github JavaScript analyzed 7f8e605

crostra/bumper

github

A macOS Control Plane that runs AI coding CLIs inside the Project boundary you choose.

maintainer: crostra
licence: Apache-2.0
first seen: 2026-08-03
last seen: 2026-08-05
releases · 30d: 0
short id

Drift inferred · capture-to-capture

HIGH 2026-08-08 code analysis flagged dynamic code execution ×2 in crostra/bumper
HIGH 2026-08-03 code analysis flagged dynamic code execution ×2 in crostra/bumper

capabilities 0 tools

transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 7f8e605 · analyzer v33 · 1w ago

danger signals5

dynamic code execution vm exec crostra-bumper-7f8e605/src/launch-gate-node.ts :81 vm.runInNewContext(code, sandbox);
dynamic code execution vm exec crostra-bumper-7f8e605/test/launch-gate.test.mjs :16 vm.runInNewContext(code, sandbox);
suspicious endpoint 1.1.1.1 crostra-bumper-7f8e605/src/room/aiproof.ts :185 const networkUrl = "http://1.1.1.1";
suspicious endpoint 1.1.1.1 crostra-bumper-7f8e605/src/room/breakout.ts :69 command: ["sh", "-c", "wget -T5 -qO- http://1.1.1.1 >/dev/null 2>&1 && echo ESCAPED || echo CONTAINED"],
suspicious endpoint 1.1.1.1 crostra-bumper-7f8e605/test/network-vm.test.mjs :81 "busybox wget -T 2 -q -O /dev/null http://1.1.1.1 2>/tmp/wget-ip.err",

code evidence vv0.6.0-rc.2 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 163

filesystem 101

fs crostra-bumper-7f8e605/assets/room-mcp-server.mjs :16 import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
fs (weak) crostra-bumper-7f8e605/scripts/build-dmg.mjs :3 import { readFileSync } from "node:fs";
fs (weak) crostra-bumper-7f8e605/scripts/build.mjs :1 import { chmodSync, rmSync } from "node:fs";
fs (weak) crostra-bumper-7f8e605/scripts/fix-node-pty.mjs :1 import { chmodSync, existsSync } from "node:fs";
fs (weak) crostra-bumper-7f8e605/scripts/install-local-app.mjs :13 import { existsSync, rmSync } from "node:fs";
fs (weak) crostra-bumper-7f8e605/scripts/notarize.mjs :16 import { mkdtempSync, rmSync } from "node:fs";
fs (weak) crostra-bumper-7f8e605/scripts/render-icons.mjs :15 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
fs (weak) crostra-bumper-7f8e605/scripts/smoke-dmg.mjs :16 import { existsSync, readFileSync, mkdtempSync, rmSync, readdirSync } from "node:fs";
fs crostra-bumper-7f8e605/src/agents.ts :1 import { existsSync, readdirSync, realpathSync } from "node:fs";
fs crostra-bumper-7f8e605/src/app.ts :2 import { existsSync, readFileSync, realpathSync, readdirSync, writeFileSync, mkdtempSync, rmSync } from "node:fs";
fs crostra-bumper-7f8e605/src/cli-room.ts :7 import { existsSync, realpathSync, writeFileSync } from "node:fs";
fs crostra-bumper-7f8e605/src/cli.ts :2 import { writeFileSync, existsSync, mkdirSync } from "node:fs";

