registry / @keystrokehq/cli / 0.1.25

@keystrokehq/cli@0.1.25

⚠ Under review

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsObfuscatedTelemetryUrlStrings

Manifest

NoLicense

scanned 127 file(s), 3.65 MB of source, external domains: 127.0.0.1, angular.io, api.keystroke.ai, cscott.net, datatracker.ietf.org, dom.spec.whatwg.org, empty.invalid, example.com, github.com, json-schema.org, keystroke.ai, landley.net, raw.githubusercontent.com, registry.npmjs.org, trac.webkit.org, www.ibm.com, www.w3.org, www.whatwg.org

Source & flagged code

5 flagged

dist/dist-C1QOfWMM.mjsView file

7804const execResult = result[result.length - 1]; L7805: if (typeof execResult === "undefined") throw new Error("Pipeline cannot be used to send any commands when the `exec()` has been called on it."); L7806: if (execResult[0]) {

High

Child Process

Package source references child process execution.

dist/dist-C1QOfWMM.mjsView on unpkg · L7804

34//#region ../../node_modules/.pnpm/just-bash@3.0.1/node_modules/just-bash/dist/bundle/chunks/chunk-G5EVRAOO.js L35: createRequire(import.meta.url); L36: var p;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/dist-C1QOfWMM.mjsView on unpkg · L34

dist/dist-BOhrc_Nv.mjsView file

Lines 121-161javascript

121 });

122}

123function mergeDefs(...defs) {

124 const mergedDescriptors = {};

125 for (const def of defs) Object.assign(mergedDescriptors, Object.getOwnPropertyDescriptors(def));

126 return Object.defineProperties({}, mergedDescriptors);

127}

128function esc(str) {

129 return JSON.stringify(str);

130}

131function slugify(input) {

132 return input.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");

133}

134const captureStackTrace = "captureStackTrace" in Error ? Error.captureStackTrace : (..._args) => {};

135function isObject(data) {

136 return typeof data === "object" && data !== null && !Array.isArray(data);

137}

138const allowsEval = /* @__PURE__ */ cached(() => {

139 if (globalConfig.jitless) return false;

140 if (typeof navigator !== "undefined" && navigator?.userAgent?.includes("Cloudflare")) return false;

141 try {

142 new Function("");

143 return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-BOhrc_Nv.mjsView on unpkg · L141

144 } catch (_) {

145 return false;

146 }

147});

148function isPlainObject(o) {

149 if (isObject(o) === false) return false;

150 const ctor = o.constructor;

151 if (ctor === void 0) return true;

152 if (typeof ctor !== "function") return true;

153 const prot = ctor.prototype;

154 if (isObject(prot) === false) return false;

155 if (Object.prototype.hasOwnProperty.call(prot, "isPrototypeOf") === false) return false;

156 return true;

157}

158function shallowClone(o) {

159 if (isPlainObject(o)) return { ...o };

160 if (Array.isArray(o)) return [...o];

161 if (o instanceof Map) return new Map(o);

dist/js-exec-N5KEZBH7-CgtG-I6s.mjsView file

Lines 28-68javascript

28 --strip-types Strip TypeScript type annotations

29 --version, -V Show version

30 --help Show this help

32Examples:

33 js-exec -c "console.log(1 + 2)"

34 js-exec script.js

35 js-exec app.ts

36 echo 'console.log("hello")' | js-exec

38File Extension Auto-Detection:

dist/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @keystrokehq/cli@0.1.24 matchedIdentity = npm:QGtleXN0cm9rZWhxL2NsaQ:0.1.24 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/index.mjsView on unpkg

Source & flagged code

5 flagged · loading source

dist/dist-C1QOfWMM.mjsView file

High

Child Process

Package source references child process execution.

