registry / unbrowse / 12.2.0

unbrowse@12.2.0

Call websites as APIs: a thin CLI over the Unbrowse API.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 82.9 KB of source, external domains: 127.0.0.1, unbrowse.ai, www.apple.com

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 956-996javascript

956 }

957 if (cur.trim())

958 parts.push(cur);

959 for (const part of parts) {

960 const t = part.trim();

961 if (/^(primary|unique|foreign|check|constraint)\b/i.test(t))

962 continue;

963 const m = /^["`[]?([A-Za-z_][\w]*)["`\]]?\s*(.*)$/.exec(t);

964 if (!m)

965 continue;

966 names.push(m[1]);

967 types.push(m[2] ?? "");

968 }

969 const out = names;

970 out.types = types;

971 return out;

972}

973var HEADER = 100;

974

975// src/cookies.ts

976import { createDecipheriv, createHash as createHash3, pbkdf2Sync } from "node:crypto";

977import { execFileSync } from "node:child_process";

978import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync3 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L976

979import { homedir as homedir3, platform as platform2 } from "node:os";

980import { join as join3 } from "node:path";

981function chromium(name, [mac, linux], keychain) {

982 return {

983 name,

984 engine: "chromium",

985 keychain: `${keychain} Safe Storage`,

986 dirs: (h) => ({

987 darwin: [join3(h, "Library/Application Support", mac)],

988 linux: [join3(h, ".config", linux), join3(h, ".var/app", flatpakId(name), "config", linux)],

989 win32: [join3(process.env.LOCALAPPDATA ?? join3(h, "AppData/Local"), mac.replace(/\//g, "\\"), "User Data")]

990 })

991 };

992}

993function firefox(name, [mac, linux, linuxHome]) {

994 return {

995 name,

996 engine: "firefox",

Lines 1250-1290javascript

1250 return null;

1251}

1252var home = () => process.env.UNBROWSE_COOKIES_HOME ?? homedir3(), OS, BROWSERS, TEXT;

1253var init_cookies

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: baseUrl; this.baseUrl = apiBase(opts.baseUrl ?? env("UNBROWSE_BASE_URL") ?? DEFAULT_BASE_URL); const res = await this.fetchImpl(`${this.baseUrl}${path}`, { ...this.apiKey ? { authorization: `Bearer ${this.apiKey}` } : {}, return `${this.baseUrl}/sites/${normalizeHost(host)}/mcp`; ...this.apiKey ? { authorization: `Bearer ${this.apiKey}` } : {}, import { createInterface } from "node:readline"; import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/cli.jsView file

976import { createDecipheriv, createHash as createHash3, pbkdf2Sync } from "node:crypto"; L977: import { execFileSync } from "node:child_process"; L978: import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync3 } from "node:fs";

unbrowse@12.2.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code