registry  /  @keystrokehq/keystroke  /  0.1.31

@keystrokehq/keystroke@0.1.31

Keystroke authoring facade — re-exports primitives for user projects.

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
Supply chain
HighEntropyStringsObfuscatedTelemetryUrlStrings
Manifest
NoLicense
scanned 386 file(s), 9.33 MB of source, external domains: ai-gateway.vercel.sh, ai-sdk.dev, angular.io, api.keystroke.ai, api.vercel.com, cscott.net, datatracker.ietf.org, dom.spec.whatwg.org, example.com, github.com, json-schema.org, landley.net, raw.githubusercontent.com, trac.webkit.org, vercel.com, www.ibm.com, www.w3.org, www.whatwg.org

Source & flagged code

5 flagged · loading source
dist/dist-C6YL0luQ.cjsView file
14require("node:url"); L15: let child_process = require("child_process"); L16: require("zod/v4-mini");
High
Child Process

Package source references child process execution.

dist/dist-C6YL0luQ.cjsView on unpkg · L14
14Cross-file remote execution chain: dist/dist-C6YL0luQ.cjs spawns dist/dist-B9AhTULV.cjs; helper contains network access plus dynamic code execution. L14: require("node:url"); L15: let child_process = require("child_process"); L16: require("zod/v4-mini"); ... L243: function feed(chunk) { L244: if (isFirstChunk && (isFirstChunk = !1, chunk.charCodeAt(0) === 239 && chunk.charCodeAt(1) === 187 && chunk.charCodeAt(2) === 191 && (chunk = chunk.slice(3))), pendingFragments.len... L245: const trailing2 = processLines(chunk); ... L281: event: eventType, L282: data: value L283: }), id = void 0, data = "", eventType = void 0, searchIndex = lfIndex + 2, lfIndex = chunk.indexOf(` ... L871: if (hostname.startsWith("[") && hostname.endsWith("]")) { L872: if (isPrivateIPv6(hostname.slice(1, -1))) throw new DownloadError({ L873: url,
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/dist-C6YL0luQ.cjsView on unpkg · L14
24297if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L24298: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L24299: this.scope.value(validateName, { ref: validate });
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-C6YL0luQ.cjsView on unpkg · L24297
dist/dist-CeFq1rYM.mjsView file
33691if (error) { L33692: if (command.name === "exec" && error.message === "EXECABORT Transaction discarded because of previous errors.") continue; L33693: if (!commonError) commonError = {
High
Shell

Package source references shell execution.

dist/dist-CeFq1rYM.mjsView on unpkg · L33691
dist/bash-YZ33HQZQ-DRnFYBAC.cjsView file
1require("./dist-GGdiZS7K.cjs"); L2: require("./chunk-BZUGFHVS-7RRM7Jpb.cjs");
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/bash-YZ33HQZQ-DRnFYBAC.cjsView on unpkg · L1

Findings

3 High4 Medium8 Low
HighChild Processdist/dist-C6YL0luQ.cjs
HighShelldist/dist-CeFq1rYM.mjs
HighCross File Remote Execution Contextdist/dist-C6YL0luQ.cjs
MediumDynamic Requiredist/bash-YZ33HQZQ-DRnFYBAC.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/dist-C6YL0luQ.cjs
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License