registry / @brightsideoy/kama / 1.0.0-alpha.5

@brightsideoy/kama@1.0.0-alpha.5

⚠ Under review

**[KAMA](https://kamaengine.com) is a schema-driven, headless Content Delivery Platform built to give you infinite edge scalability and total deployment flexibility.**

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 17 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 23 file(s), 4.03 MB of source, external domains: 127.0.0.1, api.cloudflare.com, api.iconify.design, cdn.jsdelivr.net, example.com, json-schema.org, kama.kamaengine.com, kama.t3cloud.eu, prosemirror.net, v3-migration.vuejs.org, vuejs.org, www.w3.org

Source & flagged code

6 flagged

bin/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execSync } from 'node:child_process';

3import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, unlinkSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L1

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.jsView on unpkg · L1

4import { join, dirname, basename, resolve } from 'node:path';

5import { fileURLToPath, pathToFileURL } from 'node:url';

7// 🎯 Modern CLI UI Components

8import { intro, outro, text, select, confirm, spinner, note, isCancel, cancel } from '@clack/prompts';

10// --- UI HELPERS (Zero Dependency Colors) ---

11const pc = {

12 green: (t) => `\x1b[32m${t}\x1b[0m`,

13 cyan: (t) => `\x1b[36m${t}\x1b[0m`,

14 dim: (t) => `\x1b[2m${t}\x1b[0m`,

15 yellow: (t) => `\x1b[33m${t}\x1b[0m`,

16 red: (t) => `\x1b[31m${t}\x1b[0m`,

17 bgCyan: (t) => `\x1b[46m\x1b[30m ${t} \x1b[0m`,

18 bold: (t) => `\x1b[1m${t}\x1b[0m`,

19 reset: '\x1b[0m'

20};

Lines 32-72javascript

32const ASTRO_LATEST = "latest";

33const ASTRO_NODE_LATEST = "latest";

34const ASTRO_CF_LATEST = "latest";

35const WRANGLER_LATEST =

Lines 503-543javascript

503 const s = spinner();

504 s.start(`Generating Astro site...`);

505 await generateAstroSite(rootDir, siteFolder, siteDomain, cmsFullUrl, targetWorkerName, isCloudflare);

506 s.stop(`Site created in sites/${siteFolder}!`);

npm-update.shView file

•path = npm-update.sh kind = build_helper sizeBytes = 1957 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

npm-update.shView on unpkg

dist/assets/index-DG2Asvtk.jsView file

•matchType = normalized_sha256 matchedPackage = @brightsideoy/kama@0.1.0-alpha.114 matchedPath = dist/assets/index-DcFVWhF4.js matchedIdentity = npm:QGJyaWdodHNpZGVveS9rYW1h:0.1.0-alpha.114 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/assets/index-DG2Asvtk.jsView on unpkg

Source & flagged code

6 flagged · loading source

@brightsideoy/kama@1.0.0-alpha.5

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code