dist/dist-C1QOfWMM.mjsView on unpkg · L7804

34//#region ../../node_modules/.pnpm/just-bash@3.0.1/node_modules/just-bash/dist/bundle/chunks/chunk-G5EVRAOO.js L35: createRequire(import.meta.url); L36: var p;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/dist-C1QOfWMM.mjsView on unpkg · L34

dist/dist-BOhrc_Nv.mjsView file

141try { L142: new Function(""); L143: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-BOhrc_Nv.mjsView on unpkg · L141

dist/js-exec-N5KEZBH7-CgtG-I6s.mjsView file

48Cross-file remote execution chain: dist/js-exec-N5KEZBH7-CgtG-I6s.mjs spawns dist/chunk-TN7HHBQW-CSB_R-XD.mjs; helper contains network access plus dynamic code execution. L48: Available modules: L49: fs, path, child_process, process, console, L50: os, url, assert, util, events, buffer, stream, ... L63: child_process: L64: execSync(cmd) throws on non-zero exit, returns stdout L65: spawnSync(cmd, args) returns { stdout, stderr, status } ... L69: L70: os: platform(), arch(), homedir(), tmpdir(), type(), hostname(), L71: EOL, cpus(), endianness() L72: L73: url: URL, URLSearchParams, parse(), format() L74:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/js-exec-N5KEZBH7-CgtG-I6s.mjsView on unpkg · L48

dist/index.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/index.mjsView on unpkg

Findings

1 Critical3 High4 Medium8 Low

CriticalPrevious Version Dangerous Deltadist/index.mjs

HighChild Processdist/dist-C1QOfWMM.mjs

HighShell

HighCross File Remote Execution Contextdist/js-exec-N5KEZBH7-CgtG-I6s.mjs

MediumDynamic Requiredist/dist-C1QOfWMM.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/dist-BOhrc_Nv.mjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/dist-C1QOfWMM.mjsView file

High

Child Process

Package source references child process execution.

dist/dist-C1QOfWMM.mjsView on unpkg · L7804

34//#region ../../node_modules/.pnpm/just-bash@3.0.1/node_modules/just-bash/dist/bundle/chunks/chunk-G5EVRAOO.js L35: createRequire(import.meta.url); L36: var p;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/dist-C1QOfWMM.mjsView on unpkg · L34

dist/dist-BOhrc_Nv.mjsView file

Lines 121-161javascript

121 });

122}

123function mergeDefs(...defs) {

124 const mergedDescriptors = {};

125 for (const def of defs) Object.assign(mergedDescriptors, Object.getOwnPropertyDescriptors(def));

126 return Object.defineProperties({}, mergedDescriptors);

127}

128function esc(str) {

129 return JSON.stringify(str);

130}

131function slugify(input) {

132 return input.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");

133}

134const captureStackTrace = "captureStackTrace" in Error ? Error.captureStackTrace : (..._args) => {};

135function isObject(data) {

136 return typeof data === "object" && data !== null && !Array.isArray(data);

137}

138const allowsEval = /* @__PURE__ */ cached(() => {

139 if (globalConfig.jitless) return false;

140 if (typeof navigator !== "undefined" && navigator?.userAgent?.includes("Cloudflare")) return false;

141 try {

142 new Function("");

143 return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-BOhrc_Nv.mjsView on unpkg · L141

144 } catch (_) {

145 return false;

146 }

147});

148function isPlainObject(o) {

149 if (isObject(o) === false) return false;

150 const ctor = o.constructor;

151 if (ctor === void 0) return true;

152 if (typeof ctor !== "function") return true;

153 const prot = ctor.prototype;

154 if (isObject(prot) === false) return false;

155 if (Object.prototype.hasOwnProperty.call(prot, "isPrototypeOf") === false) return false;

156 return true;

157}

158function shallowClone(o) {

159 if (isPlainObject(o)) return { ...o };

160 if (Array.isArray(o)) return [...o];

161 if (o instanceof Map) return new Map(o);

dist/js-exec-N5KEZBH7-CgtG-I6s.mjsView file

Lines 28-68javascript

28 --strip-types Strip TypeScript type annotations

29 --version, -V Show version

30 --help Show this help

32Examples:

33 js-exec -c "console.log(1 + 2)"

34 js-exec script.js

35 js-exec app.ts

36 echo 'console.log("hello")' | js-exec

38File Extension Auto-Detection:

dist/index.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/index.mjsView on unpkg