{"id":"moshcode.sh/moshcode","name":"moshcode","commands":["moshcode","moshscript"],"examples":[{"run":"moshcode engines","does":"List the coding agents moshcode can install and which are present"},{"run":"moshcode install claude","does":"Install Claude Code as an engine"},{"run":"moshcode start claude -d --name <session>","does":"Launch an engine as a background session that outlives the terminal"},{"run":"moshscript <script.mosh>","does":"Run a moshscript file (alias for moshcode run)"}],"description":"Wrapper CLI that installs and drives coding agents such as opencode, Claude Code and codex, with a small scripting toolkit called moshscript.","homepage":"https://moshcode.sh","repository":"https://github.com/moshcoder/moshcode","license":"MIT","agentic":true,"latest_version":"0.120.1","vendor":"Profullstack","install":"curl -fsSL https://moshcoding.com/install.sh | sh","publisher":"profullstack","w3bs":"w3bs install moshcode.sh/moshcode","scan":{"status":"passed","scanner":"threatcrush 0.13.30","filesScanned":624,"summary":{"critical":0,"high":4,"medium":26,"low":24,"info":0},"malware":0,"truncated":false,"version":"0.120.1","sources":{"installer":"https://moshcoding.com/install.sh","installerSha256":"eed3c6994beee7b877e75b0e99b6ccde3375e636dd89cd5d11e31c51734397da","repository":"github.com/moshcoder/moshcode"},"notes":[],"scannedAt":"2026-11-02T14:09:06.837Z","findings":[{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"high","category":"code","cwe":"CWE-494","file":"installer/install.sh","line":365,"malware":false},{"ruleId":"js-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/apps/pwa/public/sw.js","line":76,"malware":false},{"ruleId":"tls-verification-disabled","title":"TLS certificate verification disabled","severity":"high","category":"code","cwe":"CWE-295","file":"source/apps/pwa/src/lib/moshpit-gateway.mjs","line":299,"malware":false},{"ruleId":"tls-verification-disabled","title":"TLS certificate verification disabled","severity":"high","category":"code","cwe":"CWE-295","file":"source/src/dns.mjs","line":823,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"medium","category":"code","cwe":"CWE-494","file":"installer/install.sh","line":124,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"medium","category":"code","cwe":"CWE-494","file":"installer/install.sh","line":128,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"medium","category":"code","cwe":"CWE-494","file":"installer/install.sh","line":147,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/pwa/public/herd/herd.js","line":117,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/apps/pwa/src/lib/feed.mjs","line":406,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/pwa/src/moshpit.mjs","line":179,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/pwa/src/moshpit.mjs","line":674,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/pwa/src/moshpit.mjs","line":1150,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/pwa/src/moshpit.mjs","line":1173,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/pwa/src/moshpit.mjs","line":1195,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/pwa/src/moshpit.mjs","line":1394,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/pwa/src/moshpit.mjs","line":2069,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/pwa/src/moshpit.mjs","line":2340,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/pwa/src/moshpit.mjs","line":2346,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/pwa/src/moshpit.mjs","line":2491,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/pwa/src/moshpit.mjs","line":2643,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/pwa/src/moshpit.mjs","line":2651,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/pwa/src/moshpit.mjs","line":2659,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/pwa/src/moshpit.mjs","line":2689,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/pwa/src/routes/mcp.mjs","line":87,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"medium","category":"code","cwe":"CWE-494","file":"source/install.sh","line":87,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"medium","category":"code","cwe":"CWE-494","file":"source/install.sh","line":91,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/src/news.mjs","line":730,"malware":false},{"ruleId":"js-uninitialized-buffer","title":"buffer allocated without zeroing","severity":"medium","category":"code","cwe":"CWE-908","file":"source/src/pty.mjs","line":138,"malware":false},{"ruleId":"js-timing-unsafe-mac-compare","title":"MAC or signature compared with ==","severity":"medium","category":"code","cwe":"CWE-208","file":"source/src/settings-sync.mjs","line":366,"malware":false},{"ruleId":"sql-string-concatenation","title":"SQL assembled by concatenation or interpolation","severity":"medium","category":"code","cwe":"CWE-89","file":"source/src/transcript.mjs","line":512,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"low","category":"code","cwe":"CWE-95","file":"source/apps/pwa/test/apikey-mask.test.mjs","line":129,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/pwa/test/auth-form-email.test.mjs","line":33,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/pwa/test/credit-codes.test.mjs","line":91,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/pwa/test/credit-codes.test.mjs","line":179,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/pwa/test/credit-codes.test.mjs","line":202,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/pwa/test/credit-codes.test.mjs","line":209,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/pwa/test/credit-codes.test.mjs","line":214,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/pwa/test/credit-codes.test.mjs","line":219,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/pwa/test/credit-codes.test.mjs","line":228,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/pwa/test/credit-codes.test.mjs","line":253,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"low","category":"code","cwe":"CWE-89","file":"source/apps/pwa/test/credits-webhook-event-match.test.mjs","line":121,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"low","category":"code","cwe":"CWE-89","file":"source/apps/pwa/test/credits-webhook-event-match.test.mjs","line":141,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/pwa/test/csrf-input-escaping.test.mjs","line":101,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/pwa/test/moshpit-contact.test.mjs","line":107,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/pwa/test/moshpit-contact.test.mjs","line":116,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/pwa/test/moshpit-contact.test.mjs","line":122,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"low","category":"code","cwe":"CWE-89","file":"source/apps/pwa/test/moshpit-terms.test.mjs","line":207,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/pwa/test/require-auth-next.test.mjs","line":35,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/auth.test.mjs","line":13,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/auth.test.mjs","line":148,"malware":false},{"ruleId":"js-prototype-pollution","title":"write to a prototype-reachable key","severity":"low","category":"code","cwe":"CWE-1321","file":"source/test/herd-relay.test.mjs","line":130,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/mcp-share.test.mjs","line":107,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/settings-sync-allowlist.test.mjs","line":120,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/test/settings-sync.test.mjs","line":50,"malware":false}]}}