@buntok/core@2.1.14

Core HTTP framework for Bun, bring your own structure

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

WildcardDependency

scanned 45 file(s), 2.76 MB of source, external domains: accounts.google.com, api-m.paypal.com, api-m.sandbox.paypal.com, api.github.com, api.mailgun.net, api.midtrans.com, api.resend.com, api.sandbox.midtrans.com, api.sendgrid.com, api.xendit.co, app.midtrans.com, app.sandbox.midtrans.com, appleid.apple.com, example.com, github.com, json-schema.org, mths.be, oauth2.googleapis.com, tailwindcss.com, twitter.com, unpkg.com, www.googleapis.com, www.w3.org

Source & flagged code

6 flagged

dist/cli/index.jsView file

Lines 382-446javascript

382 `\x1B[90m\u2022 src/index.ts: ${pascalName} already registered\x1B[0m`

383 );

384 }

385 }

386 console.log(options.dryRun ? "\x1B[33mWould generate:\x1B[0m" : "\x1B[32mGenerated files:\x1B[0m");

387 for (const result of results.sort()) {

388 console.log(` ${result}`);

389 }

390 if (options.dryRun) {

391 console.log(`

392\x1B[33mRun without --dry-run to create these files.\x1B[0m

393`);

394 } else {

395 console.log(`

396\x1B[36mNext steps:\x1B[0m

397 1. Start dev server: \x1B[33mbun run dev\x1B[0m

398`);

399 }

400}

401

402// src/cli/commands/db.ts

403import { execSync } from "node:child_process";

404import { existsSync as existsSync4, readFileSync as readFileSync2 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L402

405function detectOrm() {

406 if (existsSync4("prisma/schema.prisma") || existsSync4("prisma/schema.ts")) {

407 return "prisma";

408 }

409 if (existsSync4("drizzle.config.ts") || existsSync4("drizzle.config.js")) {

410 return "drizzle";

411 }

412 if (existsSync4("ormconfig.json") || existsSync4("ormconfig.ts") || existsSync4("ormconfig.js")) {

413 return "typeorm";

414 }

415 if (existsSync4("package.json")) {

416 const pkg = JSON.parse(readFileSync2("package.json", "utf-8"));

417 const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };

418 if (allDeps["@prisma/client"] || allDeps["prisma"]) return "prisma";

419 if (allDeps["drizzle-orm"] || allDeps["drizzle-kit"]) return "drizzle";

420 if (allDeps["typeorm"]) return "typeorm";

421 }

422 return null;

423}

424function runCommand(cmd) {

425 console.log(`\x1B[90m$ ${cmd}\x1B[0m`);

426 try {

427 execSync(cmd, { stdio: "inherit", cwd: process.cwd() });

428 } catch {

429 process.exitCode = 1;

430 }

431}

432function prismaCommand(subcommand, args) {

433 const cmd = `npx prisma ${subcommand} ${args.join(" ")}`.trim();

434 runCommand(cmd);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L426

435}

436function drizzleCommand(subcommand, args) {

437 const commands = {

438 migrate: "drizzle-kit generate",

439 seed: "drizzle-kit seed",

440 reset: "drizzle-kit drop",

441 status: "drizzle-kit check",

442 generate: "drizzle-kit generate",

443 studio: "drizzle-kit studio"

444 };

445 const cmd = `${commands[subcommand] ?? subcommand} ${args.join(" ")}`.trim();

446 runCommand(cmd);

dist/chunk-2UDCVPSZ.cjsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-2UDCVPSZ.cjsView on unpkg

22417} L22418: const factory = new Function("fns", `return function(ctx) { ${code} }`); L22419: return factory(fns);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-2UDCVPSZ.cjsView on unpkg · L22417

dist/core-exports.cjsView file

Lines 208-248javascript

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

dist/cli/index.cjsView file

Lines 1-37javascript

1#!/usr/bin/env bun

2"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj

Source & flagged code

6 flagged · loading source

dist/cli/index.jsView file

402// src/cli/commands/db.ts L403: import { execSync } from "node:child_process"; L404: import { existsSync as existsSync4, readFileSync as readFileSync2 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L402

426try { L427: execSync(cmd, { stdio: "inherit", cwd: process.cwd() }); L428: } catch { ... L432: function prismaCommand(subcommand, args) { L433: const cmd = `npx prisma ${subcommand} ${args.join(" ")}`.trim(); L434: runCommand(cmd);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L426

dist/chunk-2UDCVPSZ.cjsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

Findings

5 High5 Medium5 Low

HighChild Processdist/cli/index.js

HighShell

HighCross File Remote Execution Contextdist/cli/index.cjs

HighRuntime Package Installdist/cli/index.js

HighSemantic Analysis Limiteddist/chunk-2UDCVPSZ.cjs

MediumDynamic Requiredist/core-exports.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowEvaldist/chunk-2UDCVPSZ.cjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @buntok/core@2.1.14.

See all versions of @buntok/core for other recorded verdicts.

Review the evidence and your use of @buntok/core@2.1.14 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-08 14:12:39.862Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.