registry  /  @caplets/core  /  0.32.4

@caplets/core@0.32.4

⚠ Under review

Core runtime library for Caplets Code Mode and progressive disclosure gateways.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsProtestwareTelemetryUrlStrings
ManifestNo manifest risk signals triggered.
scanned 23 file(s), 2.94 MB of source, external domains: 127.0.0.1, caplets.dev, caplets.example.com, catalog.caplets.dev, cloud.caplets.dev, developer.mozilla.org, eu-assets.i.posthog.com, eu.i.posthog.com, github.com, json-schema.org, posthog.com, raw.githubusercontent.com, registry.npmjs.org, schemas.microsoft.com, sentry.io, us-assets.i.posthog.com, us.i.posthog.com, www.apple.com, www.cl.cam.ac.uk, yandex.com
Oversized source lightweight scan
dist/user-settings-BfvtgPgu.js2.75 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStringsUrlStringscloud.caplets.devschemas.microsoft.comwww.apple.com

Source & flagged code

9 flagged · loading source
dist/index.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = @caplets/core@0.32.1 matchedIdentity = npm:QGNhcGxldHMvY29yZQ:0.32.1 similarity = 0.913 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/index.jsView on unpkg
19import path, { basename, dirname, isAbsolute, join, parse, posix, relative, resolve, sep, win32 } from "node:path"; L20: import childProcess, { execFile, execFileSync, spawn } from "node:child_process"; L21: import process$1, { stdin, stdout } from "node:process";
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L19
3689if (process$1.versions?.electron) parseOptions.from = "electron"; L3690: const execArgv = process$1.execArgv ?? []; L3691: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) parseOptions.from = "eval";
High
Shell

Package source references shell execution.

dist/index.jsView on unpkg · L3689
19Cross-file remote execution chain: dist/index.js spawns dist/schemas-DjdkA2UI.js; helper contains network access plus dynamic code execution. L19: import path, { basename, dirname, isAbsolute, join, parse, posix, relative, resolve, sep, win32 } from "node:path"; L20: import childProcess, { execFile, execFileSync, spawn } from "node:child_process"; L21: import process$1, { stdin, stdout } from "node:process"; L22: import { Readable, Writable } from "node:stream"; L23: import { STATUS_CODES, createServer } from "node:http"; L24: import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto"; ... L2096: * @return {string} L2097: * @private L2098: */ ... L2975: this._outputConfiguration = { L2976: writeOut: (str) => process$1.stdout.write(str), L2977: writeErr: (str) => process$1.stderr.write(str),
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L19
19Detached bundled service listener: dist/index.js launches a Node helper and exposes a broad-bound HTTP listener. L19: import path, { basename, dirname, isAbsolute, join, parse, posix, relative, resolve, sep, win32 } from "node:path"; L20: import childProcess, { execFile, execFileSync, spawn } from "node:child_process"; L21: import process$1, { stdin, stdout } from "node:process"; L22: import { Readable, Writable } from "node:stream"; L23: import { STATUS_CODES, createServer } from "node:http"; L24: import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto"; ... L2096: * @return {string} L2097: * @private L2098: */ ... L2975: this._outputConfiguration = { L2976: writeOut: (str) => process$1.stdout.write(str), L2977: writeErr: (str) => process$1.stderr.write(str),
High
Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/index.jsView on unpkg · L19
17652patternName = generic_password severity = medium line = 17652 matchedText = password...ed]"
Medium
Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L17652
2107* https://www.typescriptlang.org/docs/handbook/jsdoc-supported-types.html#import-types L2108: * @typedef { import("./argument.js").Argument } Argument L2109: * @typedef { import("./command.js").Command } Command
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L2107
dist/caplet-source.jsView file
216try { L217: new Function(""); L218: return true;
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/caplet-source.jsView on unpkg · L216
dist/user-settings-BfvtgPgu.jsView file
•path = dist/user-settings-BfvtgPgu.js kind = oversized_source_file sizeBytes = 2878664 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/user-settings-BfvtgPgu.jsView on unpkg

Findings

1 Critical5 High6 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighCross File Remote Execution Contextdist/index.js
HighSpawned Bundled Service Listenerdist/index.js
HighOversized Source Filedist/user-settings-BfvtgPgu.js
MediumSecret Patterndist/index.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/caplet-source.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings