registry  /  @astrale-os/sdk  /  0.4.5

@astrale-os/sdk@0.4.5

⚠ Under review

Astrale Remote Domain SDK - Define and deploy domains as standalone Hono servers

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
WildcardDependency
scanned 128 file(s), 440 KB of source, external domains: bun.sh

Source & flagged code

3 flagged · loading source
package.jsonView file
•scripts.preinstall = node -e "try{require('./.check-workspace.cjs')}catch{}"
Critical
Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg
•scripts.preinstall = node -e "try{require('./.check-workspace.cjs')}catch{}"
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
dist/server/start.jsView file
10// bundles (wrangler/esbuild) traverse it even though they never call it. A L11: // literal import() would make them resolve the optional peer and fail. L12: const nodeServerModule = '@hono/node-server';
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/server/start.jsView on unpkg · L10

Findings

1 Critical1 High5 Medium4 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
MediumDynamic Requiredist/server/start.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings