registry / @keystrokehq/keystroke / 0.1.29

@keystrokehq/keystroke@0.1.29

Keystroke authoring facade — re-exports primitives for user projects.

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsObfuscatedTelemetryUrlStrings

Manifest

NoLicense

scanned 386 file(s), 8.76 MB of source, external domains: ai-gateway.vercel.sh, ai-sdk.dev, angular.io, api.keystroke.ai, api.vercel.com, cscott.net, datatracker.ietf.org, dom.spec.whatwg.org, example.com, github.com, json-schema.org, landley.net, raw.githubusercontent.com, trac.webkit.org, vercel.com, www.ibm.com, www.w3.org, www.whatwg.org

Source & flagged code

5 flagged

dist/js-exec-N5KEZBH7-CqxMtdCQ.cjsView file

Lines 20-60javascript

20 --strip-types Strip TypeScript type annotations

21 --version, -V Show version

22 --help Show this help

24Examples:

25 js-exec -c "console.log(1 + 2)"

26 js-exec script.js

27 js-exec app.ts

28 echo 'console.log("hello")' | js-exec

30File Extension Auto-Detection:

31 .js script mode (module mode if top-level await detected)

32 .mjs ES module mode

33 .ts, .mts ES module mode + TypeScript stripping

35Node.js Compatibility:

36 Code written for Node.js largely works here. Both require and import

37 are supported, the node: prefix works, and standard globals like process,

38 console, and fetch are available. All I/O is synchronous.

40 Available modules:

41 fs, path, child_process, process, console,

42 os, url, assert, util, events, buffer, stream,

High

Child Process

Package source references child process execution.

dist/js-exec-N5KEZBH7-CqxMtdCQ.cjsView on unpkg · L40

43 string_decoder, querystring

45 fs (global, require('fs'), or import from 'node:fs'):

46 readFileSync, writeFileSync, appendFileSync, copyFileSync, renameSync

47 readdirSync, mkdirSync, rmSync, unlinkSync, rmdirSync

48 statSync, lstatSync, existsSync, realpathSync, chmodSync

49 symlinkSync, readlinkSync, readFileBuffer

50 fs.promises.readFile, fs.promises.writeFile, fs.promises.access, ...

52 path: join, resolve, dirname, basename, extname, normalize,

53 relative, isAbsolute, parse, format, sep, delimiter

55 child_process:

56 execSync(cmd) throws on non-zero exit, returns stdout

57 spawnSync(cmd, args) returns { stdout, stderr, status }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/js-exec-N5KEZBH7-CqxMtdCQ.cjsView on unpkg · L40

59 process (also global): argv, cwd(), exit(), env, platform, arch,

60 version, versions

dist/dist-BmiFk6Ob.mjsView file

33692if (error) { L33693: if (command.name === "exec" && error.message === "EXECABORT Transaction discarded because of previous errors.") continue; L33694: if (!commonError) commonError = {

High

Shell

Package source references shell execution.

dist/dist-BmiFk6Ob.mjsView on unpkg · L33692

dist/chunk-TN7HHBQW-D_SK6w5n.cjsView file

Lines 1-37javascript

1const require_chunk_BZUGFHVS = require("./chunk-BZUGFHVS-7RRM7Jpb.cjs");

2//#region ../../node_modules/.pnpm/just-bash@3.0.1/node_modules/just-bash/dist/bundle/chunks/chunk-TN7HHBQW.js

3(0, require("node:module").createRequire)(require("url").pathToFileURL(__filename).href);

4function v() {

5 let

dist/bash-YZ33HQZQ-DRnFYBAC.cjsView file

Lines 1-11javascript

1require("./dist-GGdiZS7K.cjs");

2require("./chunk-BZUGFHVS-7RRM7Jpb.cjs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bash-YZ33HQZQ-DRnFYBAC.cjsView on unpkg · L1

3require("./chunk-QAYAQNCG-ROQh1hrZ.cjs");

4const require_chunk_GSPYNYZA = require("./chunk-GSPYNYZA-Bauaqn7k.cjs");

Source & flagged code

5 flagged · loading source

dist/js-exec-N5KEZBH7-CqxMtdCQ.cjsView file

40Available modules: L41: fs, path, child_process, process, console, L42: os, url, assert, util, events, buffer, stream,

High

Child Process

Package source references child process execution.

dist/js-exec-N5KEZBH7-CqxMtdCQ.cjsView on unpkg · L40

40Cross-file remote execution chain: dist/js-exec-N5KEZBH7-CqxMtdCQ.cjs spawns dist/chunk-TN7HHBQW-D_SK6w5n.cjs; helper contains network access plus dynamic code execution. L40: Available modules: L41: fs, path, child_process, process, console, L42: os, url, assert, util, events, buffer, stream, ... L55: child_process: L56: execSync(cmd) throws on non-zero exit, returns stdout L57: spawnSync(cmd, args) returns { stdout, stderr, status } ... L61: L62: os: platform(), arch(), homedir(), tmpdir(), type(), hostname(), L63: EOL, cpus(), endianness() L64: L65: url: URL, URLSearchParams, parse(), format() L66:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/js-exec-N5KEZBH7-CqxMtdCQ.cjsView on unpkg · L40

dist/dist-BmiFk6Ob.mjsView file

33692if (error) { L33693: if (command.name === "exec" && error.message === "EXECABORT Transaction discarded because of previous errors.") continue; L33694: if (!commonError) commonError = {

