registry / @keystrokehq/cli / 0.1.47

@keystrokehq/cli@0.1.47

⚠ Under review

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsObfuscatedTelemetryUrlStrings

Manifest

NoLicense

scanned 127 file(s), 4.05 MB of source, external domains: 127.0.0.1, angular.io, api.keystroke.ai, cscott.net, datatracker.ietf.org, dom.spec.whatwg.org, empty.invalid, example.com, github.com, json-schema.org, keystroke.ai, landley.net, raw.githubusercontent.com, registry.npmjs.org, trac.webkit.org, www.ibm.com, www.w3.org, www.whatwg.org

Source & flagged code

6 flagged

dist/js-exec-N5KEZBH7-CgtG-I6s.mjsView file

Lines 28-68javascript

28 --strip-types Strip TypeScript type annotations

29 --version, -V Show version

30 --help Show this help

32Examples:

33 js-exec -c "console.log(1 + 2)"

34 js-exec script.js

35 js-exec app.ts

36 echo 'console.log("hello")' | js-exec

38File Extension Auto-Detection:

39 .js script mode (module mode if top-level await detected)

40 .mjs ES module mode

41 .ts, .mts ES module mode + TypeScript stripping

43Node.js Compatibility:

44 Code written for Node.js largely works here. Both require and import

45 are supported, the node: prefix works, and standard globals like process,

46 console, and fetch are available. All I/O is synchronous.

48 Available modules:

49 fs, path, child_process, process, console,

50 os, url, assert, util, events, buffer, stream,

High

Child Process

Package source references child process execution.

dist/js-exec-N5KEZBH7-CgtG-I6s.mjsView on unpkg · L48

51 string_decoder, querystring

53 fs (global, require('fs'), or import from 'node:fs'):

54 readFileSync, writeFileSync, appendFileSync, copyFileSync, renameSync

55 readdirSync, mkdirSync, rmSync, unlinkSync, rmdirSync

56 statSync, lstatSync, existsSync, realpathSync, chmodSync

57 symlinkSync, readlinkSync, readFileBuffer

58 fs.promises.readFile, fs.promises.writeFile, fs.promises.access, ...

60 path: join, resolve, dirname, basename, extname, normalize,

61 relative, isAbsolute, parse, format, sep, delimiter

63 child_process:

64 execSync(cmd) throws on non-zero exit, returns stdout

65 spawnSync(cmd, args) returns { stdout, stderr, status }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/js-exec-N5KEZBH7-CgtG-I6s.mjsView on unpkg · L48

67 process (also global): argv, cwd(), exit(), env, platform, arch,

68 version, versions

dist/dist-83uw4_yr.mjsView file

Lines 6723-6763javascript

6723 } : { ref: sch.schema }),

6724 validateName,

6725 ValidationError: _ValidationError,

6726 schema: sch.schema,

6727 schemaEnv: sch,

6728 rootId,

6729 baseId: sch.baseId || rootId,

6730 schemaPath: codegen_1.nil,

6731

dist/lzma-CTMDi254.mjsView file

Lines 327-367javascript

327//#endregion

328//#region ../../node_modules/.pnpm/node-liblzma@2.2.0/node_modules/node-liblzma/lib/lzma.js

329/**

330* node-liblzma - Node.js bindings for liblzma

331* Copyright (C) Olivier Orabona <olivier.orabona@gmail.com>

332*

333* This program is free software: you can redistribute it and/or modify

334* it under the terms of the GNU Lesser General Public License as published by

335* the Free Software Foundation, either version 3 of the License, or

336* (at your option) any later version.

337*

dist/dist-BmO-d0ms.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @keystrokehq/cli@0.1.24 matchedIdentity = npm:QGtleXN0cm9rZWhxL2NsaQ:0.1.24 similarity = 0.950 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/dist-BmO-d0ms.mjsView on unpkg

333} L334: return process.env.KEYSTROKE_ROOT ?? process.cwd(); L335: } ... L1261: nodeType, L1262: data: { L1263: label, ... L2111: { L2112: name: "base64", L2113: load: async () => (await import("./base64-C2AIWVNC-C0WIgu5V.mjs")).base64Command ... L2230: Object.freeze({ L2231: stdout: "", L2232: stderr: "",

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/dist-BmO-d0ms.mjsView on unpkg · L333

Source & flagged code

6 flagged · loading source

dist/js-exec-N5KEZBH7-CgtG-I6s.mjsView file

48Available modules: L49: fs, path, child_process, process, console, L50: os, url, assert, util, events, buffer, stream,

High

Child Process

Package source references child process execution.

