registry / @keystrokehq/cli / 0.1.28

@keystrokehq/cli@0.1.28

⚠ Under review

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsObfuscatedTelemetryUrlStrings

Manifest

NoLicense

scanned 126 file(s), 3.26 MB of source, external domains: 127.0.0.1, angular.io, api.keystroke.ai, cscott.net, datatracker.ietf.org, dom.spec.whatwg.org, empty.invalid, example.com, github.com, json-schema.org, keystroke.ai, landley.net, raw.githubusercontent.com, registry.npmjs.org, trac.webkit.org, www.apache.org, www.ibm.com, www.w3.org, www.whatwg.org

Oversized source lightweight scan

dist/dist-BcxMnb_L.mjs8.31 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoDynamicRequireHighEntropyStringsUrlStringswww.apache.org

Source & flagged code

7 flagged

dist/version-DtFg32hj.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { $n as originFromPublicUrl, ut as LOCAL_PLATFORM_ORIGIN } from "./dist-COhdZicI.mjs";

3import Conf from "conf";

4import { homedir } from "node:os";

5import { dirname, join } from "node:path";

6import { existsSync, readFileSync } from "node:fs";

7import { spawnSync } from "node:child_process";

8import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/version-DtFg32hj.mjsView on unpkg · L6

9//#region src/resolve-platform-url.ts

10const DEFAULT_WEB_URL = "https://keystroke.ai";

11const DEFAULT_PLATFORM_URL = "https://api.keystroke.ai";

12function webOriginFromUrl(webUrl) {

13 return originFromPublicUrl(webUrl, webUrl.replace(/\/+$/, ""));

14}

15/** Known web origins with a fixed platform API — undefined for custom/staging URLs. */

16function knownPlatformUrlForWebUrl(webUrl) {

17 const webOrigin = webOriginFromUrl(webUrl);

18 if (webOrigin === "http://localhost:3000" || webOrigin === "http://127.0.0.1:3000") return LOCAL_PLATFORM_ORIGIN;

19 if (webOrigin === "https://keystroke.ai") return DEFAULT_PLATFORM_URL;

20}

21function resolvePlatformUrlForWebUrl(webUrl, options = {}) {

22 const explicit = options.platformUrl?.trim();

23 if (explicit) return explicit.replace(/\/+$/, "");

24 const known = knownPlatformUrlForWebUrl(webUrl);

25 if (known) return known;

26 return (options.fallback?.trim() || "https://api.keystroke.ai").replace(/\/+$/, "");

dist/dist-9VWONIo1.mjsView file

Lines 299-339javascript

299 start(controller) {

300 parser = createParser({

301 onEvent: (event) => {

302 controller.enqueue(event);

303 },

304 onError(error) {

305 onError ===

dist/js-exec-N5KEZBH7-CgtG-I6s.mjsView file

Lines 28-68javascript

28 --strip-types Strip TypeScript type annotations

29 --version, -V Show version

30 --help Show this help

32Examples:

33 js-exec -c "console.log(1 + 2)"

34 js-exec script.js

35 js-exec app.ts

36 echo 'console.log("hello")' | js-exec

38File Extension Auto-Detection:

dist/dist-BcxMnb_L.mjsView file

•path = dist/dist-BcxMnb_L.mjs kind = oversized_source_file sizeBytes = 8709615 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/dist-BcxMnb_L.mjsView on unpkg

•path = dist/dist-BcxMnb_L.mjs kind = oversized_cli_entrypoint sizeBytes = 8709615 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/dist-BcxMnb_L.mjsView on unpkg

dist/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @keystrokehq/cli@0.1.24 matchedIdentity = npm:QGtleXN0cm9rZWhxL2NsaQ:0.1.24 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/index.mjsView on unpkg

Source & flagged code

7 flagged · loading source

dist/version-DtFg32hj.mjsView file

6import { existsSync, readFileSync } from "node:fs"; L7: import { spawnSync } from "node:child_process"; L8: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/version-DtFg32hj.mjsView on unpkg · L6

dist/dist-9VWONIo1.mjsView file

319let crypto; L320: crypto = globalThis.crypto?.webcrypto ?? globalThis.crypto ?? import("node:crypto").then((m) => m.webcrypto); L321: /**

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/dist-9VWONIo1.mjsView on unpkg · L319

6743if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L6744: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L6745: this.scope.value(validateName, { ref: validate });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-9VWONIo1.mjsView on unpkg · L6743

dist/js-exec-N5KEZBH7-CgtG-I6s.mjsView file

48Cross-file remote execution chain: dist/js-exec-N5KEZBH7-CgtG-I6s.mjs spawns dist/chunk-TN7HHBQW-CSB_R-XD.mjs; helper contains network access plus dynamic code execution. L48: Available modules: L49: fs, path, child_process, process, console, L50: os, url, assert, util, events, buffer, stream, ... L63: child_process: L64: execSync(cmd) throws on non-zero exit, returns stdout L65: spawnSync(cmd, args) returns { stdout, stderr, status } ... L69: L70: os: platform(), arch(), homedir(), tmpdir(), type(), hostname(), L71: EOL, cpus(), endianness() L72: L73: url: URL, URLSearchParams, parse(), format() L74:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/js-exec-N5KEZBH7-CgtG-I6s.mjsView on unpkg · L48

dist/dist-BcxMnb_L.mjsView file

•path = dist/dist-BcxMnb_L.mjs kind = oversized_source_file sizeBytes = 8709615 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/dist-BcxMnb_L.mjsView on unpkg

