registry / whalecap / 1.0.1

whalecap@1.0.1

Local DeepSeek proxy that paces spending to your monthly budget — works with opencode, Cline, Cursor, and any OpenAI-compatible tool

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 13 file(s), 75.2 KB of source, external domains: brew.sh, opencode.ai, tailscale.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-30javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6const server_1 = require("./proxy/server");

7const server_2 = require("./dashboard/server");

8const chalk_1 = __importDefault(require("chalk"));

9const ledger_1 = require("./db/ledger");

10const os_1 = require("os");

11const child_process_1 = require("child_process");

12function getLocalIp() {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L10

13 const nets = (0, os_1.networkInterfaces)();

14 for (const ifaces of Object.values(nets)) {

15 for (const iface of ifaces ?? []) {

16 if (iface.family === 'IPv4' && !iface.internal)

17 return iface.address;

18 }

19 }

20 return '127.0.0.1';

21}

22function getTailscaleIp() {

23 try {

24 const out = (0, child_process_1.execSync)('tailscale ip -4', { stdio: 'pipe' }).toString().trim();

25 const ip = out.split(/\s+/).find(v => /^\d+\.\d+\.\d+\.\d+$/.test(v));

26 return ip ?? null;

27 }

28 catch {

29 return null;

30 }

dist/installer/index.jsView file

Lines 199-239javascript

199 catch {

200 // Homebrew refuses to reinstall if the app already exists outside its own

201 // management (e.g. installed manually). Treat that as success, not failure.

202 if (opencodeDesktopInstalled()) {

203 console.log(chalk_1.default.dim(' App already present — continuing.\n'));

204 return true;

Source & flagged code

2 flagged · loading source

dist/index.jsView file

10const os_1 = require("os"); L11: const child_process_1 = require("child_process"); L12: function getLocalIp() {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L10

dist/installer/index.jsView file

219try { L220: (0, child_process_1.execSync)('npm install -g opencode-ai', { stdio: 'inherit' }); L221: return true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/installer/index.jsView on unpkg · L219

Findings

2 High3 Medium6 Low

HighChild Processdist/index.js

HighRuntime Package Installdist/installer/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-30javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6const server_1 = require("./proxy/server");

7const server_2 = require("./dashboard/server");

8const chalk_1 = __importDefault(require("chalk"));

9const ledger_1 = require("./db/ledger");

10const os_1 = require("os");

11const child_process_1 = require("child_process");

12function getLocalIp() {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L10

13 const nets = (0, os_1.networkInterfaces)();

14 for (const ifaces of Object.values(nets)) {

15 for (const iface of ifaces ?? []) {

16 if (iface.family === 'IPv4' && !iface.internal)

17 return iface.address;

18 }

19 }

20 return '127.0.0.1';

21}

22function getTailscaleIp() {

23 try {

24 const out = (0, child_process_1.execSync)('tailscale ip -4', { stdio: 'pipe' }).toString().trim();

25 const ip = out.split(/\s+/).find(v => /^\d+\.\d+\.\d+\.\d+$/.test(v));

26 return ip ?? null;

27 }

28 catch {

29 return null;

30 }

dist/installer/index.jsView file

Lines 199-239javascript

199 catch {

200 // Homebrew refuses to reinstall if the app already exists outside its own

201 // management (e.g. installed manually). Treat that as success, not failure.

202 if (opencodeDesktopInstalled()) {

203 console.log(chalk_1.default.dim(' App already present — continuing.\n'));

204 return true;