@buntok/core@2.0.2

Core HTTP framework for Bun — Express-like, bring your own structure

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The only notable dynamic primitive composes framework-provided middleware at runtime. Manifest and entrypoint inspection found no lifecycle hook or concrete malicious chain.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Explicit application use or a user running the buntok CLI.

Impact

No unconsented installation-time execution, data collection, or outbound exfiltration established.

Mechanism

HTTP routing and user-requested project-file generation.

AI rationale

The only notable dynamic primitive composes framework-provided middleware at runtime. Manifest and entrypoint inspection found no lifecycle hook or concrete malicious chain.

Evidence

package.jsondist/core-exports.cjsdist/cli/index.js

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Runtime code generation exists for framework middleware composition.

Evidence against

package.json has no preinstall, install, or postinstall hook.
Code generation only composes registered middleware and route handlers.
The CLI writes scaffolding only after an explicit create command.
No credential harvesting, exfiltration, remote payload loading, or agent-control mutation was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 8 file(s), 719 KB of source, external domains: api.mailgun.net, api.resend.com, api.sendgrid.com, cdn.jsdelivr.net

Source & flagged code

3 flagged

dist/core-exports.cjsView file

Lines 171-211javascript

171 sha512: () => sha512,

172 shortId: () => shortId,

173 slidingWindowRateLimiter: () => slidingWindowRateLimiter,

174 slugify: () => slugify,

175 snakeCase: () => snakeCase,

176 timeAgo: () => timeAgo,

177 timeout: () => timeout,

178 truncate: () => truncate,

179 ulid: () => ulid,

180 uniq: () => uniq,

181 uploader: () => uploader,

182 uuid: () => uuid,

183 validate: () => validate,

184 validateBody: () => validateBody,

185 validateParams: () => validateParams,

186 verifyPassword: () => verifyPassword,

187 z: () => import_zod3.z,

188 zResponse: () => zResponse,

189 zValidator: () => zValidator

190});

191module.exports = __toCommonJS(core_exports_exports);

192var import_zod3 = require("zod");

193

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core-exports.cjsView on unpkg · L191

194// src/app.ts

195var import_node_path2 = require("path");

196var import_zod = require("zod");

197

198// src/container.ts

199function isClassProvider(p) {

200 return "useClass" in p;

201}

202function isValueProvider(p) {

203 return "useValue" in p;

204}

205function isFactoryProvider(p) {

206 return "useFactory" in p;

207}

208var Container = class {

209 // biome-ignore lint/suspicious/noExplicitAny: Internal provider storage

210 providers = /* @__PURE__ */ new Map();

211 // biome-ignore lint/suspicious/noExplicitAny: Cached singleton instances

Lines 1753-1793javascript

1753 }

1754 }

1755 if (h._isBuntokResponse) {

1756 openApiDoc.responses.push({

1757 status: h._status,

1758 schema: h._schema,

1759 description: h._description

1760 });

1761 }

1762 }

1763 this

dist/cli/index.cjsView file

•matchType = normalized_sha256 matchedPackage = @buntok/core@1.0.9 matchedPath = dist/cli/index.cjs matchedIdentity = npm:QGJ1bnRvay9jb3Jl:1.0.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/index.cjsView on unpkg

Source & flagged code

3 flagged · loading source

dist/core-exports.cjsView file

191module.exports = __toCommonJS(core_exports_exports); L192: var import_zod3 = require("zod"); L193:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core-exports.cjsView on unpkg · L191

1773} L1774: const factory = new Function("fns", `return function(ctx) { ${code} }`); L1775: return factory(fns);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/core-exports.cjsView on unpkg · L1773

dist/cli/index.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

Findings

1 High4 Medium5 Low

HighKnown Malware Source Similaritydist/cli/index.cjs

MediumDynamic Requiredist/core-exports.cjs

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowEvaldist/core-exports.cjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @buntok/core@2.0.2.

See all versions of @buntok/core for other recorded verdicts.

Review the evidence and your use of @buntok/core@2.0.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-25 09:51:48.222Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.