registry  /  @keystrokehq/keystroke  /  0.1.32

@keystrokehq/keystroke@0.1.32

Keystroke authoring facade — re-exports primitives for user projects.

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
Supply chain
HighEntropyStringsObfuscatedTelemetryUrlStrings
Manifest
NoLicense
scanned 386 file(s), 9.33 MB of source, external domains: ai-gateway.vercel.sh, ai-sdk.dev, angular.io, api.keystroke.ai, api.vercel.com, cscott.net, datatracker.ietf.org, dom.spec.whatwg.org, example.com, github.com, json-schema.org, landley.net, raw.githubusercontent.com, trac.webkit.org, vercel.com, www.ibm.com, www.w3.org, www.whatwg.org

Source & flagged code

5 flagged · loading source
dist/dist-DKk-xtZv.mjsView file
13import "node:url"; L14: import { spawn } from "child_process"; L15: import "zod/v4-mini";
High
Child Process

Package source references child process execution.

dist/dist-DKk-xtZv.mjsView on unpkg · L13
33691if (error) { L33692: if (command.name === "exec" && error.message === "EXECABORT Transaction discarded because of previous errors.") continue; L33693: if (!commonError) commonError = {
High
Shell

Package source references shell execution.

dist/dist-DKk-xtZv.mjsView on unpkg · L33691
24296if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L24297: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L24298: this.scope.value(validateName, { ref: validate });
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-DKk-xtZv.mjsView on unpkg · L24296
dist/env-36M5BO7M-DIEq2M4P.cjsView file
1require("./dist-BUJyfMX0.cjs"); L2: require("./chunk-BZUGFHVS-7RRM7Jpb.cjs");
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/env-36M5BO7M-DIEq2M4P.cjsView on unpkg · L1
dist/js-exec-N5KEZBH7-Bg4YTQnj.cjsView file
40Cross-file remote execution chain: dist/js-exec-N5KEZBH7-Bg4YTQnj.cjs spawns dist/chunk-TN7HHBQW-D_SK6w5n.cjs; helper contains network access plus dynamic code execution. L40: Available modules: L41: fs, path, child_process, process, console, L42: os, url, assert, util, events, buffer, stream, ... L55: child_process: L56: execSync(cmd) throws on non-zero exit, returns stdout L57: spawnSync(cmd, args) returns { stdout, stderr, status } ... L61: L62: os: platform(), arch(), homedir(), tmpdir(), type(), hostname(), L63: EOL, cpus(), endianness() L64: L65: url: URL, URLSearchParams, parse(), format() L66:
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/js-exec-N5KEZBH7-Bg4YTQnj.cjsView on unpkg · L40

Findings

3 High4 Medium8 Low
HighChild Processdist/dist-DKk-xtZv.mjs
HighShelldist/dist-DKk-xtZv.mjs
HighCross File Remote Execution Contextdist/js-exec-N5KEZBH7-Bg4YTQnj.cjs
MediumDynamic Requiredist/env-36M5BO7M-DIEq2M4P.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/dist-DKk-xtZv.mjs
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License