registry / @brightsideoy/kama / 1.0.0-alpha.2

@brightsideoy/kama@1.0.0-alpha.2

⚠ Under review

**[KAMA](https://kamaengine.com) is a schema-driven, headless Content Delivery Platform built to give you infinite edge scalability and total deployment flexibility.**

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 16 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 23 file(s), 4.02 MB of source, external domains: 127.0.0.1, api.cloudflare.com, api.iconify.design, cdn.jsdelivr.net, example.com, json-schema.org, kama.kamaengine.com, kama.t3cloud.eu, prosemirror.net, v3-migration.vuejs.org, vuejs.org, www.w3.org

Source & flagged code

5 flagged

bin/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execSync } from 'node:child_process';

3import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, unlinkSync, appendFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L1

4import { join, dirname, basename, resolve } from 'node:path';

5import { fileURLToPath, pathToFileURL } from 'node:url';

6import * as readline from 'node:readline/promises';

8// 🎯 Always use the absolute newest ecosystem

9const ASTRO_LATEST = "latest";

10const ASTRO_NODE_LATEST = "latest";

11const ASTRO_CF_LATEST = "latest";

12const WRANGLER_LATEST = "latest";

14// Dynamically resolve current package version

15const __filename = fileURLToPath(import.meta.url);

16const __dirname = dirname(__filename);

17let currentKamaVersion = 'alpha';

18try {

19 const pkgPath = join(__dirname, '../package.json');

20 if (existsSync(pkgPath)) {

21 const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.jsView on unpkg · L1

Lines 171-211javascript

171 writeFileSync(

172 join(rootDir, '.gitignore'),

173 `node_modules/\n.env\n.DS_Store\nkama-worker/.dev.vars\nkama-worker/.env\nkama-worker/.wrangler/\nkama-worker/public/\nkama-worker/*.db\nsites/*/.env\nsites/*/.astro/

Lines 458-498javascript

458 const cmsDomainInput = (await rl.question('CMS API Domain (e.g., admin.brand.com): ')).trim();

459 cmsFullUrl = `https://${cmsDomainInput.replace(/^https?:\/\//

dist/assets/index-lXxH3VFK.jsView file

•matchType = normalized_sha256 matchedPackage = @brightsideoy/kama@0.1.0-alpha.114 matchedPath = dist/assets/index-DcFVWhF4.js matchedIdentity = npm:QGJyaWdodHNpZGVveS9rYW1h:0.1.0-alpha.114 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/assets/index-lXxH3VFK.jsView on unpkg

Source & flagged code

5 flagged · loading source

@brightsideoy/kama@1.0.0-alpha.2

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code