@buntok/core@2.1.6

⚠ Under review

Core HTTP framework for Bun, bring your own structure

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

WildcardDependency

scanned 9 file(s), 2.07 MB of source, external domains: accounts.google.com, api-m.paypal.com, api-m.sandbox.paypal.com, api.github.com, api.mailgun.net, api.midtrans.com, api.resend.com, api.sandbox.midtrans.com, api.sendgrid.com, api.stripe.com, api.xendit.co, app.midtrans.com, app.sandbox.midtrans.com, appleid.apple.com, evilmartians.com, example.com, github.com, oauth2.googleapis.com, tailwindcss.com, twitter.com, www.googleapis.com, www.w3ctech.com

Source & flagged code

5 flagged

dist/cli/index.jsView file

Lines 406-470javascript

406 );

407 }

408 }

409 console.log(options.dryRun ? "\x1B[33mWould generate:\x1B[0m" : "\x1B[32mGenerated files:\x1B[0m");

410 for (const result of results.sort()) {

411 console.log(` ${result}`);

412 }

413 if (options.dryRun) {

414 console.log(`

415\x1B[33mRun without --dry-run to create these files.\x1B[0m

416`);

417 } else {

418 console.log(`

419\x1B[36mNext steps:\x1B[0m

420 1. Start dev server: \x1B[33mbun run dev\x1B[0m

421`);

422 }

423}

424

425// src/cli/commands/db.ts

426init_esm_shims();

427import { execSync } from "child_process";

428import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L426

429function detectOrm() {

430 if (existsSync4("prisma/schema.prisma") || existsSync4("prisma/schema.ts")) {

431 return "prisma";

432 }

433 if (existsSync4("drizzle.config.ts") || existsSync4("drizzle.config.js")) {

434 return "drizzle";

435 }

436 if (existsSync4("ormconfig.json") || existsSync4("ormconfig.ts") || existsSync4("ormconfig.js")) {

437 return "typeorm";

438 }

439 if (existsSync4("package.json")) {

440 const pkg = JSON.parse(readFileSync2("package.json", "utf-8"));

441 const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };

442 if (allDeps["@prisma/client"] || allDeps["prisma"]) return "prisma";

443 if (allDeps["drizzle-orm"] || allDeps["drizzle-kit"]) return "drizzle";

444 if (allDeps["typeorm"]) return "typeorm";

445 }

446 return null;

447}

448function runCommand(cmd) {

449 console.log(`\x1B[90m$ ${cmd}\x1B[0m`);

450 try {

451 execSync(cmd, { stdio: "inherit", cwd: process.cwd() });

452 } catch {

453 process.exitCode = 1;

454 }

455}

456function prismaCommand(subcommand, args) {

457 const cmd = `npx prisma ${subcommand} ${args.join(" ")}`.trim();

458 runCommand(cmd);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L450

459}

460function drizzleCommand(subcommand, args) {

461 const commands = {

462 migrate: "drizzle-kit generate",

463 seed: "drizzle-kit seed",

464 reset: "drizzle-kit drop",

465 status: "drizzle-kit check",

466 generate: "drizzle-kit generate",

467 studio: "drizzle-kit studio"

468 };

469 const cmd = `${commands[subcommand] ?? subcommand} ${args.join(" ")}`.trim();

470 runCommand(cmd);

dist/core-exports.cjsView file

Lines 729-769javascript

729 ulid: () => ulid,

730 uniq: () => uniq,

731 uploader: () => uploader,

732 uuid: () => uuid,

733 validate: ()

dist/cli/index.cjsView file

Lines 66-106javascript

66 clear() {

67 this.messages = [];

68 }

69 };

70 defaultHistory = new MemorySSEHistory(1e3);

71 }

Source & flagged code

5 flagged · loading source

dist/cli/index.jsView file

426init_esm_shims(); L427: import { execSync } from "child_process"; L428: import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L426

450try { L451: execSync(cmd, { stdio: "inherit", cwd: process.cwd() }); L452: } catch { ... L456: function prismaCommand(subcommand, args) { L457: const cmd = `npx prisma ${subcommand} ${args.join(" ")}`.trim(); L458: runCommand(cmd);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L450

dist/core-exports.cjsView file

749init_cjs_shims(); L750: var import_node_fs2 = require("fs"); L751: var import_node_path4 = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

Findings

4 High5 Medium5 Low

HighChild Processdist/cli/index.js

HighShell

HighCross File Remote Execution Contextdist/cli/index.cjs

HighRuntime Package Installdist/cli/index.js

MediumDynamic Requiredist/core-exports.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowEvaldist/core-exports.cjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @buntok/core@2.1.6.

See all versions of @buntok/core for other recorded verdicts.

Review the evidence and your use of @buntok/core@2.1.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-13 23:15:41.858Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.