w3bs.AccountStart building
PACKAGES / Profullstack

smshub

CLI, TUI and MCP server for renting a phone number and receiving SMS verification codes.

ThreatCrush · No malware found
INSTALLw3bs install smshub.dev/smshub

No w3bs yet? curl -fsSL https://w3bs.org/install.sh | sh

Get started

What to type once it is installed.

  1. w3bs install smshub.dev/smshubInstall smshub and track it for updates
  2. smshub-cli login --key <api-key>Save your smshub.dev API key from Settings > API Keys
  3. smshub-cli rent --area <area-code>Rent a US number; prints a CoinPay link and waits for payment
  4. smshub-cli numbersList your numbers with their expiry dates
  5. smshub-cli otp <number> --wait 60Print the next verification code the number receives

Every option: smshub-cli --help · docs ↗

Malware scan

ThreatCrush found no malware indicators in smshub 1.11.0. The other findings below are ordinary code-review notes, not malware.

Scanned
2026-11-01 22:56 UTC · threatcrush 0.13.30
Files
431 (installer + github.com/profullstack/smshub)
Findings
2 high · 4 medium · 8 low
14 other findings (not malware)
  • high
    unquoted expansion in a destructive commandsource/public/install.sh:67sh-unquoted-expansion-destructive · CWE-78
  • high
    network output piped into a shellsource/public/install.sh:89sh-remote-script-execution · CWE-494
  • medium
    network output piped into a shellsource/public/install.sh:133sh-remote-script-execution · CWE-494
  • medium
    redirect to a non-constant destinationsource/src/app/numbers/page.tsx:180js-open-redirect · CWE-601
  • medium
    redirect to a non-constant destinationsource/src/components/inbox-client.tsx:35js-open-redirect · CWE-601
  • medium
    unescaped HTML renderingsource/src/components/pit-footer.tsx:17js-unescaped-html-sink · CWE-79
  • low
    Hardcoded Credentialsource/src/lib/providers/__tests__/twilio.test.ts:24secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/providers/__tests__/twilio.test.ts:46secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/providers/__tests__/twilio.test.ts:60secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/providers/__tests__/twilio.test.ts:78secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/vault/__tests__/vault.test.ts:117secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/webhooks/__tests__/supabase-store.test.ts:11secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/supabase/config.toml:287secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/supabase/config.toml:319secret-generic-credential · CWE-798

Badge for your README

ThreatCrush: No malware found

[![ThreatCrush scan](https://w3bs.org/api/packages/smshub.dev/smshub/badge.svg)](https://w3bs.org/packages/smshub.dev/smshub)