registry / @brightsideoy/kama / 1.0.0-alpha.3

@brightsideoy/kama@1.0.0-alpha.3

⚠ Under review

**[KAMA](https://kamaengine.com) is a schema-driven, headless Content Delivery Platform built to give you infinite edge scalability and total deployment flexibility.**

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 17 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 23 file(s), 4.03 MB of source, external domains: 127.0.0.1, api.cloudflare.com, api.iconify.design, cdn.jsdelivr.net, example.com, json-schema.org, kama.kamaengine.com, kama.t3cloud.eu, prosemirror.net, v3-migration.vuejs.org, vuejs.org, www.w3.org

Source & flagged code

6 flagged

bin/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execSync } from 'node:child_process';

3import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, unlinkSync, appendFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L1

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.jsView on unpkg · L1

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/cli.jsView on unpkg · L1

4import { join, dirname, basename, resolve } from 'node:path';

5import { fileURLToPath, pathToFileURL } from 'node:url';

7// 🎯 Modern CLI UI Components

8import { intro, outro, text, select, confirm, spinner, note, isCancel, cancel } from '@clack/prompts';

10// --- UI HELPERS (Zero Dependency Colors) ---

11const pc = {

12 green: (t) => `\x1b[32m${t}\x1b[0m`,

13 cyan: (t) => `\x1b[36m${t}\x1b[0m`,

14 dim: (t) => `\x1b[2m${t}\x1b[0m`,

15 yellow: (t) => `\x1b[33m${t}\x1b[0m`,

16 red: (t) => `\x1b[31m${t}\x1b[0m`,

17 bgCyan: (t) => `\x1b[46m\x1b[30m ${t} \x1b[0m`,

18 bold: (t) => `\x1b[1m${t}\x1b[0m`,

19 reset: '\x1b[0m'

20};

Lines 209-249javascript

209 if (!isCurrentDir) {

210 mkdirSync(rootDir, { recursive: true });

211 }

212

213 writeFileSync(

214 join(rootDir, '.gitignore'),

215 `node_modules/\n.env

Lines 507-547javascript

507 const s = spinner();

508 s.start(`Generating Astro site...`);

509 await generateAstroSite(rootDir, siteFolder, siteDomain, cmsFullUrl, targetWorkerName, isCloudflare);

510 s.stop(`Site created in sites/${siteFolder}!`);

dist/assets/index-DhguVxzs.jsView file

•matchType = normalized_sha256 matchedPackage = @brightsideoy/kama@0.1.0-alpha.114 matchedPath = dist/assets/index-DcFVWhF4.js matchedIdentity = npm:QGJyaWdodHNpZGVveS9rYW1h:0.1.0-alpha.114 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/assets/index-DhguVxzs.jsView on unpkg

Source & flagged code

6 flagged · loading source

bin/cli.jsView file

1#!/usr/bin/env node L2: import { execSync } from 'node:child_process'; L3: import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, unlinkSync, appendFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L1

1Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L1: #!/usr/bin/env node L2: import { execSync } from 'node:child_process'; L3: import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, unlinkSync, appendFileSync } from 'node:fs'; ... L38: const __filename = fileURLToPath(import.meta.url); L39: const __dirname = dirname(__filename); L40: let currentKamaVersion = 'alpha'; L41: try { L42: const pkgPath = join(__dirname, '../package.json'); L43: if (existsSync(pkgPath)) { L44: const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8')); L45: if (pkg.version) currentKamaVersion = `^${pkg.version}`; ... L135: .replace("import node from '@astrojs/node';", "import cloudfl

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.jsView on unpkg · L1

1Cross-file remote execution chain: bin/cli.js spawns dist/index.js; helper contains network access plus dynamic code execution. L1: #!/usr/bin/env node L2: import { execSync } from 'node:child_process'; L3: import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, unlinkSync, appendFileSync } from 'node:fs'; ... L38: const __filename = fileURLToPath(import.meta.url); L39: const __dirname = dirname(__filename); L40: let currentKamaVersion = 'alpha'; L41: try { L42: const pkgPath = join(__dirname, '../package.json'); L43: if (existsSync(pkgPath)) { L44: const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8')); L45: if (pkg.version) currentKamaVersion = `^${pkg.version}`; ... L135: .replace("import node from '@astrojs/node';", "import cloudflare from '@astrojs/cloudflare

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/cli.jsView on unpkg · L1

229try { L230: execSync('npx wrangler whoami', { stdio: 'ignore' }); L231: isAuthenticated = true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L229

527if (!existsSync(compilerPath)) compilerPath = join(__dirname, '../scripts/schema-compiler.ts'); L528: await import(pathToFileURL(compilerPath).href); L529: if (!silent) s.stop('Schemas bundled successfully.');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L527

dist/assets/index-DhguVxzs.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/assets/index-DhguVxzs.jsView on unpkg

Findings

6 High4 Medium7 Low

HighChild Processbin/cli.js

HighShell

HighEntrypoint Build Divergencebin/cli.js

HighCross File Remote Execution Contextbin/cli.js

HighRuntime Package Installbin/cli.js

HighKnown Malware Source Similaritydist/assets/index-DhguVxzs.js

MediumDynamic Requirebin/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @brightsideoy/kama@1.0.0-alpha.3.

See version security history for other recorded verdicts.

Review the evidence and your use of @brightsideoy/kama@1.0.0-alpha.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-30 03:45:54.939Z (UTC).