@buntok/core@2.2.4

⚠ Under review

Blazing-fast, type-safe HTTP framework for Bun - AOT-compiled routing, decorators, Zod validation & IoC

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 17 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

WildcardDependency

scanned 182 file(s), 4.26 MB of source, external domains: accounts.google.com, api-m.paypal.com, api-m.sandbox.paypal.com, api.github.com, api.mailgun.net, api.midtrans.com, api.resend.com, api.sandbox.midtrans.com, api.sendgrid.com, api.stripe.com, api.xendit.co, app.midtrans.com, app.sandbox.midtrans.com, appleid.apple.com, evilmartians.com, example.com, github.com, oauth2.googleapis.com, openapi.vercel.sh, tailwindcss.com, twitter.com, unpkg.com, www.googleapis.com, www.w3.org, www.w3ctech.com

Source & flagged code

8 flagged

dist/cli/index.jsView file

Lines 2004-2044javascript

2004 }

2005 if (!options.dryRun && options.controller) {

2006 warnDuplicateRoutes(scanRoutes());

2007 }

2008 console.log(options.dryRun ? "\x1B[33mWould generate:\x1B[0m" : "\x1B[32mGenerated files:\x1B[0m");

2009 for (const result of results.sort()) {

2010 console.log(` ${result}`);

2011 }

2012 if (options.dryRun) {

2013 console.log(`

2014\x1B[33mRun without --dry-run to create these files.\x1B[0m

2015`);

2016 } else {

2017 console.log(`

2018\x1B[36mNext steps:\x1B[0m

2019 1. Start dev server: \x1B[33mbun run dev\x1B[0m

2020`);

2021 }

2022}

2023

2024// src/cli/commands/db.ts

2025import { execSync } from "node:child_process";

2026import { existsSync as existsSync9, readFileSync as readFileSync5 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L2024

2027import { join as join9 } from "node:path";

2028import { createInterface } from "node:readline";

2029

2030// src/cli/commands/db-seed.ts

2031import { existsSync as existsSync8 } from "node:fs";

2032import fs3 from "node:fs/promises";

2033import { join as join8, resolve } from "node:path";

2034async function dbSeedCommand(orm) {

2035 const detectedOrm = orm ?? detectORMOrNull() ?? "prisma";

2036 console.log("\x1B[36mRunning Database Seeders...\x1B[0m\n");

2037 const seederDir = resolve(process.cwd(), "src/db/seeders");

2038 if (!existsSync8(seederDir)) {

2039 console.warn(

2040 `\x1B[33mWarning: No seeders directory found at ${seederDir}\x1B[0m`

2041 );

2042 return;

2043 }

2044 const files = await fs3.readdir(seederDir);

dist/chunk-QUHLEKYY.cjsView file

Lines 855-895javascript

855 }

856 if (h._isBuntokResponse) {

857 openApiDoc.responses.push({

858 status: h._status,

859 schema: h._schema,

860 description: h._description

861 });

862 }

863 }

864

dist/ws-helpers.cjsView file

Lines 1-21javascript

1"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return

dist/cli/index.cjsView file

Lines 2649-2689javascript

2649 console.log("\x1B[90m\u2022 package.json: all scripts already present\x1B[0m");

2650 return false;

2651 }

2652 _fs.writeFileSync.call(void 0, pkgPath,

dist/cli/templates/favicon.icoView file

•path = dist/cli/templates/favicon.ico kind = high_entropy_blob sizeBytes = 17474 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/cli/templates/favicon.icoView on unpkg

dist/chunk-6JTMQOOJ.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-6JTMQOOJ.js#virtual:normalized:round1View on unpkg

dist/cli/templates/tailwind.jsView file

•matchType = normalized_sha256 matchedPackage = @nimbus-sh/worker@0.8.0 matchedPath = public/_assets/tailwind-play.js matchedIdentity = npm:QG5pbWJ1cy1zaC93b3JrZXI:0.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/templates/tailwind.jsView on unpkg

dist/chunk-XL2GZDJL.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @buntok/core@2.1.14 matchedIdentity = npm:QGJ1bnRvay9jb3Jl:2.1.14 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-XL2GZDJL.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/cli/index.jsView file

2024// src/cli/commands/db.ts L2025: import { execSync } from "node:child_process"; L2026: import { existsSync as existsSync9, readFileSync as readFileSync5 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L2024

dist/chunk-QUHLEKYY.cjsView file

875} L876: const factory = new Function( L877: "fns",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-QUHLEKYY.cjsView on unpkg · L875

dist/ws-helpers.cjsView file

1"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } functi... L2:

Findings

1 Critical6 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/chunk-XL2GZDJL.js

HighChild Processdist/cli/index.js

HighShell

HighRuntime Package Installdist/cli/index.cjs

HighShips High Entropy Blobdist/cli/templates/favicon.ico

HighSemantic Analysis Limiteddist/chunk-6JTMQOOJ.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/cli/templates/tailwind.js

MediumDynamic Requiredist/ws-helpers.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

Low

Affected versions and remediation

This report applies to @buntok/core@2.2.4.

See all versions of @buntok/core for other recorded verdicts.

Review the evidence and your use of @buntok/core@2.2.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-16 07:18:00.202Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.