w3bs.AccountStart building
PACKAGES / Profullstack

pwamart

pwamart, the app store for web apps, from the terminal: search, install PWAs as app windows, publish your own, and browse it all in a TUI.

ThreatCrush · No malware found
INSTALLw3bs install pwamart.com/pwamart

No w3bs yet? curl -fsSL https://w3bs.org/install.sh | sh

Get started

What to type once it is installed.

  1. w3bs install pwamart.com/pwamartInstall pwamart and track it for updates
  2. pwamart search notesSearch the web-app store
  3. pwamart browse --offlineBrowse only apps whose service worker works offline
  4. pwamart install <slug>Open an app as an app window and write a launcher entry
  5. pwamart tuiThe whole store in your terminal
  6. pwamart check https://your.appGrade a site's installability before you submit it

Every option: pwamart --help · docs ↗

Malware scan

ThreatCrush found no malware indicators in pwamart 0.11.0. The other findings below are ordinary code-review notes, not malware.

Scanned
2026-11-01 22:56 UTC · threatcrush 0.13.30
Files
89 (installer + github.com/profullstack/pwamart.com)
Findings
34 critical · 5 high · 133 medium · 40 low
100+ other findings (not malware)
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:282sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:418sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:419sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:613sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:614sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:616sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:639sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:663sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:795sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:829sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:832sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:841sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:855sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:866sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:886sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:900sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:964sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:975sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:977sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:979sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:1000sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:1002sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:1055sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:1059sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:1060sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:1299sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:1300sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:1302sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/app.js:179sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/app.js:180sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/app.js:617sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/app.js:634sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/app.js:642sql-template-interpolation · CWE-89
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/app.js:646sql-template-interpolation · CWE-89
  • high
    Database URL with credentialssource/.github/workflows/ci.yml:22secret-database-url · CWE-798
  • high
    outbound request to a non-constant URLsource/apps/desktop/src/main.cjs:43js-ssrf-outbound-request · CWE-918
  • high
    unescaped HTML renderingsource/apps/web/public/console/console.js:183js-unescaped-html-sink · CWE-79
  • high
    unescaped HTML renderingsource/apps/web/public/console/console.js:1109js-unescaped-html-sink · CWE-79
  • high
    outbound request to a non-constant URLsource/apps/web/public/sw.js:34js-ssrf-outbound-request · CWE-918
  • medium
    network output piped into a shellinstaller/install.sh:64sh-remote-script-execution · CWE-494
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:51js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:63js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:95js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:121js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:224js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:237js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:274js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:293js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:309js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:326js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:432js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:507js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:624js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:646js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:687js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:713js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:738js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:755js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:781js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:845js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:941js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:973js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:1046js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:1066js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:1089js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:1140js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:1163js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/console/console.js:1185js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/web/public/store.js:55js-unescaped-html-sink · CWE-79
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:103sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:132sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:156sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:166sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:254sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:256sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:421sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:563sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:719sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:915sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:1016sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:1045sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/api.js:1276sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/app.js:170sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/auth.js:113sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/auth.js:139sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/auth.js:172sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/auth.js:212sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/auth.js:227sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/auth.js:229sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/badge.js:160sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/billing.js:32sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/billing.js:47sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/billing.js:106sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/billing.js:107sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/billing.js:114sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/billing.js:143sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/billing.js:144sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/catalog.js:105sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/catalog.js:177sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/catalog.js:178sql-template-interpolation · CWE-89

Showing the first 100 findings.

Badge for your README

ThreatCrush: No malware found

[![ThreatCrush scan](https://w3bs.org/api/packages/pwamart.com/pwamart/badge.svg)](https://w3bs.org/packages/pwamart.com/pwamart)