show 28 more

fs crostra-bumper-7f8e605/src/config-store.ts :20 } from "node:fs";
fs crostra-bumper-7f8e605/src/config.ts :1 import { readFileSync, existsSync, mkdirSync } from "node:fs";
fs crostra-bumper-7f8e605/src/development-session-lease.ts :9 } from "node:fs";
fs crostra-bumper-7f8e605/src/docker-broker.ts :12 } from "node:fs";
fs crostra-bumper-7f8e605/src/doctor.ts :19 import { existsSync } from "node:fs";
fs crostra-bumper-7f8e605/src/folders.ts :10 import { existsSync, readdirSync, realpathSync, statSync } from "node:fs";
fs crostra-bumper-7f8e605/src/git-broker.ts :10 } from "node:fs";
fs crostra-bumper-7f8e605/src/git-connections.ts :12 import { existsSync, unlinkSync } from "node:fs";
fs crostra-bumper-7f8e605/src/git-session-lease.ts :9 } from "node:fs";
fs crostra-bumper-7f8e605/src/git-workspace.ts :10 import { existsSync } from "node:fs";
fs crostra-bumper-7f8e605/src/github-app.ts :8 } from "node:fs";
fs crostra-bumper-7f8e605/src/install.ts :1 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
fs crostra-bumper-7f8e605/src/launch-gate-node.ts :5 import { readFileSync } from "node:fs";
fs crostra-bumper-7f8e605/src/log.ts :1 import { appendFileSync, readFileSync, existsSync, mkdirSync, writeFileSync, renameSync } from "node:fs";
fs crostra-bumper-7f8e605/src/mcp-hub.ts :26 } from "node:fs";
fs crostra-bumper-7f8e605/src/mcp-import.ts :10 import { existsSync, readFileSync } from "node:fs";
fs crostra-bumper-7f8e605/src/operations/prove.ts :16 import { existsSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
fs crostra-bumper-7f8e605/src/paths.ts :3 import { existsSync } from "node:fs";
fs crostra-bumper-7f8e605/src/prefs.ts :5 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
fs crostra-bumper-7f8e605/src/preview-broker.ts :4 } from "node:fs";
fs crostra-bumper-7f8e605/src/project.ts :5 import { existsSync, realpathSync } from "node:fs";
fs crostra-bumper-7f8e605/src/protection-status.ts :7 import { existsSync, mkdirSync, readFileSync } from "node:fs";
fs crostra-bumper-7f8e605/src/room/accounts-cli.ts :5 import { writeFileSync } from "node:fs";
fs crostra-bumper-7f8e605/src/room/aiproof.ts :25 import { mkdirSync, writeFileSync } from "node:fs";
fs crostra-bumper-7f8e605/src/room/auth.ts :36 } from "node:fs";
fs crostra-bumper-7f8e605/src/room/mcp-broker.ts :33 } from "node:fs";
fs crostra-bumper-7f8e605/src/room/setup.ts :2 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
fs crostra-bumper-7f8e605/src/rules.ts :1 import { readFileSync, writeFileSync } from "node:fs";

61 more not shown — this panel samples each group; the count above is the real total.

shell / exec 41

shell (weak) crostra-bumper-7f8e605/scripts/build-app.mjs :1 import { execFileSync } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/scripts/build-dmg.mjs :1 import { spawnSync } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/scripts/build.mjs :3 import { spawnSync } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/scripts/install-local-app.mjs :12 import { execFileSync, spawnSync } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/scripts/notarize.mjs :14 import { spawnSync } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/scripts/render-icons.mjs :14 import { execFile } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/scripts/smoke-dmg.mjs :14 import { spawnSync } from "node:child_process";
shell crostra-bumper-7f8e605/src/agents.ts :2 import { execFileSync } from "node:child_process";
shell crostra-bumper-7f8e605/src/app.ts :3 import { execFile, spawnSync } from "node:child_process";
shell crostra-bumper-7f8e605/src/cli-room.ts :8 import { spawn } from "node:child_process";
shell crostra-bumper-7f8e605/src/cli.ts :773 const { spawn } = await import("node:child_process");
shell crostra-bumper-7f8e605/src/docker-broker.ts :14 import { spawn, execFile } from "node:child_process";

