registry / @buntok/core / 2.2.2
@buntok/core@2.2.2
⚠ Under reviewBlazing-fast, type-safe HTTP framework for Bun - AOT-compiled routing, decorators, Zod validation & IoC
Static Scan Results
scanned 23d ago · by rust-scannerStatic analysis completed at 97.0% confidence. No malicious behavior was detected; 18 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
WildcardDependency
Source & flagged code
9 flagged · loading sourcedist/cli/index.jsView file
1669// src/cli/commands/db.ts
L1670: import { execSync } from "node:child_process";
L1671: import { existsSync as existsSync9, readFileSync as readFileSync5 } from "node:fs";
High
Child Process
Package source references child process execution.
dist/cli/index.jsView on unpkg · L16691751try {
L1752: execSync(cmd, { stdio: "inherit", cwd: process.cwd() });
L1753: } catch {
...
L1766: function prismaCommand(subcommand, args, dryRun = false) {
L1767: const cmd = `npx prisma ${subcommand} ${args.join(" ")}`.trim();
L1768: runCommand(cmd, dryRun);
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/cli/index.jsView on unpkg · L1751dist/chunk-T7LHYQ6Y.cjsView file
744}
L745: const factory = new Function("fns", `return function(ctx) { ${code} }`);
L746: return factory(fns);
Low
Eval
Package source references a known benign dynamic code generation pattern.
Findings
1 Critical7 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/cli/index.cjs
HighChild Processdist/cli/index.js
HighShell
HighCross File Remote Execution Contextdist/cli/index.cjs
HighRuntime Package Installdist/cli/index.js
HighShips High Entropy Blobdist/cli/templates/favicon.ico
HighSemantic Analysis Limiteddist/chunk-RVPIGBSE.cjs#virtual:normalized:round1
HighKnown Malware Source Similaritydist/cli/templates/tailwind.js
MediumDynamic Requiredist/ws-helpers.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
Affected versions and remediation
This report applies to @buntok/core@2.2.2.
See all versions of @buntok/core for other recorded verdicts.
- Review the evidence and your use of @buntok/core@2.2.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.