github TypeScript analyzed f412096

koala73/worldmonitor

Real-time global intelligence dashboard. AI-powered news aggregation, geopolitical monitoring, and infrastructure tracking in a unified situational awareness interface

maintainer: koala73
license: NOASSERTION
first seen: 2026-07-05
last seen: 2026-08-01
releases · 30d: 0
short id

risk 100/100 · heuristic grade

E critical

vulnerabilities attested + 50
capability exposure inferred + 35
recent drift inferred + 12
tool safety inferred + 12
trust mitigators mixed − 8

attested inferred mixed

The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.

graded 56s ago · see ecosystem CVEs →

risk trajectory 5 movements

2d ago E · 89 → E · 100
2d ago D · 77 → E · 89
1w ago B · 27 → D · 77
3w ago C · 39 → B · 27
3w ago C · 47 → C · 39

capability exposure grade factor +35

Inferred surface — each links to servers holding it:

vulnerabilities 5 CVEs · grade factor +50

HIGH

Windows command injection in Tauri open_url IPC (cmd /c start) — user-assisted desktop RCE affects ["<= 2.8.0 (main @ commit 16d0a12e) — Windows desktop builds only "]

HIGH

Unauthenticated cross-tenant read of all users' alert rules via public Convex query getByEnabled affects [" <= 2.8.0 (main @ commit 16d0a12e)"]

LOW

OAuth refresh-token reuse not contained: no family revocation on detected reuse affects ["<= 2.8.0 (main @ commit 16d0a12e)"]

MEDIUM

Abuse-control / rate-limit bypass via spoofable cf-connecting-ip header affects ["<= 2.8.0 (main @ commit 16d0a12e)"]

MEDIUM

MCP daily cost-cap bypass: quota slot refunded after the tool already executed affects ["<= 2.8.0 (main @ commit 16d0a12e)"]

tool safety 1 findings · grade factor +12

high dangerous code

dynamic exec: new Function(), vm exec · obfuscated payload: dynamic require()/import()

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit f412096 · analyzer v28 · 2d ago

