registry / AI-agent capability abuse / @buntok/core / 2.1.0

@buntok/core@2.1.0

Core HTTP framework for Bun, bring your own structure

AI Security Review

scanned 22d ago · by lpm-firewall-ai

Source establishes user-invoked agent configuration mutation without an automatic install hook. No separate concrete malicious behavior was established, so the appropriate result is a capability warning.

Static reason

One or more suspicious static signals were detected.

Trigger

The user runs buntok init.

Impact

Adds or replaces guidance available to project AI agents; the explicit command gate limits this to user-invoked setup.

Mechanism

The CLI copies its bundled skill into the current project's agent skills directory without checking whether the destination file already exists.

AI rationale

Evidence

dist/cli/index.js.agents/skills/buntok-skill/SKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json has no automatic install lifecycle hooks.
The CLI writes a bundled skill into .agents/skills/buntok-skill/SKILL.md, overwriting any existing file.
Initialization uses the current project directory and invokes the skill copy.
The skill mutation is activated by the explicit init command.

Evidence against

No concrete exfiltration, covert execution, or malicious intent was established in the inspected source.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 8 file(s), 820 KB of source, external domains: api.mailgun.net, api.resend.com, api.sendgrid.com, biomejs.dev, cdn.jsdelivr.net

Source & flagged code

4 flagged

dist/cli/index.jsView file

Lines 287-351javascript

287 );

288 if (biomeProc.exitCode === 0) {

289 console.log(

290 "\x1B[90m\u2728 Auto-formatted generated files with Biome\x1B[0m\n"

291 );

292 }

293 }

294 console.log("\x1B[32mGenerated files:\x1B[0m");

295 for (const result of results.sort()) {

296 console.log(` ${result}`);

297 }

298 console.log(`

299\x1B[36mNext steps:\x1B[0m

300 1. Register your controller in src/index.ts:

301 \x1B[32mimport { ${pascalName}Controller } from "./controllers/${entityName}.controller";\x1B[0m

302 \x1B[32mapp.registerController(${pascalName}Controller);\x1B[0m

303 2. Start dev server: \x1B[33mbun run dev\x1B[0m

304`);

305}

306

307// src/cli/commands/db.ts

308import { execSync } from "child_process";

309import { existsSync as existsSync2, readFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L307

310function detectOrm() {

311 if (existsSync2("prisma/schema.prisma") || existsSync2("prisma/schema.ts")) {

312 return "prisma";

313 }

314 if (existsSync2("drizzle.config.ts") || existsSync2("drizzle.config.js")) {

315 return "drizzle";

316 }

317 if (existsSync2("ormconfig.json") || existsSync2("ormconfig.ts") || existsSync2("ormconfig.js")) {

318 return "typeorm";

319 }

320 if (existsSync2("package.json")) {

321 const pkg = JSON.parse(readFileSync("package.json", "utf-8"));

322 const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };

323 if (allDeps["@prisma/client"] || allDeps["prisma"]) return "prisma";

324 if (allDeps["drizzle-orm"] || allDeps["drizzle-kit"]) return "drizzle";

325 if (allDeps["typeorm"]) return "typeorm";

326 }

327 return null;

328}

329function runCommand(cmd) {

330 console.log(`\x1B[90m$ ${cmd}\x1B[0m`);

331 try {

332 execSync(cmd, { stdio: "inherit", cwd: process.cwd() });

333 } catch {

334 process.exitCode = 1;

335 }

336}

337function prismaCommand(subcommand, args) {

338 const cmd = `npx prisma ${subcommand} ${args.join(" ")}`.trim();

339 runCommand(cmd);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L331

340}

341function drizzleCommand(subcommand, args) {

342 const commands = {

343 migrate: "drizzle-kit generate",

344 seed: "drizzle-kit seed",

345 reset: "drizzle-kit drop",

346 status: "drizzle-kit check",

347 generate: "drizzle-kit generate",

348 studio: "drizzle-kit studio"

349 };

350 const cmd = `${commands[subcommand] ?? subcommand} ${args.join(" ")}`.trim();

351 runCommand(cmd);

dist/core-exports.cjsView file

Lines 187-227javascript

187 slidingWindowRateLimiter: () => slidingWindowRateLimiter,

188 slugify: () => slugify,

189 snakeCase: () => snakeCase,

190 timeAgo: () => timeAgo,

191 timeout

Source & flagged code

4 flagged · loading source

dist/cli/index.jsView file

307// src/cli/commands/db.ts L308: import { execSync } from "child_process"; L309: import { existsSync as existsSync2, readFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L307

331try { L332: execSync(cmd, { stdio: "inherit", cwd: process.cwd() }); L333: } catch { ... L337: function prismaCommand(subcommand, args) { L338: const cmd = `npx prisma ${subcommand} ${args.join(" ")}`.trim(); L339: runCommand(cmd);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L331

dist/core-exports.cjsView file

207module.exports = __toCommonJS(core_exports_exports); L208: var import_zod3 = require("zod"); L209:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

Findings

3 High5 Medium5 Low

HighChild Processdist/cli/index.js

HighShell

HighRuntime Package Installdist/cli/index.js

MediumDynamic Requiredist/core-exports.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowEvaldist/core-exports.cjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @buntok/core@2.1.0.

See all versions of @buntok/core for other recorded verdicts.

Review the evidence and your use of @buntok/core@2.1.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-01 03:40:55.493Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.