@buntok/core@2.2.1

⚠ Under review

Blazing-fast, type-safe HTTP framework for Bun - AOT-compiled routing, decorators, Zod validation & IoC

Static Scan Results

scanned 29d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 18 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

WildcardDependency

scanned 166 file(s), 1.42 MB of source, external domains: accounts.google.com, api-m.paypal.com, api-m.sandbox.paypal.com, api.github.com, api.mailgun.net, api.midtrans.com, api.resend.com, api.sandbox.midtrans.com, api.sendgrid.com, api.stripe.com, api.xendit.co, app.midtrans.com, app.sandbox.midtrans.com, appleid.apple.com, evilmartians.com, example.com, github.com, oauth2.googleapis.com, openapi.vercel.sh, tailwindcss.com, twitter.com, unpkg.com, www.googleapis.com, www.w3.org, www.w3ctech.com

Source & flagged code

9 flagged

dist/cli/index.jsView file

899// src/cli/commands/db.ts L900: import { execSync } from "node:child_process"; L901: import { existsSync as existsSync6, readFileSync as readFileSync3 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L899

928try { L929: execSync(cmd, { stdio: "inherit", cwd: process.cwd() }); L930: } catch { ... L943: function prismaCommand(subcommand, args, dryRun = false) { L944: const cmd = `npx prisma ${subcommand} ${args.join(" ")}`.trim(); L945: runCommand(cmd, dryRun);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L928

dist/chunk-4WI4FHMR.cjsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-4WI4FHMR.cjsView on unpkg

739} L740: const factory = new Function("fns", `return function(ctx) { ${code} }`); L741: return factory(fns);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-4WI4FHMR.cjsView on unpkg · L739

dist/ws-helpers.cjsView file

1"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } functi... L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ws-helpers.cjsView on unpkg · L1

dist/cli/index.cjsView file

40Cross-file remote execution chain: dist/cli/index.cjs spawns dist/chunk-4WI4FHMR.cjs; helper contains network access plus dynamic code execution. L40: async function buildCommand() { L41: const projectRoot = process.cwd(); L42: const entryPoint = _path.join.call(void 0, projectRoot, "server.ts"); ... L45: console.error("\x1B[31m\u274C server.ts not found\x1B[0m"); L46: process.exitCode = 1; L47: return; ... L49: let userDeps = []; L50: const pkgPath = _path.join.call(void 0, projectRoot, "package.json"); L51: if (_fs.existsSync.call(void 0, pkgPath)) { L52: const pkg = await Bun.file(pkgPath).json(); L53: userDeps = [ ... L392:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.cjsView on unpkg · L40

dist/cli/templates/favicon.icoView file

•path = dist/cli/templates/favicon.ico kind = high_entropy_blob sizeBytes = 17474 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/cli/templates/favicon.icoView on unpkg

dist/cli/templates/tailwind.jsView file

•matchType = normalized_sha256 matchedPackage = @nimbus-sh/worker@0.8.0 matchedPath = public/_assets/tailwind-play.js matchedIdentity = npm:QG5pbWJ1cy1zaC93b3JrZXI:0.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/templates/tailwind.jsView on unpkg

dist/chunk-PZCFH44S.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @buntok/core@2.1.14 matchedIdentity = npm:QGJ1bnRvay9jb3Jl:2.1.14 similarity = 0.636 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-PZCFH44S.jsView on unpkg

Source & flagged code

9 flagged · loading source

dist/cli/index.jsView file

899// src/cli/commands/db.ts L900: import { execSync } from "node:child_process"; L901: import { existsSync as existsSync6, readFileSync as readFileSync3 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L899

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L928

dist/chunk-4WI4FHMR.cjsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

Findings

1 Critical7 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/chunk-PZCFH44S.js

HighChild Processdist/cli/index.js

HighShell

HighCross File Remote Execution Contextdist/cli/index.cjs

HighRuntime Package Installdist/cli/index.js

HighShips High Entropy Blobdist/cli/templates/favicon.ico

HighSemantic Analysis Limiteddist/chunk-4WI4FHMR.cjs

HighKnown Malware Source Similaritydist/cli/templates/tailwind.js

MediumDynamic Requiredist/ws-helpers.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

Affected versions and remediation

This report applies to @buntok/core@2.2.1.

See all versions of @buntok/core for other recorded verdicts.

Review the evidence and your use of @buntok/core@2.2.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-23 22:22:31.085Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.