registry / @kriswill/okflight / 0.1.1

@kriswill/okflight@0.1.1

CLI for maintaining OKF knowledge bundles: scaffold/index/validate/viz (self-contained 3D graph), plus a guided setup wizard

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 32 file(s), 196 KB of source, external domains: bun.sh, github.com

Source & flagged code

2 flagged

bin/okf.mjsView file

Lines 1-47javascript

1#!/usr/bin/env node

2// npm/bunx entry point. okf runs on Bun — Bun.TOML, Bun.build (+ the Svelte

3// plugin at `okf viz` time), and Bun.Glob are used at CLI runtime, so node

4// cannot host it directly. The node shebang is deliberate: bunx respects it,

5// so both `bunx @kriswill/okflight` and `npx @kriswill/okflight` land here

6// under node and we re-exec through a bun; `bunx --bun @kriswill/okflight`

7// (or a bun-run invocation) hits the typeof-Bun fast path and imports the

8// CLI in-process.

9//

Source & flagged code

2 flagged · loading source

bin/okf.mjsView file

18L19: import { spawnSync } from "node:child_process"; L20: import { existsSync } from "node:fs"; ... L24: const entry = fileURLToPath(new URL("../okf.ts", import.meta.url)); L25: process.env.OKF_PROG ??= basename(process.argv[1] ?? "", ".mjs") || "okf"; L26: ... L29: } else { L30: const isWin = process.platform === "win32"; L31: const local = ["../node_modules/.bin/bun", "../../.bin/bun"] // nested (global installs) and flat layouts ... L44: " Installing the okflight package normally brings bun along as an optional dependency; it seems to be\n" + L45: " missing here (--no-optional install, or an unsupported platform). Install bun from https://bun.sh\n" + L46: " — e.g. `npm install -g bun` or `curl -fsSL https://bun.sh/install | bash` — then re-run.",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/okf.mjsView on unpkg · L18

27if (typeof Bun !== "undefined") { L28: await import(entry); L29: } else {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/okf.mjsView on unpkg · L27

Findings

1 High3 Medium3 Low

HighSandbox Evasion Gated Capabilitybin/okf.mjs

MediumDynamic Requirebin/okf.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings