@buntok/core@2.1.16

⚠ Under review

Blazing-fast, type-safe HTTP framework for Bun - AOT-compiled routing, decorators, Zod validation & IoC

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

WildcardDependency

scanned 56 file(s), 4.72 MB of source, external domains: accounts.google.com, api-m.paypal.com, api-m.sandbox.paypal.com, api.github.com, api.mailgun.net, api.midtrans.com, api.resend.com, api.sandbox.midtrans.com, api.sendgrid.com, api.stripe.com, api.xendit.co, app.midtrans.com, app.sandbox.midtrans.com, appleid.apple.com, evilmartians.com, example.com, github.com, json-schema.org, oauth2.googleapis.com, openapi.vercel.sh, tailwindcss.com, twitter.com, unpkg.com, www.googleapis.com, www.w3.org, www.w3ctech.com

Source & flagged code

8 flagged

dist/cli/index.jsView file

Lines 859-928javascript

859 `\x1B[90m\u2022 src/index.ts: ${controllerName} already registered in ${location}\x1B[0m`

860 );

861 }

862 }

863 console.log(options.dryRun ? "\x1B[33mWould generate:\x1B[0m" : "\x1B[32mGenerated files:\x1B[0m");

864 for (const result of results.sort()) {

865 console.log(` ${result}`);

866 }

867 if (options.dryRun) {

868 console.log(`

869\x1B[33mRun without --dry-run to create these files.\x1B[0m

870`);

871 } else {

872 console.log(`

873\x1B[36mNext steps:\x1B[0m

874 1. Start dev server: \x1B[33mbun run dev\x1B[0m

875`);

876 }

877}

878

879// src/cli/commands/db.ts

880import { execSync } from "node:child_process";

881import { existsSync as existsSync6, readFileSync as readFileSync3 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L879

882import { createInterface } from "node:readline";

883function detectOrm() {

884 if (existsSync6("prisma/schema.prisma") || existsSync6("prisma/schema.ts")) {

885 return "prisma";

886 }

887 if (existsSync6("drizzle.config.ts") || existsSync6("drizzle.config.js")) {

888 return "drizzle";

889 }

890 if (existsSync6("ormconfig.json") || existsSync6("ormconfig.ts") || existsSync6("ormconfig.js")) {

891 return "typeorm";

892 }

893 if (existsSync6("package.json")) {

894 const pkg = JSON.parse(readFileSync3("package.json", "utf-8"));

895 const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };

896 if (allDeps["@prisma/client"] || allDeps["prisma"]) return "prisma";

897 if (allDeps["drizzle-orm"] || allDeps["drizzle-kit"]) return "drizzle";

898 if (allDeps["typeorm"]) return "typeorm";

899 }

900 return null;

901}

902function runCommand(cmd, dryRun = false) {

903 if (dryRun) {

904 console.log(`\x1B[90m[dry-run] Would execute: ${cmd}\x1B[0m`);

905 return;

906 }

907 console.log(`\x1B[90m$ ${cmd}\x1B[0m`);

908 try {

909 execSync(cmd, { stdio: "inherit", cwd: process.cwd() });

910 } catch {

911 process.exitCode = 1;

912 }

913}

914async function confirm(message) {

915 const rl = createInterface({ input: process.stdin, output: process.stdout });

916 return new Promise((resolve5) => {

917 rl.question(`\x1B[33m${message} (y/N): \x1B[0m`, (answer) => {

918 rl.close();

919 resolve5(answer.toLowerCase() === "y" || answer.toLowerCase() === "yes");

920 });

921 });

922}

923function prismaCommand(subcommand, args, dryRun = false) {

924 const cmd = `npx prisma ${subcommand} ${args.join(" ")}`.trim();

925 runCommand(cmd, dryRun);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L908

926}

927function drizzleCommand(subcommand, args, dryRun = false) {

928 const commands = {

dist/chunk-ZS2TKFE6.cjsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-ZS2TKFE6.cjsView on unpkg

24456} L24457: const factory = new Function("fns", `return function(ctx) { ${code} }`); L24458: return factory(fns);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-ZS2TKFE6.cjsView on unpkg · L24456

dist/ws-helpers.cjsView file

Lines 1-22javascript

1"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return

dist/cli/index.cjsView file

Lines 1-40javascript

1#!/usr/bin/env bun

2"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj

dist/cli/templates/favicon.icoView file

•path = dist/cli/templates/favicon.ico kind = high_entropy_blob sizeBytes = 17474 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/cli/templates/favicon.icoView on unpkg

Source & flagged code

8 flagged · loading source

dist/cli/index.jsView file

879// src/cli/commands/db.ts L880: import { execSync } from "node:child_process"; L881: import { existsSync as existsSync6, readFileSync as readFileSync3 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L879

908try { L909: execSync(cmd, { stdio: "inherit", cwd: process.cwd() }); L910: } catch { ... L923: function prismaCommand(subcommand, args, dryRun = false) { L924: const cmd = `npx prisma ${subcommand} ${args.join(" ")}`.trim(); L925: runCommand(cmd, dryRun);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L908

dist/chunk-ZS2TKFE6.cjsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

Findings

1 Critical6 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/cli/index.cjs

HighChild Processdist/cli/index.js

HighShell

HighCross File Remote Execution Contextdist/cli/index.cjs

HighRuntime Package Installdist/cli/index.js

HighShips High Entropy Blobdist/cli/templates/favicon.ico

HighSemantic Analysis Limiteddist/chunk-ZS2TKFE6.cjs

MediumDynamic Requiredist/ws-helpers.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowEvaldist/chunk-ZS2TKFE6.cjs

Affected versions and remediation

This report applies to @buntok/core@2.1.16.

See all versions of @buntok/core for other recorded verdicts.

Review the evidence and your use of @buntok/core@2.1.16 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 11:02:02.267Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.