registry / wuphf / 0.235.0

wuphf@0.235.0

Slack for AI employees with a shared brain. A collaborative office where AI employees run your work 24x7.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

Manifest

NoLicense

scanned 5 file(s), 31.7 KB of source, external domains: github.com, registry.npmjs.org

Source & flagged code

5 flagged

package.jsonView file

Lines 1-39json

2 "name": "wuphf",

3 "version": "0.235.0",

4 "description": "Slack for AI employees with a shared brain. A collaborative office where AI employees run your work 24x7.",

5 "bin": {

6 "wuphf": "bin/wuphf.js"

7 },

8 "files": [

9 "bin/wuphf.js",

10 "scripts/cloudflared.json",

11 "scripts/download-binary.js",

12 "scripts/download-cloudflared.js",

13 "scripts/postinstall.js",

14 "scripts/version-check.js",

15 "README.md",

16 "LICENSE"

17 ],

18 "scripts": {

19 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L19

20 "test": "bun test"

21 },

22 "engines": {

23 "node": ">=18"

24 },

25 "os": [

26 "darwin",

27 "linux",

28 "win32"

29 ],

30 "cpu": [

31 "x64",

32 "arm64"

33 ],

34 "repository": {

35 "type": "git",

36 "url": "git+https://github.com/nex-crm/wuphf.git"

37 },

38 "homepage": "https://wuphf.team",

39 "bugs": {

bin/wuphf.jsView file

Lines 7-47javascript

7//

8// 1. Lazy download if postinstall was skipped (common with

9// `npm install --ignore-scripts` and with some `npx` cache behaviors).

10//

11// 2. Self-heal when npm's published `latest` has moved past the installed

12// version. `npm install -g` does NOT auto-upgrade, so a user who

13// installed weeks ago runs their old binary forever without this

14// check. We consult the npm registry (24h cache), and if a newer

15// release exists, we transparently serve it from an out-of-tree

16// version-keyed cache. The cached binary is verified against the

17// release's checksums.txt via the same path postinstall uses — there

scripts/version-check.jsView file

Lines 6-46javascript

6// Why this exists: `npm install -g wuphf` does not auto-upgrade. A user who

7// installed weeks ago runs their old binary forever unless they manually

8// re-install. The shim in bin/wuphf.js uses this to transparently serve the

9// *latest* release from a verified cache while pointing the user at a real

10// fix (`npm install -g wuphf@latest`). See bin/wuphf.js for how the result

11// feeds into ensureBinary().

12//

13// Contract:

14// - getLatestVersion() returns a semver string or null. null means

15// "couldn't check" and the caller MUST fall back to the installed

16// version. Network errors, malformed responses, and fetch timeouts all

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/wuphf.jsView file

27const os = require("node:os"); L28: const { spawn } = require("node:child_process"); L29: const { downloadBinary, packageVersion } = require("../scripts/download-binary");

High

Child Process

Package source references child process execution.

bin/wuphf.jsView on unpkg · L27

82`wuphf: running installed v${installedVersion}. ` + L83: `Run \`npm install -g wuphf@latest\` to upgrade.\n`, L84: ); ... L97: function run(resolvedPath) { L98: const child = spawn(resolvedPath, process.argv.slice(2), { L99: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/wuphf.jsView on unpkg · L82

scripts/version-check.jsView file

26const os = require("node:os"); L27: const { execFile } = require("node:child_process"); L28: L29: const REGISTRY_URL = "https://registry.npmjs.org/wuphf/latest"; L30: // Generous enough to survive a cold TLS handshake on a slow network but ... L51: // separate caches from prod. L52: const runtimeHome = process.env.WUPHF_RUNTIME_HOME?.trim() || os.homedir(); L53: return path.join(runtimeHome, ".wuphf", "cache"); ... L60: async function markCacheDirExcludedFromBackup(dir = cacheDir()) { L61: if (process.platform !== "darwin") return; L62: const candidates = new Set([dir]); ... L88: const raw = await fsp.readFile(latestVersionCachePath(), "utf8");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/version-check.jsView on unpkg · L26

