registry  /  @keystrokehq/keystroke  /  0.1.33

@keystrokehq/keystroke@0.1.33

Keystroke authoring facade — re-exports primitives for user projects.

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
Supply chain
HighEntropyStringsObfuscatedTelemetryUrlStrings
Manifest
NoLicense
scanned 386 file(s), 9.34 MB of source, external domains: ai-gateway.vercel.sh, ai-sdk.dev, angular.io, api.keystroke.ai, api.vercel.com, cscott.net, datatracker.ietf.org, dom.spec.whatwg.org, example.com, github.com, json-schema.org, landley.net, raw.githubusercontent.com, trac.webkit.org, vercel.com, www.ibm.com, www.w3.org, www.whatwg.org

Source & flagged code

5 flagged · loading source
dist/dist-DKk-xtZv.mjsView file
13import "node:url"; L14: import { spawn } from "child_process"; L15: import "zod/v4-mini";
High
Child Process

Package source references child process execution.

dist/dist-DKk-xtZv.mjsView on unpkg · L13
33691if (error) { L33692: if (command.name === "exec" && error.message === "EXECABORT Transaction discarded because of previous errors.") continue; L33693: if (!commonError) commonError = {
High
Shell

Package source references shell execution.

dist/dist-DKk-xtZv.mjsView on unpkg · L33691
2695try { L2696: const [{ getTokenPayload, isExpired }, { refreshToken }] = await Promise.all([await Promise.resolve().then(() => /* @__PURE__ */ __toESM(require_token_util())), await import("./tok... L2697: if (!token || isExpired(getTokenPayload(token), options?.expirationBufferMs)) {
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/dist-DKk-xtZv.mjsView on unpkg · L2695
24296if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L24297: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L24298: this.scope.value(validateName, { ref: validate });
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-DKk-xtZv.mjsView on unpkg · L24296
dist/js-exec-N5KEZBH7-C86C6aiT.mjsView file
40Cross-file remote execution chain: dist/js-exec-N5KEZBH7-C86C6aiT.mjs spawns dist/dist-9SXOJb9L.mjs; helper contains network access plus dynamic code execution. L40: Available modules: L41: fs, path, child_process, process, console, L42: os, url, assert, util, events, buffer, stream, ... L55: child_process: L56: execSync(cmd) throws on non-zero exit, returns stdout L57: spawnSync(cmd, args) returns { stdout, stderr, status } ... L61: L62: os: platform(), arch(), homedir(), tmpdir(), type(), hostname(), L63: EOL, cpus(), endianness() L64: L65: url: URL, URLSearchParams, parse(), format() L66:
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/js-exec-N5KEZBH7-C86C6aiT.mjsView on unpkg · L40

Findings

3 High4 Medium8 Low
HighChild Processdist/dist-DKk-xtZv.mjs
HighShelldist/dist-DKk-xtZv.mjs
HighCross File Remote Execution Contextdist/js-exec-N5KEZBH7-C86C6aiT.mjs
MediumDynamic Requiredist/dist-DKk-xtZv.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/dist-DKk-xtZv.mjs
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License