msg = JSON.parse(line);

330 } catch {

331 pending.add(write({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "Parse error" } }));

332 continue;

333 }

334 const p = handle(msg).then((res) => res ? write(res) : undefined);

335 pending.add(p);

336 p.finally(() => pending.delete(p));

337 }

338 await Promise.all(pending);

339}

340var PROTOCOLS;

341var init_mcp_proxy = __esm(() => {

342 init_src();

343 PROTOCOLS = ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];

344});

345

346// src/cli.ts

347import { spawn } from "node:child_process";

348import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L346

349import { readFileSync as readFileSync2 } from "node:fs";

350

351// src/auth.ts

352import { createHash, randomBytes } from "node:crypto";

353import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";

354import { createServer } from "node:http";

355import { homedir } from "node:os";

356import { dirname, join } from "node:path";

357function configPath() {

358 const root = process.env.UNBROWSE_CONFIG_DIR ?? join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "unbrowse");

359 return join(root, "cli.json");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L346

360}

361function load() {

362 const path = configPath();

363 if (!existsSync(path))

364 return {};

365 try {

366 return JSON.parse(readFileSync(path, "utf8"));

dist/cli.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.js#virtual:string-array:round1View on unpkg

Source & flagged code

3 flagged · loading source

dist/cli.jsView file

346// src/cli.ts L347: import { spawn } from "node:child_process"; L348: import { randomUUID } from "node:crypto";

unbrowse@12.1.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code