dist/js-exec-N5KEZBH7-CgtG-I6s.mjsView on unpkg · L48

48Cross-file remote execution chain: dist/js-exec-N5KEZBH7-CgtG-I6s.mjs spawns dist/chunk-TN7HHBQW-CSB_R-XD.mjs; helper contains network access plus dynamic code execution. L48: Available modules: L49: fs, path, child_process, process, console, L50: os, url, assert, util, events, buffer, stream, ... L63: child_process: L64: execSync(cmd) throws on non-zero exit, returns stdout L65: spawnSync(cmd, args) returns { stdout, stderr, status } ... L69: L70: os: platform(), arch(), homedir(), tmpdir(), type(), hostname(), L71: EOL, cpus(), endianness() L72: L73: url: URL, URLSearchParams, parse(), format() L74:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/js-exec-N5KEZBH7-CgtG-I6s.mjsView on unpkg · L48

dist/dist-83uw4_yr.mjsView file

6743if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L6744: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L6745: this.scope.value(validateName, { ref: validate });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-83uw4_yr.mjsView on unpkg · L6743

dist/lzma-CTMDi254.mjsView file

347const __dirname = path.dirname(__filename); L348: const require = createRequire(import.meta.url); L349: const bindingPath = path.resolve(path.join(__dirname, ".."));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lzma-CTMDi254.mjsView on unpkg · L347

dist/dist-BmO-d0ms.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/dist-BmO-d0ms.mjsView on unpkg

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/dist-BmO-d0ms.mjsView on unpkg · L333

Findings

1 Critical3 High5 Medium8 Low

CriticalPrevious Version Dangerous Deltadist/dist-BmO-d0ms.mjs

HighChild Processdist/js-exec-N5KEZBH7-CgtG-I6s.mjs

HighShell

HighCross File Remote Execution Contextdist/js-exec-N5KEZBH7-CgtG-I6s.mjs

MediumDynamic Requiredist/lzma-CTMDi254.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/dist-BmO-d0ms.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/dist-83uw4_yr.mjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

dist/js-exec-N5KEZBH7-CgtG-I6s.mjsView file

Lines 28-68javascript

28 --strip-types Strip TypeScript type annotations

29 --version, -V Show version

30 --help Show this help

32Examples:

33 js-exec -c "console.log(1 + 2)"

34 js-exec script.js

35 js-exec app.ts

36 echo 'console.log("hello")' | js-exec

38File Extension Auto-Detection:

39 .js script mode (module mode if top-level await detected)

40 .mjs ES module mode

41 .ts, .mts ES module mode + TypeScript stripping

43Node.js Compatibility:

44 Code written for Node.js largely works here. Both require and import

45 are supported, the node: prefix works, and standard globals like process,

46 console, and fetch are available. All I/O is synchronous.

48 Available modules:

49 fs, path, child_process, process, console,

50 os, url, assert, util, events, buffer, stream,

High

Child Process

Package source references child process execution.

dist/js-exec-N5KEZBH7-CgtG-I6s.mjsView on unpkg · L48

51 string_decoder, querystring

53 fs (global, require('fs'), or import from 'node:fs'):

54 readFileSync, writeFileSync, appendFileSync, copyFileSync, renameSync

55 readdirSync, mkdirSync, rmSync, unlinkSync, rmdirSync

56 statSync, lstatSync, existsSync, realpathSync, chmodSync

57 symlinkSync, readlinkSync, readFileBuffer

58 fs.promises.readFile, fs.promises.writeFile, fs.promises.access, ...

60 path: join, resolve, dirname, basename, extname, normalize,

61 relative, isAbsolute, parse, format, sep, delimiter

63 child_process:

64 execSync(cmd) throws on non-zero exit, returns stdout

65 spawnSync(cmd, args) returns { stdout, stderr, status }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/js-exec-N5KEZBH7-CgtG-I6s.mjsView on unpkg · L48

67 process (also global): argv, cwd(), exit(), env, platform, arch,

68 version, versions

dist/dist-83uw4_yr.mjsView file

Lines 6723-6763javascript

6723 } : { ref: sch.schema }),

6724 validateName,

6725 ValidationError: _ValidationError,

6726 schema: sch.schema,

6727 schemaEnv: sch,

6728 rootId,

6729 baseId: sch.baseId || rootId,

6730 schemaPath: codegen_1.nil,

6731

dist/lzma-CTMDi254.mjsView file

Lines 327-367javascript

327//#endregion

328//#region ../../node_modules/.pnpm/node-liblzma@2.2.0/node_modules/node-liblzma/lib/lzma.js

329/**

330* node-liblzma - Node.js bindings for liblzma

331* Copyright (C) Olivier Orabona <olivier.orabona@gmail.com>

332*

333* This program is free software: you can redistribute it and/or modify

334* it under the terms of the GNU Lesser General Public License as published by

335* the Free Software Foundation, either version 3 of the License, or

336* (at your option) any later version.

337*

dist/dist-BmO-d0ms.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/dist-BmO-d0ms.mjsView on unpkg

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/dist-BmO-d0ms.mjsView on unpkg · L333