registry / @kekkai/blueprint / 1.0.2

@kekkai/blueprint@1.0.2

Architecture as Code — one Blueprint compiles into docs, agent contracts, lint, and CI for Vue & React projects.

Static Scan Results

scanned 13h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 169 KB of source

Source & flagged code

3 flagged

dist/bin.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import fs, { realpathSync } from "node:fs";

3import path from "node:path";

4import { fileURLToPath, pathToFileURL } from "node:url";

5import { execSync } from "node:child_process";

6//#region src/config/graph.ts

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L4

7/** Normalize the mixed `allowedImporters` list into objects. */

8function normalizeAllowedImporters(allowed) {

9 return (allowed ?? []).map((entry) => typeof entry === "string" ? { layer: entry } : entry);

10}

11/**

12* Names of layers permitted to import the layer at `index`: its explicit

13* `allowedImporters` list, or — by default — every layer declared before it.

14*/

15function importerNames(layers, index) {

16 const { allowedImporters } = layers[index];

17 return allowedImporters ? normalizeAllowedImporters(allowedImporters).map((importer) => importer.layer) : layers.slice(0, index).map((layer) => layer.name);

18}

19/**

20* Layers `layerName` may NOT import: every other layer that does not list

21* `layerName` among its permitted importers (upstream layers included).

22*/

23function getForbiddenLayers(architecture, layerName) {

24 const { layers } = architecture;

Lines 959-999javascript

959 package: "vue",

960 imports: ["provide"]

961 }]

962 }, options);

963}

964/** Canonical React blueprint: createContext/useContext in their layers, Zustand owned by hooks. */

965function reactPreset(options = {}) {

Lines 1535-1575javascript

1535 " files: ['src/**/*.{js,jsx,ts,tsx,vue}'],",

1536 " plugins: {",

1537 " import: importPlugin,",

1538 " '@eslint-community/eslint-comments': comments,",

1539 " },",

1540 " rules: {",

1541 ...core,

Source & flagged code

3 flagged · loading source

dist/bin.jsView file

4import { fileURLToPath, pathToFileURL } from "node:url"; L5: import { execSync } from "node:child_process"; L6: //#region src/config/graph.ts

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code