@buntok/core@2.1.5

⚠ Under review

Core HTTP framework for Bun, bring your own structure

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

WildcardDependency

scanned 9 file(s), 1.75 MB of source, external domains: accounts.google.com, api.github.com, api.mailgun.net, api.resend.com, api.sendgrid.com, appleid.apple.com, github.com, mths.be, oauth2.googleapis.com, tailwindcss.com, twitter.com, www.googleapis.com

Source & flagged code

5 flagged

dist/cli/index.jsView file

Lines 303-367javascript

303 await fs.writeFile(indexPath, updatedContent);

304 console.log(

305 `\x1B[32m\u2714 Registered ${pascalName} in src/index.ts\x1B[0m`

306 );

307 } else {

308 console.log(

309 `\x1B[90m\u2022 src/index.ts: ${pascalName} already registered\x1B[0m`

310 );

311 }

312 }

313 console.log("\x1B[32mGenerated files:\x1B[0m");

314 for (const result of results.sort()) {

315 console.log(` ${result}`);

316 }

317 console.log(`

318\x1B[36mNext steps:\x1B[0m

319 1. Start dev server: \x1B[33mbun run dev\x1B[0m

320`);

321}

322

323// src/cli/commands/db.ts

324import { execSync } from "child_process";

325import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L323

326function detectOrm() {

327 if (existsSync3("prisma/schema.prisma") || existsSync3("prisma/schema.ts")) {

328 return "prisma";

329 }

330 if (existsSync3("drizzle.config.ts") || existsSync3("drizzle.config.js")) {

331 return "drizzle";

332 }

333 if (existsSync3("ormconfig.json") || existsSync3("ormconfig.ts") || existsSync3("ormconfig.js")) {

334 return "typeorm";

335 }

336 if (existsSync3("package.json")) {

337 const pkg = JSON.parse(readFileSync2("package.json", "utf-8"));

338 const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };

339 if (allDeps["@prisma/client"] || allDeps["prisma"]) return "prisma";

340 if (allDeps["drizzle-orm"] || allDeps["drizzle-kit"]) return "drizzle";

341 if (allDeps["typeorm"]) return "typeorm";

342 }

343 return null;

344}

345function runCommand(cmd) {

346 console.log(`\x1B[90m$ ${cmd}\x1B[0m`);

347 try {

348 execSync(cmd, { stdio: "inherit", cwd: process.cwd() });

349 } catch {

350 process.exitCode = 1;

351 }

352}

353function prismaCommand(subcommand, args) {

354 const cmd = `npx prisma ${subcommand} ${args.join(" ")}`.trim();

355 runCommand(cmd);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L347

356}

357function drizzleCommand(subcommand, args) {

358 const commands = {

359 migrate: "drizzle-kit generate",

360 seed: "drizzle-kit seed",

361 reset: "drizzle-kit drop",

362 status: "drizzle-kit check",

363 generate: "drizzle-kit generate",

364 studio: "drizzle-kit studio"

365 };

366 const cmd = `${commands[subcommand] ?? subcommand} ${args.join(" ")}`.trim();

367 runCommand(cmd);

dist/core-exports.cjsView file

Lines 708-748javascript

708 ulid: () => ulid,

709 uniq: () => uniq,

710 uploader: () => uploader,

711 uuid: () => uuid,

712 validate: ()

dist/cli/index.cjsView file

Lines 25-65javascript

25 // "default" to the CommonJS "module.exports" for node compatibility.

26 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

27 mod

28));

Source & flagged code

5 flagged · loading source

dist/cli/index.jsView file

323// src/cli/commands/db.ts L324: import { execSync } from "child_process"; L325: import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L323

347try { L348: execSync(cmd, { stdio: "inherit", cwd: process.cwd() }); L349: } catch { ... L353: function prismaCommand(subcommand, args) { L354: const cmd = `npx prisma ${subcommand} ${args.join(" ")}`.trim(); L355: runCommand(cmd);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L347

dist/core-exports.cjsView file

728init_cjs_shims(); L729: var import_zod4 = require("zod"); L730:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core-exports.cjs

Findings

4 High5 Medium5 Low

HighChild Processdist/cli/index.js

HighShell

HighCross File Remote Execution Contextdist/cli/index.cjs

HighRuntime Package Installdist/cli/index.js

MediumDynamic Requiredist/core-exports.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowEvaldist/core-exports.cjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @buntok/core@2.1.5.

See all versions of @buntok/core for other recorded verdicts.

Review the evidence and your use of @buntok/core@2.1.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-31 14:35:49.047Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.