skills & prompt files 27

danger signals53

dynamic code execution new Function() koala73-worldmonitor-f412096/scripts/ais-relay-entity-decode.test.cjs :24 return new Function(`${match[0]}; return ${name};`)();
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/blog-faq-ld.test.mjs :24 return new Function(`${js}\nreturn extractFaqLd;`)();
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/brief-thread-open-telemetry.test.mjs :285 const fn = new Function('window', 'document', script);
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/chokepoint-transit-counter.test.mjs :12 const classifyVesselType = new Function('shipType', fnMatch[1]);
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/csp-filter.test.mjs :22 const suppress = new Function(...fnParams, fnBody);
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/deckgl-interleaved-race-filter.test.mjs :14 return new Function(`return ${match[1]}`)();
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/deduct-situation-edge-budget.test.mjs :33 return new Function(`"use strict"; return (${expr});`)();
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/email-validation.test.mjs :148 const parseCsvLine = new Function('line', fnSource.replace('function parseCsvLine(line)', 'return (function(line)') + ')(line)');
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/flush-stale-refreshes.test.mjs :119 const factory = new Function('Date', 'setTimeout', 'clearTimeout', `
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/freight-indices.test.mjs :17 const accumulateHistory = new Function(`return ${accHistBlock}`)();
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/gulf-fdi-data.test.mjs :22 const evaluator = new Function('exports', 'module', transpiled.outputText);
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/importance-score-parity.test.mjs :83 return new Function(`return (${literal});`)();
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/map-trade-animation-loop.test.mjs :126 return new Function(`${js}\nreturn { stableTradeRoutePhase, TRADE_ANIMATION_CYCLE };`)();
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/map-trade-trip-position.test.mjs :35 return new Function(`${js}\nreturn positionAlongPath;`)();
dynamic code execution vm exec koala73-worldmonitor-f412096/tests/mcp-resources.test.mjs :147 vm.runInNewContext(script, context, { timeout: 1_000 });
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/redis-rest-proxy-url-masking.test.mjs :19 return new Function(`${helperSrc}\nreturn maskRedisUrl;`)();
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/relay-boot-seed-freshness-guard.test.mjs :62 const factory = new Function('UPSTASH_ENABLED', 'upstashGet', 'console', `return (${delayFnText});`);
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/search-mobile-first-paint.test.mts :93 const Harness = new Function('isMobileDevice', harnessJs)(() => true) as new () => SearchModalHarness;
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/search-open-state-machine.test.mjs :50 return new Function('showToast', `${js}\nreturn __OpenSearchHarness;`);
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/sector-valuations.test.mjs :22 const parseSectorValuation = new Function(
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/sentry-beforesend.test.mjs :43 const rawBeforeSend = new Function('event', 'isDebugBearRumScriptFrame', `${tpMatch[0]}\n${fnBody}`);
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/smart-poll-loop.test.mjs :132 const factory = new Function(
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/transit-summaries.test.mjs :209 const factory = new Function(
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/ucdp-seed-resilience.test.mjs :254 const ucdpVersionNewer = new Function(
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/unified-settings-active-tab.test.mjs :66 return new Function(
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/webmcp.test.mjs :152 const runInline = IIFE ? new Function('navigator', 'window', 'document', IIFE) : null;
dynamic code execution vm exec koala73-worldmonitor-f412096/tests/widget-builder.test.mjs :1387 vm.runInNewContext(script, context);
dynamic code execution new Function() koala73-worldmonitor-f412096/tests/widget-builder.test.mjs :1780 const fn = new Function(`${fnMatch[0]}; return classifyWidgetAgentError;`)();
suspicious endpoint example.ingest.sentry.io (telemetry) expected for this server's purpose koala73-worldmonitor-f412096/api/_sentry-common.test.mjs :66 assert.equal(String(input), 'https://example.ingest.sentry.io/api/12345/envelope/');
suspicious endpoint 169.254.169.254 (cloud metadata) koala73-worldmonitor-f412096/api/rss-proxy.test.mjs :97 headers: { Location: 'http://169.254.169.254/latest/meta-data' },
