registry / @keystrokehq/cli / 0.1.38

@keystrokehq/cli@0.1.38

⚠ Under review

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsObfuscatedTelemetryUrlStrings

Manifest

NoLicense

scanned 127 file(s), 3.76 MB of source, external domains: 127.0.0.1, angular.io, api.keystroke.ai, cscott.net, datatracker.ietf.org, dom.spec.whatwg.org, empty.invalid, example.com, github.com, json-schema.org, keystroke.ai, landley.net, raw.githubusercontent.com, registry.npmjs.org, trac.webkit.org, www.ibm.com, www.w3.org, www.whatwg.org

Source & flagged code

5 flagged

dist/maybe-auto-update-Dv4MJvWb.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import { l as getCliConfigDir, r as detectPackageManager, s as resolveCliRoot, t as readCliVersion } from "./version-CiFlKPyE.mjs";

3import { dirname, join } from "node:path";

4import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";

5import { spawnSync } from "node:child_process";

6//#region src/update/compare-version.ts

High

Child Process

Package source references child process execution.

dist/maybe-auto-update-Dv4MJvWb.mjsView on unpkg · L4

7function parseVersion(version) {

8 const [major = 0, minor = 0, patch = 0] = (version.trim().replace(/^v/, "").split("-")[0] ?? "").split(".").map((part) => {

9 const value = Number.parseInt(part, 10);

10 return Number.isFinite(value) ? value : 0;

11 });

12 return [

13 major,

14 minor,

15 patch

16 ];

17}

18function isNewerVersion(latest, current) {

19 const [latestMajor, latestMinor, latestPatch] = parseVersion(latest);

20 const [currentMajor, currentMinor, currentPatch] = parseVersion(current);

21 if (latestMajor !== currentMajor) return latestMajor > currentMajor;

22 if (latestMinor !== currentMinor) return latestMinor > currentMinor;

23 return latestPatch > currentPatch;

24}

dist/dist-DkLbeW8l.mjsView file

Lines 121-161javascript

121 });

122}

123function mergeDefs(...defs) {

124 const mergedDescriptors = {};

125 for (const def of defs) Object.assign(mergedDescriptors, Object.getOwnPropertyDescriptors(def));

126

dist/lzma-CTMDi254.mjsView file

Lines 327-367javascript

327//#endregion

328//#region ../../node_modules/.pnpm/node-liblzma@2.2.0/node_modules/node-liblzma/lib/lzma.js

329/**

330* node-liblzma - Node.js bindings for liblzma

331* Copyright (C) Olivier Orabona <olivier.orabona@gmail.com>

332*

333* This program is free software: you can redistribute it and/or modify

334* it under the terms of the GNU Lesser General Public License as published by

335* the Free Software Foundation, either version 3 of the License, or

336* (at your option) any later version.

337*

dist/js-exec-N5KEZBH7-CgtG-I6s.mjsView file

Lines 28-68javascript

28 --strip-types Strip TypeScript type annotations

29 --version, -V Show version

30 --help Show this help

32Examples:

33 js-exec -c "console.log(1 + 2)"

34 js-exec script.js

35 js-exec app.ts

36 echo 'console.log("hello")' | js-exec

38File Extension Auto-Detection:

dist/dist-B6z1wti6.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @keystrokehq/cli@0.1.24 matchedIdentity = npm:QGtleXN0cm9rZWhxL2NsaQ:0.1.24 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/dist-B6z1wti6.mjsView on unpkg

Source & flagged code

5 flagged · loading source

dist/maybe-auto-update-Dv4MJvWb.mjsView file

4import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs"; L5: import { spawnSync } from "node:child_process"; L6: //#region src/update/compare-version.ts

High

Child Process

Package source references child process execution.

