Bundle Report

com-tinyspeck-slackmacgap v4.42.121

Bundle risk65medium

Binary-only · L1Live analyzer output · not mock dataAnalyzed just now

v4.42.121build 442000121medium· 65

eb7c1597cc53f738ffe3a192283b9bb5020de983b007ef44297bb294368445b9

Platform: macOS · MACAPP
Bundle size: 416.0 MB
OS range: macOS 11.0 → macOS 11.0+
Architectures: arm64
Permissions: 5

Store review readiness

Will flag at review

14 reviewer-flag items but no auto-rejection causes.

Safe to submit, but the reviewer may ask about the items above. Have answers ready and watch for review delays.

Blocking0

No pre-review rejection causes

None detected

Needs review14

Reviewer may ask

Embedded SDK with known CVE: Electron Framework· electron
Embedded SDK with known CVE: Electron Framework· electron
Embedded SDK with known CVE: Electron Framework· electron
Embedded SDK with known CVE: Electron Framework· electron
Embedded SDK with known CVE: Electron Framework· electron
Embedded SDK with known CVE: Electron Framework· electron
Embedded SDK with known CVE: Electron Framework· electron
Embedded SDK with known CVE: Electron Framework· electron
Embedded SDK with known CVE: Electron Framework· electron
Embedded SDK with known CVE: Electron Framework· electron
Embedded SDK with known CVE: Electron Framework· electron
Embedded SDK with known CVE: Electron Framework· electron
Embedded SDK with known CVE: Electron Framework· electron
Embedded SDK with known CVE: Electron Framework· electron

OK4

What was checked and passed

Required Reason API declarations match binary usage
ATT framework + NSUserTrackingUsageDescription consistent
Build SDK meets Apple's current floor
SDK-collected data types covered by app manifest

18 findings

Embedded SDK with known CVE: Electron FrameworkSDK vulnerability · warning
GHSA-3c8v-cfp5-9885 — Electron: Out-of-bounds read in second-instance IPC on macOS and Linux
component: electron
Embedded SDK with known CVE: Electron FrameworkSDK vulnerability · warning
GHSA-4p4r-m79c-wq3v — Electron: HTTP Response Header Injection in custom protocol handlers and webRequest
component: electron
Embedded SDK with known CVE: Electron FrameworkSDK vulnerability · critical
GHSA-532v-xpq5-8h95 — Electron: Use-after-free in offscreen child window paint callback
component: electron
Embedded SDK with known CVE: Electron FrameworkSDK vulnerability · warning
GHSA-5rqw-r77c-jp79 — Electron: AppleScript injection in app.moveToApplicationsFolder on macOS
component: electron
Embedded SDK with known CVE: Electron FrameworkSDK vulnerability · critical
GHSA-8337-3p73-46f4 — Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks
component: electron
Embedded SDK with known CVE: Electron FrameworkSDK vulnerability · info
GHSA-8x5q-pvf5-64mp — Electron: Use-after-free in offscreen shared texture release() callback
component: electron
Embedded SDK with known CVE: Electron FrameworkSDK vulnerability · info
GHSA-9899-m83m-qhpj — Electron: USB device selection not validated against filtered device list
component: electron
Embedded SDK with known CVE: Electron FrameworkSDK vulnerability · warning
GHSA-9w97-2464-8783 — Electron: Use-after-free in download save dialog callback
component: electron
Embedded SDK with known CVE: Electron FrameworkSDK vulnerability · critical
GHSA-9wfr-w7mm-pc7f — Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference
component: electron
Embedded SDK with known CVE: Electron FrameworkSDK vulnerability · info
GHSA-f37v-82c4-4x64 — Electron: Crash in clipboard.readImage() on malformed clipboard image data
component: electron
Embedded SDK with known CVE: Electron FrameworkSDK vulnerability · warning
GHSA-f3pv-wv63-48x8 — Electron: Named window.open targets not scoped to the opener's browsing context
component: electron
Embedded SDK with known CVE: Electron FrameworkSDK vulnerability · info
GHSA-jfqx-fxh3-c62j — Electron: Unquoted executable path in app.setLoginItemSettings on Windows
component: electron
Embedded SDK with known CVE: Electron FrameworkSDK vulnerability · critical
GHSA-jjp3-mq3x-295m — Electron: Use-after-free in PowerMonitor on Windows and macOS
component: electron
Embedded SDK with known CVE: Electron FrameworkSDK vulnerability · warning
GHSA-mwmh-mq4g-g6gr — Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows
component: electron
Embedded SDK with known CVE: Electron FrameworkSDK vulnerability · warning
GHSA-r5p7-gp4j-qhrx — Electron: Incorrect origin passed to permission request handler for iframe requests
component: electron
Embedded SDK with known CVE: Electron FrameworkSDK vulnerability · warning
GHSA-vmqv-hx8q-j7mg — Electron has ASAR Integrity Bypass via resource modification
component: electron
Embedded SDK with known CVE: Electron FrameworkSDK vulnerability · warning
GHSA-xj5x-m3f3-5x3h — Electron: Service worker can spoof executeJavaScript IPC replies
component: electron
Embedded SDK with known CVE: Electron FrameworkSDK vulnerability · warning
GHSA-xwr5-m59h-vwqr — Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes
component: electron

Want PR-level context for this app?

Connect the GitHub repo for this app to upgrade to L3. You'll get per-PR Check Runs, source-aware risk factors, and root-cause attribution against this exact bundle.

Compare tiers