@keystrokehq/platform@0.1.29: Suspicious npm security report

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsObfuscatedTelemetryUrlStrings

Manifest

NoLicense

scanned 212 file(s), 7.56 MB of source, external domains: 127.0.0.1, ai-gateway.vercel.sh, angular.io, api.exa.ai, api.keystroke.ai, chat-sdk.dev, cscott.net, datatracker.ietf.org, dom.spec.whatwg.org, example.com, github.com, json-schema.org, landley.net, raw.githubusercontent.com, trac.webkit.org, www.ibm.com, www.w3.org, www.whatwg.org

Source & flagged code

7 flagged

dist/dist-CIV6gIc3.mjsView file

17import { join } from "node:path"; L18: import { spawnSync } from "node:child_process"; L19: import { tmpdir } from "node:os";

High

Child Process

Package source references child process execution.

dist/dist-CIV6gIc3.mjsView on unpkg · L17

7import { AsyncLocalStorage } from "node:async_hooks"; L8: import { deleteSecretValuesForRef, ensureOAuthApp, getOrganizationScopeId, saveOAuthConnection, selectSecretValue, upsertSecretValue } from "@keystrokehq/platform-database"; L9: import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from "node:crypto"; L10: import * as z$1 from "zod/v4"; ... L17: import { join } from "node:path"; L18: import { spawnSync } from "node:child_process"; L19: import { tmpdir } from "node:os"; ... L593: * (timestamps embedded in the id). Use {@link cuid2} instead. L594: * See https://github.com/paralleldrive/cuid. L595: */ ... L4825: "previews", L4826: "private",

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/dist-CIV6gIc3.mjsView on unpkg · L7

7import { AsyncLocalStorage } from "node:async_hooks"; L8: import { deleteSecretValuesForRef, ensureOAuthApp, getOrganizationScopeId, saveOAuthConnection, selectSecretValue, upsertSecretValue } from "@keystrokehq/platform-database"; L9: import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from "node:crypto"; L10: import * as z$1 from "zod/v4"; ... L17: import { join } from "node:path"; L18: import { spawnSync } from "node:child_process"; L19: import { tmpdir } from "node:os"; ... L593: * (timestamps embedded in the id). Use {@link cuid2} instead. L594: * See https://github.com/paralleldrive/cuid. L595: */ ... L4825: "previews", L4826: "private",

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/dist-CIV6gIc3.mjsView on unpkg · L7

7import { AsyncLocalStorage } from "node:async_hooks"; L8: import { deleteSecretValuesForRef, ensureOAuthApp, getOrganizationScopeId, saveOAuthConnection, selectSecretValue, upsertSecretValue } from "@keystrokehq/platform-database"; L9: import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from "node:crypto"; L10: import * as z$1 from "zod/v4"; ... L17: import { join } from "node:path"; L18: import { spawnSync } from "node:child_process"; L19: import { tmpdir } from "node:os"; ... L593: * (timestamps embedded in the id). Use {@link cuid2} instead. L594: * See https://github.com/paralleldrive/cuid. L595: */ ... L4825: "previews", L4826: "private",

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/dist-CIV6gIc3.mjsView on unpkg · L7

dist/chunk-TN7HHBQW-D_SK6w5n.cjsView file

Lines 1-37javascript

1const require_chunk_BZUGFHVS = require("./chunk-BZUGFHVS-7RRM7Jpb.cjs");

2//#region ../../node_modules/.pnpm/just-bash@3.0.1/node_modules/just-bash/dist/bundle/chunks/chunk-TN7HHBQW.js

3(0, require("node:module").createRequire)(require("url").pathToFileURL(__filename).href);

4function v() {

5 let

dist/split-4KKZZXXE-powTfJ0o.cjsView file

Lines 1-21javascript

1const require_start = require("./start-iU-IEj6X.cjs");

2require("./chunk-BZUGFHVS-7RRM7Jpb.cjs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/split-4KKZZXXE-powTfJ0o.cjsView on unpkg · L1

3const require_chunk_QAYAQNCG = require("./chunk-QAYAQNCG-ROQh1hrZ.cjs");

4let

dist/js-exec-N5KEZBH7-a_xcvlBX.mjsView file

Lines 20-60javascript

20 --strip-types Strip TypeScript type annotations

21 --version, -V Show version

22 --help Show this help

23

24Examples:

25 js-exec -c "console.log(1 + 2)"

26 js-exec script.js

27 js-exec app.ts

28 echo 'console.log("hello")' | js-exec

29

30File Extension Auto-Detection:

