w3bs.AccountStart building
PACKAGES / Profullstack

r4ck

r4ck.dev from the terminal and for agents: search hosting offers by spec, price and place, and bridge the same tools into any MCP client.

ThreatCrush · No malware found
INSTALLw3bs install r4ck.dev/r4ck

No w3bs yet? curl -fsSL https://w3bs.org/install.sh | sh

Get started

What to type once it is installed.

  1. w3bs install r4ck.dev/r4ckInstall r4ck and track it for updates
  2. r4ck search "2 vcpu 4gb under $10 in eu"Search every VPS, cloud, bare metal, GPU and PaaS offer
  3. r4ck cheapest --min-vcpu 4 --min-ram 8 --has api,cliFind the cheapest offer that fits
  4. r4ck compare 120 344 902Compare offers side by side
  5. r4ck providers --has cli --country DEList providers by feature and country
  6. claude mcp add r4ck -- r4ck mcpBridge every r4ck tool into Claude Code

Every option: r4ck --help · docs ↗

Malware scan

ThreatCrush found no malware indicators in r4ck 0.3.0. The other findings below are ordinary code-review notes, not malware.

Scanned
2026-11-01 22:56 UTC · threatcrush 0.13.30
Files
109 (installer + github.com/profullstack/r4ck.dev)
Findings
1 critical · 6 high · 27 medium · 15 low
49 other findings (not malware)
  • critical
    SQL built from a template literal or f-stringsource/apps/web/src/routes/pages.js:301sql-template-interpolation · CWE-89
  • high
    Database URL with credentialssource/.env.example:2secret-database-url · CWE-798
  • high
    Database URL with credentialssource/.github/workflows/ci.yml:24secret-database-url · CWE-798
  • high
    Database URL with credentialssource/docker-compose.yml:7secret-database-url · CWE-798
  • high
    Database URL with credentialssource/packages/config/src/index.js:32secret-database-url · CWE-798
  • high
    TLS certificate verification disabledsource/packages/db/src/index.js:16tls-verification-disabled · CWE-295
  • high
    outbound request to a non-constant URLsource/scripts/refresh-snapshot.py:9py-ssrf-outbound-request · CWE-918
  • medium
    unescaped HTML renderingsource/apps/web/public/app.js:100js-unescaped-html-sink · CWE-79
  • medium
    regular expression compiled from a variablesource/apps/web/src/lib/gate.js:68js-regex-from-input · CWE-1333
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/lib/webhooks.js:151sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/apps/web/src/lib/webhooks.js:152sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/auth/src/api-keys.js:40sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/auth/src/api-keys.js:45sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/auth/src/api-keys.js:50sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/auth/src/api-keys.js:68sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/db/src/accounts.js:20sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/db/src/accounts.js:97sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/db/src/accounts.js:103sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/db/src/accounts.js:104sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/db/src/accounts.js:108sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/db/src/accounts.js:113sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/db/src/accounts.js:117sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/db/src/accounts.js:121sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/db/src/accounts.js:158sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/db/src/accounts.js:164sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/db/src/accounts.js:195sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/db/src/accounts.js:211sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/db/src/accounts.js:296sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/db/src/accounts.js:308sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/db/src/catalog.js:54sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/db/src/catalog.js:130sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/db/src/catalog.js:279sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/db/src/migrate.js:35sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/db/src/search.js:118sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/test/credits.test.js:51sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/test/credits.test.js:54sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/test/credits.test.js:58sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/test/credits.test.js:59sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/test/credits.test.js:60sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/test/credits.test.js:61sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/test/credits.test.js:62sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/test/credits.test.js:63sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/test/credits.test.js:64sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/test/credits.test.js:67sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/test/credits.test.js:146sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/test/credits.test.js:239sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/test/credits.test.js:272sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/test/webhooks.test.js:67sql-template-interpolation · CWE-89
  • low
    Hardcoded Credentialsource/test/webhooks.test.js:150secret-generic-credential · CWE-798

Badge for your README

ThreatCrush: No malware found

[![ThreatCrush scan](https://w3bs.org/api/packages/r4ck.dev/r4ck/badge.svg)](https://w3bs.org/packages/r4ck.dev/r4ck)