suspicious endpoint api.telegram.org koala73-worldmonitor-f412096/convex/http.ts :447 await fetch(`https://api.telegram.org/bot${botToken}/sendMessage`, {
suspicious endpoint t.me koala73-worldmonitor-f412096/scripts/ais-relay.cjs :855 url: `https://t.me/${channel.handle}/${msg.id}`,
suspicious endpoint api.telegram.org koala73-worldmonitor-f412096/scripts/notification-relay.cjs :360 const res = await fetch(`https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage`, {
suspicious endpoint api.telegram.org koala73-worldmonitor-f412096/scripts/seed-digest-notifications.mjs :1367 `https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMediaGroup`,
suspicious endpoint status.datadoghq.com (telemetry) koala73-worldmonitor-f412096/server/worldmonitor/infrastructure/v1/list-service-statuses.ts :58 { id: 'datadog', name: 'Datadog', statusPage: 'https://status.datadoghq.com/api/v2/status.json', category: 'saas' },
suspicious endpoint status.sentry.io (telemetry) expected for this server's purpose koala73-worldmonitor-f412096/server/worldmonitor/infrastructure/v1/list-service-statuses.ts :59 { id: 'sentry', name: 'Sentry', statusPage: 'https://status.sentry.io/api/v2/status.json', category: 'saas' },
suspicious endpoint t.me koala73-worldmonitor-f412096/server/worldmonitor/leads/v1/register-interest.ts :137 const telegramShare = `https://t.me/share/url?url=${shareUrl}&text=${encodeURIComponent('Join the World Monitor Pro waitlist:')}`;
suspicious endpoint 192.0.0.1 koala73-worldmonitor-f412096/src-tauri/sidecar/local-api-server.test.mjs :860 'http://192.0.0.1/secret',
suspicious endpoint 192.88.99.1 koala73-worldmonitor-f412096/src-tauri/sidecar/local-api-server.test.mjs :862 'http://192.88.99.1/secret',
suspicious endpoint 93.184.216.34 koala73-worldmonitor-f412096/src-tauri/sidecar/local-api-server.test.mjs :975 const upstream = await fetch('https://93.184.216.34/data');
suspicious endpoint mcp.datadoghq.com (telemetry) koala73-worldmonitor-f412096/src/services/mcp-store.ts :195 serverUrl: 'https://mcp.datadoghq.com/api/unstable/mcp-server/mcp',
suspicious endpoint t.me koala73-worldmonitor-f412096/src/services/notifications-settings.ts :1036 const deepLink = `https://t.me/${String(botUsername)}?start=${token}`;
suspicious endpoint t.me koala73-worldmonitor-f412096/src/services/story-share.ts :119 telegram: `https://t.me/share/url?url=${encodeURIComponent(url)}&text=${encodeURIComponent(shareTexts.telegram(data))}`,
suspicious endpoint 169.254.169.254 (cloud metadata) koala73-worldmonitor-f412096/tests/china-decision-parity-audit.test.mjs :371 'https://169.254.169.254',
suspicious endpoint o450.ingest.us.sentry.io (telemetry) expected for this server's purpose koala73-worldmonitor-f412096/tests/csp-filter.test.mjs :49 assert.ok(suppress('enforce', 'connect-src', 'https://o450.ingest.us.sentry.io', '', true));
suspicious endpoint mcp.datadoghq.com (telemetry) koala73-worldmonitor-f412096/tests/mcp-presets.test.mjs :199 { name: 'Datadog', url: 'https://mcp.datadoghq.com/api/unstable/mcp-server/mcp' },
suspicious endpoint 169.254.169.254 (cloud metadata) koala73-worldmonitor-f412096/tests/mcp-proxy.test.mjs :393 const res = await handler(makeGetRequest({ serverUrl: 'https://169.254.169.254/latest/meta-data/' }));
suspicious endpoint 169.254.169.254 (cloud metadata) koala73-worldmonitor-f412096/tests/notification-webhook-ssrf.test.mts :33 'https://169.254.169.254/latest/meta-data',
suspicious endpoint 93.184.216.34 koala73-worldmonitor-f412096/tests/notification-webhook-ssrf.test.mts :163 'https://93.184.216.34/hook',
suspicious endpoint 93.184.216.34 koala73-worldmonitor-f412096/tests/shipping-v2-handler.test.mjs :209 callbackUrl: 'https://93.184.216.34/wm',
suspicious endpoint 169.254.169.254 (cloud metadata) koala73-worldmonitor-f412096/tests/shipping-v2-handler.test.mjs :241 'https://169.254.169.254/latest/meta-data/',
suspicious endpoint t.me koala73-worldmonitor-f412096/tests/telegram-feed-contract.test.mjs :85 url: 'https://t.me/osint/1',
suspicious endpoint o4505.ingest.sentry.io (telemetry) expected for this server's purpose koala73-worldmonitor-f412096/tests/wm-session-interceptor-target.test.mts :86 isApiCallTarget('https://o4505.ingest.sentry.io/api/12345/envelope/', CANONICAL_ORIGIN),

other grade factors evidence elsewhere

recent drift +12 capability drift →

embed badge readme-ready

[![MCP Observatory risk grade](https://mcpobservatory.com/servers/github:koala73/worldmonitor/badge.svg)](https://mcpobservatory.com/servers/github:koala73/worldmonitor/security)

Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of koala73.

koala73/worldmonitor

skills & prompt files 27

danger signals53

Navigate

Stream

Features

Display