Source & flagged code

7 flagged · loading source

dist/dist-CIV6gIc3.mjsView file

17import { join } from "node:path"; L18: import { spawnSync } from "node:child_process"; L19: import { tmpdir } from "node:os";

High

Child Process

Package source references child process execution.

dist/dist-CIV6gIc3.mjsView on unpkg · L17

7import { AsyncLocalStorage } from "node:async_hooks"; L8: import { deleteSecretValuesForRef, ensureOAuthApp, getOrganizationScopeId, saveOAuthConnection, selectSecretValue, upsertSecretValue } from "@keystrokehq/platform-database"; L9: import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from "node:crypto"; L10: import * as z$1 from "zod/v4"; ... L17: import { join } from "node:path"; L18: import { spawnSync } from "node:child_process"; L19: import { tmpdir } from "node:os"; ... L593: * (timestamps embedded in the id). Use {@link cuid2} instead. L594: * See https://github.com/paralleldrive/cuid. L595: */ ... L4825: "previews", L4826: "private",

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/dist-CIV6gIc3.mjsView on unpkg · L7

7import { AsyncLocalStorage } from "node:async_hooks"; L8: import { deleteSecretValuesForRef, ensureOAuthApp, getOrganizationScopeId, saveOAuthConnection, selectSecretValue, upsertSecretValue } from "@keystrokehq/platform-database"; L9: import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from "node:crypto"; L10: import * as z$1 from "zod/v4"; ... L17: import { join } from "node:path"; L18: import { spawnSync } from "node:child_process"; L19: import { tmpdir } from "node:os"; ... L593: * (timestamps embedded in the id). Use {@link cuid2} instead. L594: * See https://github.com/paralleldrive/cuid. L595: */ ... L4825: "previews", L4826: "private",

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/dist-CIV6gIc3.mjsView on unpkg · L7

7import { AsyncLocalStorage } from "node:async_hooks"; L8: import { deleteSecretValuesForRef, ensureOAuthApp, getOrganizationScopeId, saveOAuthConnection, selectSecretValue, upsertSecretValue } from "@keystrokehq/platform-database"; L9: import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from "node:crypto"; L10: import * as z$1 from "zod/v4"; ... L17: import { join } from "node:path"; L18: import { spawnSync } from "node:child_process"; L19: import { tmpdir } from "node:os"; ... L593: * (timestamps embedded in the id). Use {@link cuid2} instead. L594: * See https://github.com/paralleldrive/cuid. L595: */ ... L4825: "previews", L4826: "private",

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/dist-CIV6gIc3.mjsView on unpkg · L7

dist/chunk-TN7HHBQW-D_SK6w5n.cjsView file

17strategy: "throw", L18: reason: "eval() allows arbitrary code execution" L19: },

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-TN7HHBQW-D_SK6w5n.cjsView on unpkg · L17

dist/split-4KKZZXXE-powTfJ0o.cjsView file

1const require_start = require("./start-iU-IEj6X.cjs"); L2: require("./chunk-BZUGFHVS-7RRM7Jpb.cjs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/split-4KKZZXXE-powTfJ0o.cjsView on unpkg · L1

dist/js-exec-N5KEZBH7-a_xcvlBX.mjsView file

40Cross-file remote execution chain: dist/js-exec-N5KEZBH7-a_xcvlBX.mjs spawns dist/chunk-TN7HHBQW-B8PYcKz5.mjs; helper contains network access plus dynamic code execution. L40: Available modules: L41: fs, path, child_process, process, console, L42: os, url, assert, util, events, buffer, stream, ... L55: child_process: L56: execSync(cmd) throws on non-zero exit, returns stdout L57: spawnSync(cmd, args) returns { stdout, stderr, status } ... L61: L62: os: platform(), arch(), homedir(), tmpdir(), type(), hostname(), L63: EOL, cpus(), endianness() L64: L65: url: URL, URLSearchParams, parse(), format() L66:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/js-exec-N5KEZBH7-a_xcvlBX.mjsView on unpkg · L40

Findings

4 High5 Medium9 Low

HighChild Processdist/dist-CIV6gIc3.mjs

HighShell

HighCloud Metadata Accessdist/dist-CIV6gIc3.mjs

HighCross File Remote Execution Contextdist/js-exec-N5KEZBH7-a_xcvlBX.mjs

MediumDynamic Requiredist/split-4KKZZXXE-powTfJ0o.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/dist-CIV6gIc3.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/chunk-TN7HHBQW-D_SK6w5n.cjs

LowWeak Cryptodist/dist-CIV6gIc3.mjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License