w3bs.AccountStart building
PACKAGES / profullstack.com

root-w3bs-os

Set up and maintain a W3BS OS box as root: accounts, SSH keys, zsh, Caddy sites, firewall, swap and confinement. Safe to re-run.

ThreatCrush · No malware found
INSTALLw3bs install profullstack.com/root-w3bs-os

No w3bs yet? curl -fsSL https://w3bs.org/install.sh | sh

Get started

What to type once it is installed.

  1. w3bs install profullstack.com/root-w3bs-osInstall root-w3bs-os and track it for updates
  2. root-w3bs-osStart root-w3bs-os

Every option: root-w3bs-os --help · docs ↗

Malware scan

ThreatCrush found no malware indicators in root-w3bs-os 0.1.0. The other findings below are ordinary code-review notes, not malware.

Scanned
2026-11-01 22:56 UTC · threatcrush 0.13.30
Files
402 (installer + github.com/profullstack/cli-tools)
Findings
15 high · 12 medium · 14 low
41 other findings (not malware)
  • high
    outbound request to a non-constant URLsource/dev2/dev2-site:151py-ssrf-outbound-request · CWE-918
  • high
    outbound request to a non-constant URLsource/dev2/dev2-site:1062py-ssrf-outbound-request · CWE-918
  • high
    outbound request to a non-constant URLsource/dev2/dev2-site:1799py-ssrf-outbound-request · CWE-918
  • high
    network output piped into a shellsource/root-ubuntu.sh:3262sh-remote-script-execution · CWE-494
  • high
    network output piped into a shellsource/root-ubuntu.sh:3263sh-remote-script-execution · CWE-494
  • high
    network output piped into a shellsource/root-ubuntu.sh:5168sh-remote-script-execution · CWE-494
  • high
    network output piped into a shellsource/root-ubuntu.sh:5172sh-remote-script-execution · CWE-494
  • high
    network output piped into a shellsource/root-w3bs-os.sh:3639sh-remote-script-execution · CWE-494
  • high
    network output piped into a shellsource/root-w3bs-os.sh:3640sh-remote-script-execution · CWE-494
  • high
    network output piped into a shellsource/root-w3bs-os.sh:5569sh-remote-script-execution · CWE-494
  • high
    network output piped into a shellsource/root-w3bs-os.sh:5579sh-remote-script-execution · CWE-494
  • high
    network output piped into a shellsource/root-w3bs-os.sh:5586sh-remote-script-execution · CWE-494
  • high
    network output piped into a shellsource/root-w3bs-os.sh:5602sh-remote-script-execution · CWE-494
  • high
    network output piped into a shellsource/root-w3bs-os.sh:5607sh-remote-script-execution · CWE-494
  • high
    download over plain HTTPsource/root-w3bs-os.sh:6289sh-plaintext-download · CWE-319
  • medium
    SQL built from a template literal or f-stringsource/dev2/dev2-site:1289sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/dev2/dev2-site:1366sql-template-interpolation · CWE-89
  • medium
    network output piped into a shellsource/root-ubuntu.sh:5376sh-remote-script-execution · CWE-494
  • medium
    regex with nested unbounded quantifierssource/src/domain-free.ts:56redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/src/emoji.ts:167redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/src/icon.ts:166redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/src/mail.ts:1060redos-nested-quantifier · CWE-1333
  • medium
    SQL built from a template literal or f-stringsource/src/users-dump.ts:487sql-template-interpolation · CWE-89
  • medium
    SQL assembled by concatenation or interpolationsource/src/users-dump.ts:507sql-string-concatenation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/src/users-dump.ts:540sql-template-interpolation · CWE-89
  • medium
    SQL assembled by concatenation or interpolationsource/src/users-dump.ts:574sql-string-concatenation · CWE-89
  • medium
    regex with nested unbounded quantifierssource/src/wcag.ts:556redos-nested-quantifier · CWE-1333
  • low
    Hardcoded Credentialsource/src/credentials.ts:41secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/credentials.ts:58secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/credentials.ts:61secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/credentials.ts:66secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/user-export.ts:689secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/user-export.ts:695secret-generic-credential · CWE-798
  • low
    Generic API Keysource/test/credentials.test.ts:208secret-generic-api-key · CWE-798
  • low
    Hardcoded Credentialsource/test/mail.test.ts:141secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/test/proxy.test.ts:69secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/test/proxy.test.ts:85secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/test/shorten.test.ts:36secret-generic-credential · CWE-798
  • low
    Database URL with credentialssource/test/users-dump.test.ts:108secret-database-url · CWE-798
  • low
    Database URL with credentialssource/test/users-dump.test.ts:119secret-database-url · CWE-798
  • low
    Database URL with credentialssource/test/users-dump.test.ts:120secret-database-url · CWE-798

Badge for your README

ThreatCrush: No malware found

[![ThreatCrush scan](https://w3bs.org/api/packages/profullstack.com/root-w3bs-os/badge.svg)](https://w3bs.org/packages/profullstack.com/root-w3bs-os)