@buntok/core@2.0.1

Core HTTP framework for Bun — Express-like, bring your own structure

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Source inspection found ordinary framework functionality and user-invoked CLI generation, without an install-time or stealthy malicious chain. The flagged dynamic code and networking are constrained to router optimization and configured application features.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Importing the framework or explicitly running the buntok CLI.

Impact

Normal application routing, optional project scaffolding, and caller-configured email sending.

Mechanism

HTTP framework, code generator, and configured mail delivery.

AI rationale

Evidence

package.jsondist/core-exports.cjsdist/cli/index.cjsdist/exports.cjs

Network endpoints3

api.resend.com/emailsapi.sendgrid.com/v3/mail/sendapi.mailgun.net

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json has no npm lifecycle hook; it declares library exports and a CLI bin.
Dynamic Function construction compiles registered middleware/router handlers, not downloaded code.
CLI writes project scaffolding only after explicit create or make:docs commands.
Network calls are configured mail-provider sends using caller-supplied message and API configuration.

Evidence against

No credential harvesting, shell execution, remote payload loading, persistence, or AI-agent configuration writes found.
No install-time execution path is declared.
The CLI’s dynamic import is limited to the user’s local src/index.ts during explicit documentation generation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

5 flagged

dist/core-exports.cjsView file

Lines 171-211javascript

171 sha512: () => sha512,

172 shortId: () => shortId,

173 slidingWindowRateLimiter: () => slidingWindowRateLimiter,

174 slugify: () => slugify,

175 snakeCase: () => snakeCase,

176 timeAgo: () => timeAgo,

177 timeout: () => timeout,

178 truncate: () => truncate,

179 ulid: () => ulid,

180 uniq: () => uniq,

181 uploader: () => uploader,

182 uuid: () => uuid,

183 validate: () => validate,

184 validateBody: () => validateBody,

185 validateParams: () => validateParams,

186 verifyPassword: () => verifyPassword,

187 z: () => import_zod3.z,

188 zResponse: () => zResponse,

189 zValidator: () => zValidator

190});

191module.exports = __toCommonJS(core_exports_exports);

192var import_zod3 = require("zod");

193

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core-exports.cjsView on unpkg · L191

194// src/app.ts

195var import_node_path2 = require("path");

196var import_zod = require("zod");

197

198// src/container.ts

199function isClassProvider(p) {

200 return "useClass" in p;

201}

202function isValueProvider(p) {

203 return "useValue" in p;

204}

205function isFactoryProvider(p) {

206 return "useFactory" in p;

207}

208var Container = class {

209 // biome-ignore lint/suspicious/noExplicitAny: Internal provider storage

210 providers = /* @__PURE__ */ new Map();

211 // biome-ignore lint/suspicious/noExplicitAny: Cached singleton instances

Lines 1753-1793javascript

1753 }

1754 }

1755 if (h._isBuntokResponse) {

1756 openApiDoc.responses.push({

1757 status: h._status,

1758 schema: h._schema,

1759 description: h._description

1760 });

1761 }

1762 }

1763 this

dist/cli/index.cjsView file

Lines 491-531javascript

491function printUsage() {

492 console.log(`

493\x1B[36mUsage:\x1B[0m

494 buntok <command> [arguments] [options]

495

496\x1B[36mCommands:\x1B[0m

497 create <entity> Generate all files for entity (repo, service, controller)

package.jsonView file

Lines 1-25json

2 "name": "@buntok/core",

3 "version": "2.0.1",

4 "description": "Core HTTP framework for Bun — Express-like, bring your own structure",

5 "module": "dist/core-exports.js",

Source & flagged code

5 flagged · loading source

dist/core-exports.cjsView file

191module.exports = __toCommonJS(core_exports_exports); L192: var import_zod3 = require("zod"); L193:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core-exports.cjsView on unpkg · L191

1773} L1774: const factory = new Function("fns", `return function(ctx) { ${code} }`); L1775: return factory(fns);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/core-exports.cjsView on unpkg · L1773

dist/cli/index.cjsView file

•matchType = normalized_sha256 matchedPackage = @buntok/core@1.0.9 matchedPath = dist/cli/index.cjs matchedIdentity = npm:QGJ1bnRvay9jb3Jl:1.0.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

Findings

1 High4 Medium7 Low

HighKnown Malware Source Similaritydist/cli/index.cjs

MediumDynamic Requiredist/core-exports.cjs

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowEvaldist/core-exports.cjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/cli/index.cjs

Affected versions and remediation

This report applies to @buntok/core@2.0.1.

See all versions of @buntok/core for other recorded verdicts.

Review the evidence and your use of @buntok/core@2.0.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-25 09:51:35.454Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.