show 28 more

shell crostra-bumper-7f8e605/src/doctor.ts :20 import { spawnSync } from "node:child_process";
shell crostra-bumper-7f8e605/src/git-workspace.ts :9 import { execFile } from "node:child_process";
shell crostra-bumper-7f8e605/src/github-app.ts :5 import { spawnSync } from "node:child_process";
shell crostra-bumper-7f8e605/src/operations/container-system.ts :13 import { spawnSync } from "node:child_process";
shell crostra-bumper-7f8e605/src/preview-broker.ts :48 import { execFileSync } from "node:child_process";
shell crostra-bumper-7f8e605/src/room/apple-container.ts :14 import { execFile, spawn as spawnProcess } from "node:child_process";
shell crostra-bumper-7f8e605/src/room/egress-network.ts :23 import { execFile } from "node:child_process";
shell crostra-bumper-7f8e605/src/room/setup.ts :1 import { spawn, spawnSync } from "node:child_process";
shell crostra-bumper-7f8e605/src/sandbox.ts :1 import { execFileSync, spawn } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/test/cli-guidance.test.mjs :7 import { spawnSync } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/test/development-runtime-vm.test.mjs :3 import { execFile, spawn } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/test/egress-network-vm.test.mjs :17 import { execFile } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/test/hook.test.mjs :9 import { spawnSync } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/test/log.test.mjs :8 import { spawnSync } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/test/mcp-room-vm.test.mjs :18 import { spawn } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/test/operations-folders.test.mjs :15 import { spawnSync } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/test/operations-lifecycle.test.mjs :13 import { spawnSync } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/test/operations-network.test.mjs :14 import { spawnSync } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/test/operations-parity.test.mjs :15 import { spawnSync } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/test/project-access-empty-roots.test.mjs :12 import { spawnSync } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/test/project-cli-phase2.test.mjs :10 import { spawnSync } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/test/project-cli-phase5.test.mjs :14 import { spawnSync } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/test/project-cli-room-image.test.mjs :3 import { spawnSync } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/test/quickstart-support.test.mjs :7 import { spawnSync } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/test/repository-hygiene.test.mjs :15 import { execFileSync } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/test/sandbox.test.mjs :4 import { execFileSync, spawnSync } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/test/ui-control-plane-phase5.test.mjs :11 import { execFileSync } from "node:child_process";
shell (weak) crostra-bumper-7f8e605/test/ui-control-plane-phase7.test.mjs :19 import { spawn } from "node:child_process";

1 more not shown — this panel samples each group; the count above is the real total.

network 34

net crostra-bumper-7f8e605/assets/app.js :176 const response = await fetch(path, { ...options, headers: { ...(options.body ? { "content-type": "application/json" } : {}), ...(options.headers || {}) } });
net crostra-bumper-7f8e605/src/app.ts :1 import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
net crostra-bumper-7f8e605/src/cli.ts :757 const response = await fetch(`${handle.url}/api/github/connect`, {
net crostra-bumper-7f8e605/src/github-app.ts :251 const res = await fetch(`https://api.github.com${path}`, {
net crostra-bumper-7f8e605/src/preview-broker.ts :1 import { createServer, createConnection, type Server, type Socket } from "node:net";
net crostra-bumper-7f8e605/src/room/egress-proxy.ts :20 import { createServer, request as httpRequest, type Server, type IncomingMessage, type ServerResponse } from "node:http";
net crostra-bumper-7f8e605/src/sessions.ts :4 import type { Server } from "node:http";
net (weak) crostra-bumper-7f8e605/test/app.test.mjs :44 const stateResponse = await fetch(`${handle.url}/api/state`);
net (weak) crostra-bumper-7f8e605/test/desire-first-ux.test.mjs :376 const readState = async () => (await (await fetch(`${handle.url}/api/state`)).json());
net (weak) crostra-bumper-7f8e605/test/development-runtime-vm.test.mjs :41 const response = await fetch(url, { signal: AbortSignal.timeout(2_000) });
net (weak) crostra-bumper-7f8e605/test/development-runtime.test.mjs :6 import { createServer } from "node:net";
net (weak) crostra-bumper-7f8e605/test/egress-proxy.test.mjs :3 import { createServer, request } from "node:http";

