registry / @brightsideoy/kama / 0.1.0-alpha.137

@brightsideoy/kama@0.1.0-alpha.137

⚠ Under review

Outdated version. Please upgrade to the latest release.

**KAMA is a schema-driven, headless Content Delivery Platform built to give you infinite edge scalability and total deployment flexibility.**

Static Scan Results

scanned 23d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 21 file(s), 718 KB of source, external domains: api.cloudflare.com, example.com, kama.t3cloud.eu, vuejs.org, www.w3.org

Oversized source lightweight scan

dist/assets/index-bu1Tuvdh.js2.29 MB file, sampled 256 KB

NetworkMinifiedUrlStringsexample.comvuejs.orgwww.w3.org

Source & flagged code

5 flagged

bin/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execSync } from 'node:child_process';

3import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, unlinkSync, statSync, appendFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L1

4import { join, dirname, basename, relative, resolve } from 'node:path';

5import { fileURLToPath } from 'node:url';

6import * as readline from 'node:readline/promises';

8// Dynamically resolve current package version

9const __filename = fileURLToPath(import.meta.url);

10const __dirname = dirname(__filename);

11let currentKamaVersion = 'alpha';

12try {

13 const pkgPath = join(__dirname, '../package.json');

14 if (existsSync(pkgPath)) {

15 const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));

16 if (pkg.version) currentKamaVersion = `^${pkg.version}`;

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.jsView on unpkg · L1

17 }

18} catch (e) {

19 console.warn("⚠️ Could not detect Kama version, defaulting to 'alpha'");

20}

Lines 160-200javascript

160sites/*/.astro/

161sites/*/dist/

162kama-worker/workspace-schemas.js

163`

164 );

165

166 console.log(`\n📄 Copying default content definitions...`);

167 const sourceDefsDir = join(__dirname, '../content/definitions');

•matchType = previous_version_dangerous_delta matchedPackage = @brightsideoy/kama@0.1.0-alpha.121 matchedIdentity = npm:QGJyaWdodHNpZGVveS9rYW1h:0.1.0-alpha.121 similarity = 0.864 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.jsView on unpkg

dist/assets/index-bu1Tuvdh.jsView file

•matchType = normalized_sha256 matchedPackage = @brightsideoy/kama@0.1.0-alpha.114 matchedPath = dist/assets/index-DcFVWhF4.js matchedIdentity = npm:QGJyaWdodHNpZGVveS9rYW1h:0.1.0-alpha.114 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/assets/index-bu1Tuvdh.jsView on unpkg

Source & flagged code

5 flagged · loading source

bin/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.jsView on unpkg

1#!/usr/bin/env node L2: import { execSync } from 'node:child_process'; L3: import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, unlinkSync, statSync, appendFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L1

1Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: sensitive-file+network, execution+network L1: #!/usr/bin/env node L2: import { execSync } from 'node:child_process'; L3: import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, unlinkSync, statSync, appendFileSync } from 'node:fs'; ... L9: const __filename = fileURLToPath(import.meta.url); L10: const __dirname = dirname(__filename); L11: let currentKamaVersion = 'alpha'; L12: try { L13: const pkgPath = join(__dirname, '../package.json'); L14: if (existsSync(pkgPath)) { L15: const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8')); L16: if (pkg.version) currentKamaVersion = `^${pkg.version}`; ... L23: input: process.stdin,

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.jsView on unpkg · L1

180try { L181: execSync('npx wrangler whoami', { stdio: 'pipe' }); L182: isAuthenticated = true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L180

dist/assets/index-bu1Tuvdh.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/assets/index-bu1Tuvdh.jsView on unpkg

Findings

1 Critical5 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltabin/cli.js

HighChild Processbin/cli.js

HighShell

HighEntrypoint Build Divergencebin/cli.js

HighRuntime Package Installbin/cli.js

HighKnown Malware Source Similaritydist/assets/index-bu1Tuvdh.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @brightsideoy/kama@0.1.0-alpha.137.

See version security history for other recorded verdicts.

Review the evidence and your use of @brightsideoy/kama@0.1.0-alpha.137 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-15 20:14:20.645Z (UTC).