•path = dist/dist-BcxMnb_L.mjs kind = oversized_cli_entrypoint sizeBytes = 8709615 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/dist-BcxMnb_L.mjsView on unpkg

dist/index.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/index.mjsView on unpkg

Findings

1 Critical4 High5 Medium8 Low

CriticalPrevious Version Dangerous Deltadist/index.mjs

HighChild Processdist/version-DtFg32hj.mjs

HighShell

HighCross File Remote Execution Contextdist/js-exec-N5KEZBH7-CgtG-I6s.mjs

HighOversized Source Filedist/dist-BcxMnb_L.mjs

MediumDynamic Requiredist/dist-9VWONIo1.mjs

MediumNetwork

MediumEnvironment Vars

MediumOversized Cli Entrypointdist/dist-BcxMnb_L.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/dist-9VWONIo1.mjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

dist/version-DtFg32hj.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { $n as originFromPublicUrl, ut as LOCAL_PLATFORM_ORIGIN } from "./dist-COhdZicI.mjs";

3import Conf from "conf";

4import { homedir } from "node:os";

5import { dirname, join } from "node:path";

6import { existsSync, readFileSync } from "node:fs";

7import { spawnSync } from "node:child_process";

8import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/version-DtFg32hj.mjsView on unpkg · L6

9//#region src/resolve-platform-url.ts

10const DEFAULT_WEB_URL = "https://keystroke.ai";

11const DEFAULT_PLATFORM_URL = "https://api.keystroke.ai";

12function webOriginFromUrl(webUrl) {

13 return originFromPublicUrl(webUrl, webUrl.replace(/\/+$/, ""));

14}

15/** Known web origins with a fixed platform API — undefined for custom/staging URLs. */

16function knownPlatformUrlForWebUrl(webUrl) {

17 const webOrigin = webOriginFromUrl(webUrl);

18 if (webOrigin === "http://localhost:3000" || webOrigin === "http://127.0.0.1:3000") return LOCAL_PLATFORM_ORIGIN;

19 if (webOrigin === "https://keystroke.ai") return DEFAULT_PLATFORM_URL;

20}

21function resolvePlatformUrlForWebUrl(webUrl, options = {}) {

22 const explicit = options.platformUrl?.trim();

23 if (explicit) return explicit.replace(/\/+$/, "");

24 const known = knownPlatformUrlForWebUrl(webUrl);

25 if (known) return known;

26 return (options.fallback?.trim() || "https://api.keystroke.ai").replace(/\/+$/, "");

dist/dist-9VWONIo1.mjsView file

Lines 299-339javascript

299 start(controller) {

300 parser = createParser({

301 onEvent: (event) => {

302 controller.enqueue(event);

303 },

304 onError(error) {

305 onError ===

dist/js-exec-N5KEZBH7-CgtG-I6s.mjsView file

Lines 28-68javascript

28 --strip-types Strip TypeScript type annotations

29 --version, -V Show version

30 --help Show this help

32Examples:

33 js-exec -c "console.log(1 + 2)"

34 js-exec script.js

35 js-exec app.ts

36 echo 'console.log("hello")' | js-exec

38File Extension Auto-Detection:

dist/dist-BcxMnb_L.mjsView file

•path = dist/dist-BcxMnb_L.mjs kind = oversized_source_file sizeBytes = 8709615 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/dist-BcxMnb_L.mjsView on unpkg

•path = dist/dist-BcxMnb_L.mjs kind = oversized_cli_entrypoint sizeBytes = 8709615 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/dist-BcxMnb_L.mjsView on unpkg

dist/index.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/index.mjsView on unpkg

Lines 6723-6763javascript

6723 } : { ref: sch.schema }),

6724 validateName,

6725 ValidationError: _ValidationError,

6726 schema: sch.schema,

6727 schemaEnv: sch,

6728 rootId,

6729 baseId: sch.baseId || rootId,

6730 schemaPath: codegen_1.nil,

6731 errSchemaPath: sch.schemaPath || (this.opts.jtd ? "" : "#"),

6732 errorPath: (0, codegen_1._)`""`,

6733 opts: this.opts,

6734 self: this

6735 };

6736 let sourceCode;

6737 try {

6738 this._compilations.add(sch);

6739 (0, validate_1.validateFunctionCode)(schemaCxt);

6740 gen.optimize(this.opts.code.optimize);

6741 const validateCode = gen.toString();

6742 sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${validateCode}`;

6743 if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch);

6744 const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get());

6745 this.scope.value(validateName, { ref: validate });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-9VWONIo1.mjsView on unpkg · L6743

6746 validate.errors = null;

6747 validate.schema = sch.schema;

6748 validate.schemaEnv = sch;

6749 if (sch.$async) validate.$async = true;

6750 if (this.opts.code.source === true) validate.source = {

6751 validateName,

6752 validateCode,

6753 scopeValues: gen._values

6754 };

6755 if (this.opts.unevaluated) {

6756 const { props, items } = schemaCxt;

6757 validate.evaluated = {

6758 props: props instanceof codegen_1.Name ? void 0 : props,

6759 items: items instanceof codegen_1.Name ? void 0 : items,

6760 dynamicProps: props instanceof codegen_1.Name,

6761 dynamicItems: items instanceof codegen_1.Name

6762 };

6763 if (validate.source) validate.source.evaluated = (0, codegen_1.stringify)(validate.evaluated);