registry / @keystrokehq/keystroke / 0.1.25

@keystrokehq/keystroke@0.1.25

Keystroke authoring facade — re-exports primitives for user projects.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsObfuscatedTelemetryUrlStrings

Manifest

NoLicense

scanned 386 file(s), 8.76 MB of source, external domains: ai-gateway.vercel.sh, ai-sdk.dev, angular.io, api.keystroke.ai, api.vercel.com, cscott.net, datatracker.ietf.org, dom.spec.whatwg.org, example.com, github.com, json-schema.org, landley.net, raw.githubusercontent.com, trac.webkit.org, vercel.com, www.ibm.com, www.w3.org, www.whatwg.org

Source & flagged code

5 flagged

dist/chunk-4RUAZWKT-CISqwIli.mjsView file

Lines 22337-22377javascript

22337 _matcher = null;

22338 _matcherInput = null;

22339 acquireMatcher(t) {

22340 return this._matcher === null ? (this._matcher = this._re2.matcher(t), this._matcherInput = t, this._matcher) : (this._matcherInput !== t && (this._matcher.matcherInput.charSequence = t, this._matcherInput = t), this._matcher.reset(), this._matcher);

22341 }

22342 constructor(t, e = "") {

22343 this._pattern = t, this._flags = e, this._global = e.includes("g"), this._ignoreCase = e.includes("i"), this._multiline = e.includes("m");

22344 try {

22345 let s = L1(t), n = x1(e);

22346 this._re2 = y.compile(s, n);

22347 } catch (s) {

22348 if (s instanceof m) {

22349 let n = s.message || "", r = "";

22350 throw n.includes("(?=") || n.includes("(?!") || n.includes("(?<") || n.includes("(?<!") || t.includes("(?=") || t.includes("(?!") || t.includes("(?<=") || t.includes("(?<!"

22351 }

22352 throw s;

22353 }

22354 }

22355 test(t) {

22356 return this._global && (this._lastIndex = 0), this.acquireMatcher(t).find();

22357 }

22358 exec(t) {

22359 let e = this.acquireMatcher(t), s = this._global ? this._lastIndex : 0;

High

Child Process

Package source references child process execution.

dist/chunk-4RUAZWKT-CISqwIli.mjsView on unpkg · L22357

22360 if (!e.find(s)) return this._global && (this._lastIndex = 0), null;

22361 let n = this._re2.groupCount(), r = [];

22362 r.push(e.group(0) ?? "");

22363 for (let h = 1; h <= n; h++) {

22364 let p = e.group(h);

22365 r.push(p);

22366 }

22367 let a = r;

22368 a.index = e.start(0), a.input = t;

22369 let o = this._re2.namedGroups();

22370 if (o && Object.keys(o).length > 0) {

22371 let h = Object.create(null);

22372 for (let [p, f] of Object.entries(o)) {

22373 let A = e.group(f);

22374 A !== null && (h[p] = A);

22375 }

22376 a.groups = h;

22377 }

Long lines were clipped for display.

dist/dist-DXQ9dYvL.mjsView file

33692if (error) { L33693: if (command.name === "exec" && error.message === "EXECABORT Transaction discarded because of previous errors.") continue; L33694: if (!commonError) commonError = {

High

Shell

Package source references shell execution.

dist/dist-DXQ9dYvL.mjsView on unpkg · L33692

dist/chunk-TN7HHBQW-D_SK6w5n.cjsView file

Lines 1-37javascript

1const require_chunk_BZUGFHVS = require("./chunk-BZUGFHVS-7RRM7Jpb.cjs");

2//#region ../../node_modules/.pnpm/just-bash@3.0.1/node_modules/just-bash/dist/bundle/chunks/chunk-TN7HHBQW.js

3(0, require("node:module").createRequire)(require("url").pathToFileURL(__filename).href);

4function v() {

5 let

dist/tr-36LHWFRQ-CJUEJlEm.cjsView file

Lines 1-11javascript

1require("./dist-D8doj-M6.cjs");

2require("./chunk-BZUGFHVS-7RRM7Jpb.cjs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tr-36LHWFRQ-CJUEJlEm.cjsView on unpkg · L1

3require("./chunk-QAYAQNCG-ROQh1hrZ.cjs");

4require("./chunk-QIQMJJZ4-Cm4e9-4O.cjs");

5const require_chunk_HJBTD7PY =

dist/js-exec-N5KEZBH7-BuBt5sPH.cjsView file

Lines 20-60javascript

20 --strip-types Strip TypeScript type annotations

21 --version, -V Show version

22 --help Show this help

24Examples:

25 js-exec -c "console.log(1 + 2)"

26 js-exec script.js

27 js-exec app.ts

28 echo 'console.log("hello")' | js-exec

30File Extension Auto-Detection:

Source & flagged code

5 flagged · loading source

dist/chunk-4RUAZWKT-CISqwIli.mjsView file

22357} L22358: exec(t) { L22359: let e = this.acquireMatcher(t), s = this._global ? this._lastIndex : 0;

High

Child Process

Package source references child process execution.

dist/chunk-4RUAZWKT-CISqwIli.mjsView on unpkg · L22357

dist/dist-DXQ9dYvL.mjsView file

33692if (error) { L33693: if (command.name === "exec" && error.message === "EXECABORT Transaction discarded because of previous errors.") continue; L33694: if (!commonError) commonError = {

High

Shell

Package source references shell execution.

dist/dist-DXQ9dYvL.mjsView on unpkg · L33692

dist/chunk-TN7HHBQW-D_SK6w5n.cjsView file

17strategy: "throw", L18: reason: "eval() allows arbitrary code execution" L19: },