Findings

4 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/wuphf.js

HighSandbox Evasion Gated Capabilityscripts/version-check.js

HighRuntime Package Installbin/wuphf.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

package.jsonView file

Lines 1-39json

2 "name": "wuphf",

3 "version": "0.235.0",

4 "description": "Slack for AI employees with a shared brain. A collaborative office where AI employees run your work 24x7.",

5 "bin": {

6 "wuphf": "bin/wuphf.js"

7 },

8 "files": [

9 "bin/wuphf.js",

10 "scripts/cloudflared.json",

11 "scripts/download-binary.js",

12 "scripts/download-cloudflared.js",

13 "scripts/postinstall.js",

14 "scripts/version-check.js",

15 "README.md",

16 "LICENSE"

17 ],

18 "scripts": {

19 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L19

20 "test": "bun test"

21 },

22 "engines": {

23 "node": ">=18"

24 },

25 "os": [

26 "darwin",

27 "linux",

28 "win32"

29 ],

30 "cpu": [

31 "x64",

32 "arm64"

33 ],

34 "repository": {

35 "type": "git",

36 "url": "git+https://github.com/nex-crm/wuphf.git"

37 },

38 "homepage": "https://wuphf.team",

39 "bugs": {

bin/wuphf.jsView file

Lines 7-47javascript

7//

8// 1. Lazy download if postinstall was skipped (common with

9// `npm install --ignore-scripts` and with some `npx` cache behaviors).

10//

11// 2. Self-heal when npm's published `latest` has moved past the installed

12// version. `npm install -g` does NOT auto-upgrade, so a user who

13// installed weeks ago runs their old binary forever without this

14// check. We consult the npm registry (24h cache), and if a newer

15// release exists, we transparently serve it from an out-of-tree

16// version-keyed cache. The cached binary is verified against the

17// release's checksums.txt via the same path postinstall uses — there

scripts/version-check.jsView file

Lines 6-46javascript

6// Why this exists: `npm install -g wuphf` does not auto-upgrade. A user who

7// installed weeks ago runs their old binary forever unless they manually

8// re-install. The shim in bin/wuphf.js uses this to transparently serve the

9// *latest* release from a verified cache while pointing the user at a real

10// fix (`npm install -g wuphf@latest`). See bin/wuphf.js for how the result

11// feeds into ensureBinary().

12//

13// Contract:

14// - getLatestVersion() returns a semver string or null. null means

15// "couldn't check" and the caller MUST fall back to the installed

16// version. Network errors, malformed responses, and fetch timeouts all

Lines 62-102javascript

62 const latestVersion = await getLatestVersion();

63 if (!latestVersion) return installed;

64 if (compareVersions(latestVersion, installedVersion) <= 0) return installed;

66 // npm has a newer release than what's installed. Serve the cached newer

67 // binary, downloading it once if absent. Integrity-verified via the same

68 // checksums.txt path as postinstall — a failure anywhere in that chain

69 // falls back to the installed binary rather than running something

70 // unverified or crashing the command.

71 const cachedPath = cachedBinaryPath(latestVersion);

72 if (!fs.existsSync(cachedPath)) {

73 try {

74 await ensureCacheDir();

75 await downloadBinary({

76 version: latestVersion,

77 targetPath: cachedPath,

78 });

79 } catch (err) {

80 process.stderr.write(

81 `wuphf: self-heal download of v${latestVersion} failed: ${err.message}\n` +

82 `wuphf: running installed v${installedVersion}. ` +

83 `Run \`npm install -g wuphf@latest\` to upgrade.\n`,

84 );

85 return installed;

86 }

87 }

89 process.stderr.write(

90 `wuphf: serving cached v${latestVersion} (installed is v${installedVersion}). ` +

91 `Run \`npm install -g wuphf@latest\` to upgrade permanently, ` +

92 `or set WUPHF_SKIP_VERSION_CHECK=1 to disable this check.\n`,

93 );

94 return cachedPath;

95}

97function run(resolvedPath) {

98 const child = spawn(resolvedPath, process.argv.slice(2), {

99 stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/wuphf.jsView on unpkg · L82

100 });

101 child.on("exit", (code, signal) => {

102 if (signal) {