show 22 more

net (weak) crostra-bumper-7f8e605/test/git-broker.test.mjs :373 const body = await (await fetch(`${handle.url}${path}`)).text();
net (weak) crostra-bumper-7f8e605/test/git-multi-repository.test.mjs :85 return fetch(`${handle.url}/api/contexts`, {
net (weak) crostra-bumper-7f8e605/test/git-session-lease.test.mjs :246 const state = await (await fetch(`${handle.url}/api/state`)).json();
net (weak) crostra-bumper-7f8e605/test/github-app.test.mjs :531 const saved = await fetch(`${handle.url}/api/contexts`, {
net (weak) crostra-bumper-7f8e605/test/honest-product-surface.test.mjs :197 const appHtml = await (await fetch(handle.url)).text();
net (weak) crostra-bumper-7f8e605/test/perf-budget.test.mjs :36 const res = await fetch(url);
net (weak) crostra-bumper-7f8e605/test/phase9-ai-facts.test.mjs :167 const agents = await (await fetch(`${handle.url}/api/agents`)).json();
net (weak) crostra-bumper-7f8e605/test/phase9-l5-dom.test.mjs :204 const state = await (await fetch(`${base}/api/state`)).json();
net (weak) crostra-bumper-7f8e605/test/project-access-empty-roots.test.mjs :244 const before = await (await fetch(`${handle.url}/api/state`)).json();
net (weak) crostra-bumper-7f8e605/test/project-cli-phase1.test.mjs :131 const state = await (await fetch(`${handle.url}/api/state`)).json();
net (weak) crostra-bumper-7f8e605/test/project-cli-phase3.test.mjs :300 const stateRes = await fetch(`${base}/api/state`);
net (weak) crostra-bumper-7f8e605/test/project-cli-phase4.test.mjs :11 import { createServer, request } from "node:http";
net (weak) crostra-bumper-7f8e605/test/ui-control-plane-phase1.test.mjs :118 const appHtml = await (await fetch(handle.url)).text();
net (weak) crostra-bumper-7f8e605/test/ui-control-plane-phase2.test.mjs :101 const stateRes = await fetch(`${handle.url}/api/state`);
net (weak) crostra-bumper-7f8e605/test/ui-control-plane-phase3.test.mjs :189 const state = await (await fetch(`${base}/api/state`)).json();
net (weak) crostra-bumper-7f8e605/test/ui-control-plane-phase4.test.mjs :119 const put = await fetch(`${handle.url}/api/contexts`, {
net (weak) crostra-bumper-7f8e605/test/ui-control-plane-phase5.test.mjs :97 const state = await fetch(`${handle.url}/api/state`).then((r) => r.json());
net (weak) crostra-bumper-7f8e605/test/ui-control-plane-phase5b.test.mjs :133 const state = await fetch(`${handle.url}/api/state`).then((r) => r.json());
net (weak) crostra-bumper-7f8e605/test/ui-control-plane-phase6.test.mjs :140 const res = await fetch(`${handle.url}/api/events?grouped=1&type=files&context=demo`);
net (weak) crostra-bumper-7f8e605/test/ui-control-plane-phase7.test.mjs :142 const state = await (await fetch(`${handle.url}/api/state`)).json();
net (weak) crostra-bumper-7f8e605/test/ui-control-plane-phase8.test.mjs :327 const body = await (await fetch(`${handle.url}/api/state`)).json();
net (weak) crostra-bumper-7f8e605/test/ui-surface-owner-review.test.mjs :123 const state = await (await fetch(`${handle.url}/api/state`)).json();

secrets 2

secrets (weak) crostra-bumper-7f8e605/scripts/notarize.mjs :37 const password = process.env.APPLE_APP_SPECIFIC_PASSWORD;
secrets (weak) crostra-bumper-7f8e605/test/notarize.test.mjs :9 APPLE_APP_SPECIFIC_PASSWORD: process.env.APPLE_APP_SPECIFIC_PASSWORD,

install hooks 2

postinstall crostra-bumper-7f8e605/package.json :21 node scripts/fix-node-pty.mjs
prepare crostra-bumper-7f8e605/package.json :33 tsc

declared dependencies 12

@modelcontextprotocol/sdk@^1.29.0
@xterm/addon-fit@^0.11.0
@xterm/xterm@^6.0.0
lucide@^0.468.0
node-pty@^1.1.0
ws@^8.21.1
zod@^3.23.8
@types/node@^22.10.0
@types/ws@^8.18.1
electron@^43.2.0
electron-builder@^26.15.3
typescript@^5.7.0

obfuscation 1

dynamic require()/import() crostra-bumper-7f8e605/test/project-last-event.test.mjs :24 const { logEvent, latestEventAtByContext } = await import(`${repoRoot}/dist/log.js?t=${Date.now()}`);