dist/maybe-auto-update-Dv4MJvWb.mjsView on unpkg · L4

dist/dist-DkLbeW8l.mjsView file

141try { L142: new Function(""); L143: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-DkLbeW8l.mjsView on unpkg · L141

dist/lzma-CTMDi254.mjsView file

347const __dirname = path.dirname(__filename); L348: const require = createRequire(import.meta.url); L349: const bindingPath = path.resolve(path.join(__dirname, ".."));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lzma-CTMDi254.mjsView on unpkg · L347

dist/js-exec-N5KEZBH7-CgtG-I6s.mjsView file

48Cross-file remote execution chain: dist/js-exec-N5KEZBH7-CgtG-I6s.mjs spawns dist/chunk-TN7HHBQW-CSB_R-XD.mjs; helper contains network access plus dynamic code execution. L48: Available modules: L49: fs, path, child_process, process, console, L50: os, url, assert, util, events, buffer, stream, ... L63: child_process: L64: execSync(cmd) throws on non-zero exit, returns stdout L65: spawnSync(cmd, args) returns { stdout, stderr, status } ... L69: L70: os: platform(), arch(), homedir(), tmpdir(), type(), hostname(), L71: EOL, cpus(), endianness() L72: L73: url: URL, URLSearchParams, parse(), format() L74:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/js-exec-N5KEZBH7-CgtG-I6s.mjsView on unpkg · L48

dist/dist-B6z1wti6.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/dist-B6z1wti6.mjsView on unpkg

Findings

1 Critical3 High4 Medium8 Low

CriticalPrevious Version Dangerous Deltadist/dist-B6z1wti6.mjs

HighChild Processdist/maybe-auto-update-Dv4MJvWb.mjs

HighShell

HighCross File Remote Execution Contextdist/js-exec-N5KEZBH7-CgtG-I6s.mjs

MediumDynamic Requiredist/lzma-CTMDi254.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/dist-DkLbeW8l.mjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/maybe-auto-update-Dv4MJvWb.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import { l as getCliConfigDir, r as detectPackageManager, s as resolveCliRoot, t as readCliVersion } from "./version-CiFlKPyE.mjs";

3import { dirname, join } from "node:path";

4import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";

5import { spawnSync } from "node:child_process";

6//#region src/update/compare-version.ts

High

Child Process

Package source references child process execution.

dist/maybe-auto-update-Dv4MJvWb.mjsView on unpkg · L4

7function parseVersion(version) {

8 const [major = 0, minor = 0, patch = 0] = (version.trim().replace(/^v/, "").split("-")[0] ?? "").split(".").map((part) => {

9 const value = Number.parseInt(part, 10);

10 return Number.isFinite(value) ? value : 0;

11 });

12 return [

13 major,

14 minor,

15 patch

16 ];

17}

18function isNewerVersion(latest, current) {

19 const [latestMajor, latestMinor, latestPatch] = parseVersion(latest);

20 const [currentMajor, currentMinor, currentPatch] = parseVersion(current);

21 if (latestMajor !== currentMajor) return latestMajor > currentMajor;

22 if (latestMinor !== currentMinor) return latestMinor > currentMinor;

23 return latestPatch > currentPatch;

24}

dist/dist-DkLbeW8l.mjsView file

Lines 121-161javascript

121 });

122}

123function mergeDefs(...defs) {

124 const mergedDescriptors = {};

125 for (const def of defs) Object.assign(mergedDescriptors, Object.getOwnPropertyDescriptors(def));

126

dist/lzma-CTMDi254.mjsView file

Lines 327-367javascript

327//#endregion

328//#region ../../node_modules/.pnpm/node-liblzma@2.2.0/node_modules/node-liblzma/lib/lzma.js

329/**

330* node-liblzma - Node.js bindings for liblzma

331* Copyright (C) Olivier Orabona <olivier.orabona@gmail.com>

332*

333* This program is free software: you can redistribute it and/or modify

334* it under the terms of the GNU Lesser General Public License as published by

335* the Free Software Foundation, either version 3 of the License, or

336* (at your option) any later version.

337*

dist/js-exec-N5KEZBH7-CgtG-I6s.mjsView file

Lines 28-68javascript

28 --strip-types Strip TypeScript type annotations

29 --version, -V Show version

30 --help Show this help

32Examples:

33 js-exec -c "console.log(1 + 2)"

34 js-exec script.js

35 js-exec app.ts

36 echo 'console.log("hello")' | js-exec

38File Extension Auto-Detection:

dist/dist-B6z1wti6.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/dist-B6z1wti6.mjsView on unpkg