w3bs.AccountStart building
PACKAGES / Profullstack

moshcode

Wrapper CLI that installs and drives coding agents such as opencode, Claude Code and codex, with a small scripting toolkit called moshscript.

ThreatCrush · No malware found
INSTALLw3bs install moshcode.sh/moshcode

No w3bs yet? curl -fsSL https://w3bs.org/install.sh | sh

Get started

What to type once it is installed.

  1. w3bs install moshcode.sh/moshcodeInstall moshcode and track it for updates
  2. moshcode enginesList the coding agents moshcode can install and which are present
  3. moshcode install claudeInstall Claude Code as an engine
  4. moshcode start claude -d --name <session>Launch an engine as a background session that outlives the terminal
  5. moshscript <script.mosh>Run a moshscript file (alias for moshcode run)

Every option: moshcode --help · docs ↗

Malware scan

ThreatCrush found no malware indicators in moshcode 0.120.1. The other findings below are ordinary code-review notes, not malware.

Scanned
2026-11-02 14:09 UTC · threatcrush 0.13.30
Files
624 (installer + github.com/moshcoder/moshcode)
Findings
4 high · 26 medium · 24 low
54 other findings (not malware)
  • high
    network output piped into a shellinstaller/install.sh:365sh-remote-script-execution · CWE-494
  • high
    outbound request to a non-constant URLsource/apps/pwa/public/sw.js:76js-ssrf-outbound-request · CWE-918
  • high
    TLS certificate verification disabledsource/apps/pwa/src/lib/moshpit-gateway.mjs:299tls-verification-disabled · CWE-295
  • high
    TLS certificate verification disabledsource/src/dns.mjs:823tls-verification-disabled · CWE-295
  • medium
    network output piped into a shellinstaller/install.sh:124sh-remote-script-execution · CWE-494
  • medium
    network output piped into a shellinstaller/install.sh:128sh-remote-script-execution · CWE-494
  • medium
    network output piped into a shellinstaller/install.sh:147sh-remote-script-execution · CWE-494
  • medium
    unescaped HTML renderingsource/apps/pwa/public/herd/herd.js:117js-unescaped-html-sink · CWE-79
  • medium
    regex with nested unbounded quantifierssource/apps/pwa/src/lib/feed.mjs:406redos-nested-quantifier · CWE-1333
  • medium
    SQL built from a template literal or f-stringsource/apps/pwa/src/moshpit.mjs:179sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/pwa/src/moshpit.mjs:674sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/pwa/src/moshpit.mjs:1150sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/pwa/src/moshpit.mjs:1173sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/pwa/src/moshpit.mjs:1195sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/pwa/src/moshpit.mjs:1394sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/pwa/src/moshpit.mjs:2069sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/pwa/src/moshpit.mjs:2340sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/pwa/src/moshpit.mjs:2346sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/pwa/src/moshpit.mjs:2491sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/pwa/src/moshpit.mjs:2643sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/pwa/src/moshpit.mjs:2651sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/pwa/src/moshpit.mjs:2659sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/pwa/src/moshpit.mjs:2689sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/pwa/src/routes/mcp.mjs:87sql-template-interpolation · CWE-89
  • medium
    network output piped into a shellsource/install.sh:87sh-remote-script-execution · CWE-494
  • medium
    network output piped into a shellsource/install.sh:91sh-remote-script-execution · CWE-494
  • medium
    regex with nested unbounded quantifierssource/src/news.mjs:730redos-nested-quantifier · CWE-1333
  • medium
    buffer allocated without zeroingsource/src/pty.mjs:138js-uninitialized-buffer · CWE-908
  • medium
    MAC or signature compared with ==source/src/settings-sync.mjs:366js-timing-unsafe-mac-compare · CWE-208
  • medium
    SQL assembled by concatenation or interpolationsource/src/transcript.mjs:512sql-string-concatenation · CWE-89
  • low
    dynamic code executionsource/apps/pwa/test/apikey-mask.test.mjs:129js-dynamic-code-execution · CWE-95
  • low
    Hardcoded Credentialsource/apps/pwa/test/auth-form-email.test.mjs:33secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/pwa/test/credit-codes.test.mjs:91secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/pwa/test/credit-codes.test.mjs:179secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/pwa/test/credit-codes.test.mjs:202secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/pwa/test/credit-codes.test.mjs:209secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/pwa/test/credit-codes.test.mjs:214secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/pwa/test/credit-codes.test.mjs:219secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/pwa/test/credit-codes.test.mjs:228secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/pwa/test/credit-codes.test.mjs:253secret-generic-credential · CWE-798
  • low
    SQL built from a template literal or f-stringsource/apps/pwa/test/credits-webhook-event-match.test.mjs:121sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/apps/pwa/test/credits-webhook-event-match.test.mjs:141sql-template-interpolation · CWE-89
  • low
    Hardcoded Credentialsource/apps/pwa/test/csrf-input-escaping.test.mjs:101secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/pwa/test/moshpit-contact.test.mjs:107secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/pwa/test/moshpit-contact.test.mjs:116secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/pwa/test/moshpit-contact.test.mjs:122secret-generic-credential · CWE-798
  • low
    SQL built from a template literal or f-stringsource/apps/pwa/test/moshpit-terms.test.mjs:207sql-template-interpolation · CWE-89
  • low
    Hardcoded Credentialsource/apps/pwa/test/require-auth-next.test.mjs:35secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/test/auth.test.mjs:13secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/test/auth.test.mjs:148secret-generic-credential · CWE-798
  • low
    write to a prototype-reachable keysource/test/herd-relay.test.mjs:130js-prototype-pollution · CWE-1321
  • low
    Hardcoded Credentialsource/test/mcp-share.test.mjs:107secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/test/settings-sync-allowlist.test.mjs:120secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/test/settings-sync.test.mjs:50secret-generic-credential · CWE-798

Badge for your README

ThreatCrush: No malware found

[![ThreatCrush scan](https://w3bs.org/api/packages/moshcode.sh/moshcode/badge.svg)](https://w3bs.org/packages/moshcode.sh/moshcode)