registry / @aikdna/kdna-cli / 0.30.0

@aikdna/kdna-cli@0.30.0

KDNA CLI — runtime control plane for inspecting, validating, planning, packing, unpacking, and loading local .kdna assets.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 66 file(s), 833 KB of source, external domains: api.anthropic.com, api.openai.com, github.com, raw.githubusercontent.com

Source & flagged code

2 flagged

schema/trace-validator.jsView file

Lines 1-21javascript

1const fs = require('node:fs');

2const path = require('node:path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

schema/trace-validator.jsView on unpkg · L1

4let _schema = null;

6function loadSchema() {

7 if (_schema) return _schema;

8 const schemaPath = path.join(__dirname, '..', 'schema', 'trace-v1.schema.json');

9 _schema = JSON.parse(fs.readFileSync(schemaPath, 'utf8'));

10 return _schema;

11}

13function validateTrace(trace) {

14 const errors = [];

16 if (!trace || typeof trace !== 'object') {

17 return { valid: false, errors: ['trace must be an object'] };

18 }

20 if (trace.kdna_trace !== '1.0.0') {

21 errors.push('kdna_trace must be "1.0.0"');

src/install.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @aikdna/kdna-cli@0.28.33 matchedIdentity = npm:QGFpa2RuYS9rZG5hLWNsaQ:0.28.33 similarity = 0.528 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/install.jsView on unpkg

Source & flagged code

2 flagged · loading source

schema/trace-validator.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code