High

Shell

Package source references shell execution.

dist/dist-BmiFk6Ob.mjsView on unpkg · L33692

dist/chunk-TN7HHBQW-D_SK6w5n.cjsView file

17strategy: "throw", L18: reason: "eval() allows arbitrary code execution" L19: },

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-TN7HHBQW-D_SK6w5n.cjsView on unpkg · L17

dist/bash-YZ33HQZQ-DRnFYBAC.cjsView file

1require("./dist-GGdiZS7K.cjs"); L2: require("./chunk-BZUGFHVS-7RRM7Jpb.cjs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bash-YZ33HQZQ-DRnFYBAC.cjsView on unpkg · L1

Findings

3 High4 Medium8 Low

HighChild Processdist/js-exec-N5KEZBH7-CqxMtdCQ.cjs

HighShelldist/dist-BmiFk6Ob.mjs

HighCross File Remote Execution Contextdist/js-exec-N5KEZBH7-CqxMtdCQ.cjs

MediumDynamic Requiredist/bash-YZ33HQZQ-DRnFYBAC.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/chunk-TN7HHBQW-D_SK6w5n.cjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/js-exec-N5KEZBH7-CqxMtdCQ.cjsView file

Lines 20-60javascript

20 --strip-types Strip TypeScript type annotations

21 --version, -V Show version

22 --help Show this help

24Examples:

25 js-exec -c "console.log(1 + 2)"

26 js-exec script.js

27 js-exec app.ts

28 echo 'console.log("hello")' | js-exec

30File Extension Auto-Detection:

31 .js script mode (module mode if top-level await detected)

32 .mjs ES module mode

33 .ts, .mts ES module mode + TypeScript stripping

35Node.js Compatibility:

36 Code written for Node.js largely works here. Both require and import

37 are supported, the node: prefix works, and standard globals like process,

38 console, and fetch are available. All I/O is synchronous.

40 Available modules:

41 fs, path, child_process, process, console,

42 os, url, assert, util, events, buffer, stream,

High

Child Process

Package source references child process execution.

dist/js-exec-N5KEZBH7-CqxMtdCQ.cjsView on unpkg · L40

43 string_decoder, querystring

45 fs (global, require('fs'), or import from 'node:fs'):

46 readFileSync, writeFileSync, appendFileSync, copyFileSync, renameSync

47 readdirSync, mkdirSync, rmSync, unlinkSync, rmdirSync

48 statSync, lstatSync, existsSync, realpathSync, chmodSync

49 symlinkSync, readlinkSync, readFileBuffer

50 fs.promises.readFile, fs.promises.writeFile, fs.promises.access, ...

52 path: join, resolve, dirname, basename, extname, normalize,

53 relative, isAbsolute, parse, format, sep, delimiter

55 child_process:

56 execSync(cmd) throws on non-zero exit, returns stdout

57 spawnSync(cmd, args) returns { stdout, stderr, status }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/js-exec-N5KEZBH7-CqxMtdCQ.cjsView on unpkg · L40

59 process (also global): argv, cwd(), exit(), env, platform, arch,

60 version, versions

dist/dist-BmiFk6Ob.mjsView file

33692if (error) { L33693: if (command.name === "exec" && error.message === "EXECABORT Transaction discarded because of previous errors.") continue; L33694: if (!commonError) commonError = {

High

Shell

Package source references shell execution.

dist/dist-BmiFk6Ob.mjsView on unpkg · L33692

dist/chunk-TN7HHBQW-D_SK6w5n.cjsView file

Lines 1-37javascript

1const require_chunk_BZUGFHVS = require("./chunk-BZUGFHVS-7RRM7Jpb.cjs");

2//#region ../../node_modules/.pnpm/just-bash@3.0.1/node_modules/just-bash/dist/bundle/chunks/chunk-TN7HHBQW.js

3(0, require("node:module").createRequire)(require("url").pathToFileURL(__filename).href);

4function v() {

5 let

dist/bash-YZ33HQZQ-DRnFYBAC.cjsView file

Lines 1-11javascript

1require("./dist-GGdiZS7K.cjs");

2require("./chunk-BZUGFHVS-7RRM7Jpb.cjs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bash-YZ33HQZQ-DRnFYBAC.cjsView on unpkg · L1

3require("./chunk-QAYAQNCG-ROQh1hrZ.cjs");

4const require_chunk_GSPYNYZA = require("./chunk-GSPYNYZA-Bauaqn7k.cjs");