registry / @buntok/core / 2.0.0
@buntok/core@2.0.0
Core HTTP framework for Bun — Express-like, bring your own structure
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource inspection found a Bun HTTP framework with explicit scaffolding/docs commands and configured mail-provider integrations. The scanner signals map to framework code, not a concrete malicious chain.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Import the framework or explicitly run the buntok CLI.
Impact
No unconsented install-time mutation, credential harvesting, or exfiltration was found.
Mechanism
HTTP framework, project scaffolding, and configured mail delivery.
AI rationale
Source inspection found a Bun HTTP framework with explicit scaffolding/docs commands and configured mail-provider integrations. The scanner signals map to framework code, not a concrete malicious chain.
Evidence
package.jsondist/cli/index.jsdist/core-exports.jsdist/exports.cjs
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- No npm lifecycle hook is declared.
- CLI writes only generated project files after explicit commands.
- Network calls are configured email-provider sends.
- Dynamic Function use compiles framework middleware routing.
Evidence against
- The explicit make:docs command imports the user's src/index.ts, but it is not install- or import-time behavior.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
4 flagged · loading sourcedist/core-exports.cjsView file
191module.exports = __toCommonJS(core_exports_exports);
L192: var import_zod3 = require("zod");
L193:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/core-exports.cjsView on unpkg · L1911773}
L1774: const factory = new Function("fns", `return function(ctx) { ${code} }`);
L1775: return factory(fns);
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/core-exports.cjsView on unpkg · L1773dist/cli/index.cjsView file
•matchType = normalized_sha256
matchedPackage = @buntok/core@1.0.9
matchedPath = dist/cli/index.cjs
matchedIdentity = npm:QGJ1bnRvay9jb3Jl:1.0.9
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
Findings
1 High4 Medium6 Low
HighKnown Malware Source Similaritydist/cli/index.cjs
MediumDynamic Requiredist/core-exports.cjs
MediumNetwork
MediumEnvironment Vars
MediumWildcard Dependency
LowScripts Present
LowEvaldist/core-exports.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencedist/cli/index.js
Affected versions and remediation
This report applies to @buntok/core@2.0.0.
See all versions of @buntok/core for other recorded verdicts.
- Review the evidence and your use of @buntok/core@2.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.