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-TN7HHBQW-D_SK6w5n.cjsView on unpkg · L17

dist/tr-36LHWFRQ-CJUEJlEm.cjsView file

1require("./dist-D8doj-M6.cjs"); L2: require("./chunk-BZUGFHVS-7RRM7Jpb.cjs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tr-36LHWFRQ-CJUEJlEm.cjsView on unpkg · L1

dist/js-exec-N5KEZBH7-BuBt5sPH.cjsView file

40Cross-file remote execution chain: dist/js-exec-N5KEZBH7-BuBt5sPH.cjs spawns dist/chunk-TN7HHBQW-D_SK6w5n.cjs; helper contains network access plus dynamic code execution. L40: Available modules: L41: fs, path, child_process, process, console, L42: os, url, assert, util, events, buffer, stream, ... L55: child_process: L56: execSync(cmd) throws on non-zero exit, returns stdout L57: spawnSync(cmd, args) returns { stdout, stderr, status } ... L61: L62: os: platform(), arch(), homedir(), tmpdir(), type(), hostname(), L63: EOL, cpus(), endianness() L64: L65: url: URL, URLSearchParams, parse(), format() L66:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/js-exec-N5KEZBH7-BuBt5sPH.cjsView on unpkg · L40

Findings

3 High4 Medium8 Low

HighChild Processdist/chunk-4RUAZWKT-CISqwIli.mjs

HighShelldist/dist-DXQ9dYvL.mjs

HighCross File Remote Execution Contextdist/js-exec-N5KEZBH7-BuBt5sPH.cjs

MediumDynamic Requiredist/tr-36LHWFRQ-CJUEJlEm.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/chunk-TN7HHBQW-D_SK6w5n.cjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/chunk-4RUAZWKT-CISqwIli.mjsView file

Lines 22337-22377javascript

22337 _matcher = null;

22338 _matcherInput = null;

22339 acquireMatcher(t) {

22341 }

22342 constructor(t, e = "") {

22343 this._pattern = t, this._flags = e, this._global = e.includes("g"), this._ignoreCase = e.includes("i"), this._multiline = e.includes("m");

22344 try {

22345 let s = L1(t), n = x1(e);

22346 this._re2 = y.compile(s, n);

22347 } catch (s) {

22348 if (s instanceof m) {

22349 let n = s.message || "", r = "";

22350 throw n.includes("(?=") || n.includes("(?!") || n.includes("(?<") || n.includes("(?<!") || t.includes("(?=") || t.includes("(?!") || t.includes("(?<=") || t.includes("(?<!"

22351 }

22352 throw s;

22353 }

22354 }

22355 test(t) {

22356 return this._global && (this._lastIndex = 0), this.acquireMatcher(t).find();

22357 }

22358 exec(t) {

22359 let e = this.acquireMatcher(t), s = this._global ? this._lastIndex : 0;

High

Child Process

Package source references child process execution.

dist/chunk-4RUAZWKT-CISqwIli.mjsView on unpkg · L22357

22360 if (!e.find(s)) return this._global && (this._lastIndex = 0), null;

22361 let n = this._re2.groupCount(), r = [];

22362 r.push(e.group(0) ?? "");

22363 for (let h = 1; h <= n; h++) {

22364 let p = e.group(h);

22365 r.push(p);

22366 }

22367 let a = r;

22368 a.index = e.start(0), a.input = t;

22369 let o = this._re2.namedGroups();

22370 if (o && Object.keys(o).length > 0) {

22371 let h = Object.create(null);

22372 for (let [p, f] of Object.entries(o)) {

22373 let A = e.group(f);

22374 A !== null && (h[p] = A);

22375 }

22376 a.groups = h;

22377 }

Long lines were clipped for display.

dist/dist-DXQ9dYvL.mjsView file

33692if (error) { L33693: if (command.name === "exec" && error.message === "EXECABORT Transaction discarded because of previous errors.") continue; L33694: if (!commonError) commonError = {

High

Shell

Package source references shell execution.

dist/dist-DXQ9dYvL.mjsView on unpkg · L33692

dist/chunk-TN7HHBQW-D_SK6w5n.cjsView file

Lines 1-37javascript

1const require_chunk_BZUGFHVS = require("./chunk-BZUGFHVS-7RRM7Jpb.cjs");

2//#region ../../node_modules/.pnpm/just-bash@3.0.1/node_modules/just-bash/dist/bundle/chunks/chunk-TN7HHBQW.js

3(0, require("node:module").createRequire)(require("url").pathToFileURL(__filename).href);

4function v() {

5 let

dist/tr-36LHWFRQ-CJUEJlEm.cjsView file

Lines 1-11javascript

1require("./dist-D8doj-M6.cjs");

2require("./chunk-BZUGFHVS-7RRM7Jpb.cjs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tr-36LHWFRQ-CJUEJlEm.cjsView on unpkg · L1

3require("./chunk-QAYAQNCG-ROQh1hrZ.cjs");

4require("./chunk-QIQMJJZ4-Cm4e9-4O.cjs");

5const require_chunk_HJBTD7PY =

dist/js-exec-N5KEZBH7-BuBt5sPH.cjsView file

Lines 20-60javascript

20 --strip-types Strip TypeScript type annotations

21 --version, -V Show version

22 --help Show this help

24Examples:

25 js-exec -c "console.log(1 + 2)"

26 js-exec script.js

27 js-exec app.ts

28 echo 'console.log("hello")' | js-exec

30File Extension Auto-Detection: