registry / @knapsack/app / 4.107.2
@knapsack/app@4.107.2
Build Design Systems with Knapsack
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe manifest declares no install lifecycle hooks, and the routed dynamic-require finding is a set of ordinary fixed imports. CLI error telemetry is disclosed with an opt-out; the reviewed source does not establish malicious collection or actions.
Static reason
No blocking static signals were detected.
Trigger
Importing the library loads its declared modules; running either CLI command loads the package's CLI entry.
Impact
No malicious behavior is supported by the inspected source.
Mechanism
The reviewed dynamic-require location uses fixed module names. Runtime error telemetry is disclosed and can be disabled with KS_DISABLE_TELEMETRY.
AI rationale
The manifest declares no install lifecycle hooks, and the routed dynamic-require finding is a set of ordinary fixed imports. CLI error telemetry is disclosed with an opt-out; the reviewed source does not establish malicious collection or actions.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes a library entry and two CLI commands; the CLI wrapper loads the package's own dist/cli entry.
- The package scripts contain build, clean, lint and test only; no install lifecycle hook is declared.
- Telemetry status is announced to CLI users, with KS_DISABLE_TELEMETRY documented as the opt-out.
- The dynamic-require finding is ordinary static requires of Zod, Knapsack helpers and a renderer base class.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
CopyleftLicense
Source & flagged code
5 flaggeddist/types/knapsack-config.jsView file
3exports.KnapsackConfigSchema = void 0;
L4: const zod_1 = require("zod");
L5: const file_utils_1 = require("@knapsack/file-utils");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/types/knapsack-config.jsView on unpkg · L34const zod_1 = require("zod");
const file_utils_1 = require("@knapsack/file-utils");
const renderer_base_1 = require("../[redacted]-base");
const PathSchema = zod_1.z.custom((val) => {
return
Low
Ai Review Evidence
The dynamic-require finding is ordinary static requires of Zod, Knapsack helpers and a renderer base class.
dist/types/knapsack-config.jsView on unpkg · L4package.jsonView file
5"bin": {
"knapsack": "cli.js",
"knapsack-build-tokens": "build-tokens.js"
},
"types": "./dist/index.d.ts",
"exports": {
".": {
"types": "./dist/index.d.ts",
"d
Findings
3 Medium9 Low
MediumDynamic Requiredist/types/knapsack-config.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
LowAi Review Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/cli/log.js
LowAi Review Evidencedist/types/knapsack-config.js
Affected versions and remediation
This report applies to @knapsack/app@4.107.2.
See all versions of @knapsack/app for other recorded verdicts.
- Review the evidence and your use of @knapsack/app@4.107.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.