perm:untrusted 21

untrusted (weak) crostra-bumper-7f8e605/test/desire-first-ux.test.mjs :376 const readState = async () => (await (await fetch(`${handle.url}/api/state`)).json());
untrusted (weak) crostra-bumper-7f8e605/test/development-runtime-vm.test.mjs :244 "node -e \"fetch('http://127.0.0.1:4567').then(r=>r.text()).then(console.log).catch(console.error)\"; cat /bumper-development-state/preview-connection.json 2>&1; cat /bumper-development-state/preview-
untrusted (weak) crostra-bumper-7f8e605/test/development-runtime.test.mjs :129 assert.equal(await (await fetch(mapping.url)).text(), "preview-ok");
untrusted (weak) crostra-bumper-7f8e605/test/git-broker.test.mjs :373 const body = await (await fetch(`${handle.url}${path}`)).text();
untrusted (weak) crostra-bumper-7f8e605/test/git-multi-repository.test.mjs :121 const state = await (await fetch(`${handle.url}/api/state`)).json();
untrusted (weak) crostra-bumper-7f8e605/test/git-session-lease.test.mjs :246 const state = await (await fetch(`${handle.url}/api/state`)).json();
untrusted (weak) crostra-bumper-7f8e605/test/github-app.test.mjs :557 const savedState = await (await fetch(`${handle.url}/api/state`)).json();
untrusted (weak) crostra-bumper-7f8e605/test/honest-product-surface.test.mjs :197 const appHtml = await (await fetch(handle.url)).text();
untrusted (weak) crostra-bumper-7f8e605/test/phase9-ai-facts.test.mjs :167 const agents = await (await fetch(`${handle.url}/api/agents`)).json();
untrusted (weak) crostra-bumper-7f8e605/test/phase9-l5-dom.test.mjs :204 const state = await (await fetch(`${base}/api/state`)).json();
untrusted (weak) crostra-bumper-7f8e605/test/project-access-empty-roots.test.mjs :244 const before = await (await fetch(`${handle.url}/api/state`)).json();
untrusted (weak) crostra-bumper-7f8e605/test/project-cli-phase1.test.mjs :131 const state = await (await fetch(`${handle.url}/api/state`)).json();

show 9 more

untrusted (weak) crostra-bumper-7f8e605/test/project-cli-phase3.test.mjs :328 const after = await (await fetch(`${base}/api/state`)).json();
untrusted (weak) crostra-bumper-7f8e605/test/ui-control-plane-phase1.test.mjs :118 const appHtml = await (await fetch(handle.url)).text();
untrusted (weak) crostra-bumper-7f8e605/test/ui-control-plane-phase3.test.mjs :189 const state = await (await fetch(`${base}/api/state`)).json();
untrusted (weak) crostra-bumper-7f8e605/test/ui-control-plane-phase5.test.mjs :97 const state = await fetch(`${handle.url}/api/state`).then((r) => r.json());
untrusted (weak) crostra-bumper-7f8e605/test/ui-control-plane-phase5b.test.mjs :133 const state = await fetch(`${handle.url}/api/state`).then((r) => r.json());
untrusted (weak) crostra-bumper-7f8e605/test/ui-control-plane-phase6.test.mjs :245 const state = await (await fetch(`${handle.url}/api/state`)).json();
untrusted (weak) crostra-bumper-7f8e605/test/ui-control-plane-phase7.test.mjs :142 const state = await (await fetch(`${handle.url}/api/state`)).json();
untrusted (weak) crostra-bumper-7f8e605/test/ui-control-plane-phase8.test.mjs :327 const body = await (await fetch(`${handle.url}/api/state`)).json();
untrusted (weak) crostra-bumper-7f8e605/test/ui-surface-owner-review.test.mjs :123 const state = await (await fetch(`${handle.url}/api/state`)).json();

transport_posture 2

binds all interfaces (0.0.0.0) crostra-bumper-7f8e605/src/room/egress-proxy.ts :83 async listen(host = "0.0.0.0"): Promise<number> {
network-listening, binds all interfaces, no auth detected crostra-bumper-7f8e605/test/development-runtime-vm.test.mjs :214 "require('http').createServer((q,r)=>r.end('docker-preview-ok\\n')).listen(4567,'0.0.0.0')",