registry  /  @keystrokehq/keystroke  /  0.1.28

@keystrokehq/keystroke@0.1.28

Keystroke authoring facade — re-exports primitives for user projects.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
Supply chain
HighEntropyStringsObfuscatedTelemetryUrlStrings
Manifest
NoLicense
scanned 386 file(s), 8.76 MB of source, external domains: ai-gateway.vercel.sh, ai-sdk.dev, angular.io, api.keystroke.ai, api.vercel.com, cscott.net, datatracker.ietf.org, dom.spec.whatwg.org, example.com, github.com, json-schema.org, landley.net, raw.githubusercontent.com, trac.webkit.org, vercel.com, www.ibm.com, www.w3.org, www.whatwg.org

Source & flagged code

5 flagged · loading source
dist/dist-jRbaylLr.mjsView file
17378} L17379: async exec(t, s) { L17380: if (this.state.callDepth === 0 && (this.state.commandCount = 0), this.state.commandCount++, this.state.commandCount > this.limits.maxCommandCount) return {
High
Child Process

Package source references child process execution.

dist/dist-jRbaylLr.mjsView on unpkg · L17378
dist/dist-Bmjy7TiE.mjsView file
33692if (error) { L33693: if (command.name === "exec" && error.message === "EXECABORT Transaction discarded because of previous errors.") continue; L33694: if (!commonError) commonError = {
High
Shell

Package source references shell execution.

dist/dist-Bmjy7TiE.mjsView on unpkg · L33692
dist/chunk-TN7HHBQW-D_SK6w5n.cjsView file
17strategy: "throw", L18: reason: "eval() allows arbitrary code execution" L19: },
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-TN7HHBQW-D_SK6w5n.cjsView on unpkg · L17
dist/diff-MWJFIG7X-42sr7rDc.cjsView file
1require("./dist-D7ENCZrw.cjs"); L2: require("./chunk-BZUGFHVS-7RRM7Jpb.cjs");
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/diff-MWJFIG7X-42sr7rDc.cjsView on unpkg · L1
dist/js-exec-N5KEZBH7-BYZdHawz.mjsView file
40Cross-file remote execution chain: dist/js-exec-N5KEZBH7-BYZdHawz.mjs spawns dist/dist-jRbaylLr.mjs; helper contains network access plus dynamic code execution. L40: Available modules: L41: fs, path, child_process, process, console, L42: os, url, assert, util, events, buffer, stream, ... L55: child_process: L56: execSync(cmd) throws on non-zero exit, returns stdout L57: spawnSync(cmd, args) returns { stdout, stderr, status } ... L61: L62: os: platform(), arch(), homedir(), tmpdir(), type(), hostname(), L63: EOL, cpus(), endianness() L64: L65: url: URL, URLSearchParams, parse(), format() L66:
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/js-exec-N5KEZBH7-BYZdHawz.mjsView on unpkg · L40

Findings

3 High4 Medium8 Low
HighChild Processdist/dist-jRbaylLr.mjs
HighShelldist/dist-Bmjy7TiE.mjs
HighCross File Remote Execution Contextdist/js-exec-N5KEZBH7-BYZdHawz.mjs
MediumDynamic Requiredist/diff-MWJFIG7X-42sr7rDc.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/chunk-TN7HHBQW-D_SK6w5n.cjs
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License