registry  /  whipped  /  0.9.4

whipped@0.9.4

Autonomous AI agent kanban board for Claude, Codex, Opencode, and Cursor.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsObfuscatedTelemetryUrlStrings
Manifest
NoLicense
scanned 66 file(s), 7.89 MB of source, external domains: 127.0.0.1, api.github.com, api.slack.com, app.example.com, chevrotain.io, developers.cloudflare.com, docs.github.com, en.wikibooks.org, en.wikipedia.org, fetch.spec.whatwg.org, github.com, jquery.org, langium.org, reactjs.org, registry.npmjs.org, slack.com, tex.stackexchange.com, tldrlegal.com, uploads.github.com, www.w3.org
Oversized source lightweight scan
dist/web-ui/assets/index-BdxxeyIM.js2.98 MB file, sampled 256 KB
NetworkHighEntropyStringsUrlStringsapi.slack.comapp.example.comdevelopers.cloudflare.comreactjs.orgwww.w3.org

Source & flagged code

7 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/cli.jsView file
1206var EventEmitter = __require("node:events").EventEmitter; L1207: var childProcess4 = __require("node:child_process"); L1208: var path2 = __require("node:path");
High
Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L1206
2059} L2060: const execArgv = process16.execArgv ?? []; L2061: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
High
Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L2059
13542}); L13543: const args = [...passThroughExecArgv, process.argv[1], "__daemon-run", "--port", String(port), "--host", host]; L13544: const child = spawn(process.execPath, args, { ... L13546: stdio: ["ignore", out, err], L13547: env: { ...process.env } L13548: }); ... L13553: } L13554: const url = `http://${host}:${port}`; L13555: const ready = await waitForPort(host, port, 1e4);
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L13542
dist/web-ui/assets/geist-mono-vietnamese-wght-normal-D8KDMBhC.woff2View file
•path = dist/web-ui/assets/geist-mono-vietnamese-wght-normal-D8KDMBhC.woff2 kind = high_entropy_blob sizeBytes = 7716 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web-ui/assets/geist-mono-vietnamese-wght-normal-D8KDMBhC.woff2View on unpkg
dist/web-ui/assets/index-BdxxeyIM.jsView file
•path = dist/web-ui/assets/index-BdxxeyIM.js kind = oversized_source_file sizeBytes = 3122329 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/web-ui/assets/index-BdxxeyIM.jsView on unpkg

Findings

6 High4 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/cli.js
HighShelldist/cli.js
HighSame File Env Network Executiondist/cli.js
HighShips High Entropy Blobdist/web-ui/assets/geist-mono-vietnamese-wght-normal-D8KDMBhC.woff2
HighOversized Source Filedist/web-ui/assets/index-BdxxeyIM.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License