registry / @kriswill/okflight / 0.2.0

@kriswill/okflight@0.2.0

CLI for maintaining OKF knowledge bundles: scaffold/index/validate/viz (self-contained 3D graph), plus a guided setup wizard

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 46 file(s), 265 KB of source, external domains: bun.sh, github.com

Source & flagged code

3 flagged

bin/okf.mjsView file

Lines 1-47javascript

1#!/usr/bin/env node

2// npm/bunx entry point. okf runs on Bun — Bun.TOML, Bun.build (+ the Svelte

3// plugin at `okf viz` time), and Bun.Glob are used at CLI runtime, so node

4// cannot host it directly. The node shebang is deliberate: bunx respects it,

5// so both `bunx @kriswill/okflight` and `npx @kriswill/okflight` land here

6// under node and we re-exec through a bun; `bunx --bun @kriswill/okflight`

7// (or a bun-run invocation) hits the typeof-Bun fast path and imports the

8// CLI in-process.

9//

10// Bun lookup order: the PATH (the common case — bunx users by definition,

11// and any machine with bun installed), then the `bun` optionalDependency

12// npm brings alongside this package (flat and nested install layouts), so

13// plain `npx @kriswill/okflight` works with no prerequisites. A machine with none of

14// these gets an explanation instead of a cryptic ENOENT.

15//

16// OKF_PROG makes usage/help print the name the user actually typed

17// (okflight or okf, per the bin symlink) rather than "bun okf.ts".

19import { spawnSync } from "node:child_process";

20import { existsSync } from "node:fs";

21import { basename } from "node:path";

22import { fileURLToPath } from "node:url";

24const entry = fileURLToPath(new URL("../okf.ts", import.meta.url));

25process.env.OKF_PROG ??= basename(process.argv[1] ?? "", ".mjs") || "okf";

27if (typeof Bun !== "undefined") {

28 await import(entry);

29} else {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/okf.mjsView on unpkg · L27

30 const isWin = process.platform === "win32";

31 const local = ["../node_modules/.bin/bun", "../../.bin/bun"] // nested (global installs) and flat layouts

32 .map((rel) => fileURLToPath(new URL(rel + (isWin ? ".cmd" : ""), import.meta.url)))

33 .filter((p) => existsSync(p));

34 for (const bun of ["bun", ...local]) {

35 // .cmd shims need a shell; node refuses to spawn them directly.

36 const r = spawnSync(bun, [entry, ...process.argv.slice(2)], { stdio: "inherit", shell: bun.endsWith(".cmd") });

37 if (r.error && r.error.code === "ENOENT") continue; // not on PATH — try the next candidate

38 if (r.error) throw r.error;

39 process.exit(r.status ?? 1);

40 }

41 // Every candidate ENOENT'd — no bun anywhere.

42 console.error(

43 "okf: the Bun runtime is required (this CLI uses Bun.build/Bun.TOML at runtime and cannot run under node).\n" +

44 " Installing the okflight package normally brings bun along as an optional dependency; it seems to be\n" +

45 " missing here (--no-optional install, or an unsupported platform). Install bun from https://bun.sh\n" +

46 " — e.g. `npm install -g bun` or `curl -fsSL https://bun.sh/install | bash` — then re-run.",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/okf.mjsView on unpkg · L18

47 );

viz.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @kriswill/okflight@0.1.1 matchedIdentity = npm:QGtyaXN3aWxsL29rZmxpZ2h0:0.1.1 similarity = 0.625 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

viz.tsView on unpkg

Source & flagged code

3 flagged · loading source

bin/okf.mjsView file

18L19: import { spawnSync } from "node:child_process"; L20: import { existsSync } from "node:fs"; ... L24: const entry = fileURLToPath(new URL("../okf.ts", import.meta.url)); L25: process.env.OKF_PROG ??= basename(process.argv[1] ?? "", ".mjs") || "okf"; L26: ... L29: } else { L30: const isWin = process.platform === "win32"; L31: const local = ["../node_modules/.bin/bun", "../../.bin/bun"] // nested (global installs) and flat layouts ... L44: " Installing the okflight package normally brings bun along as an optional dependency; it seems to be\n" + L45: " missing here (--no-optional install, or an unsupported platform). Install bun from https://bun.sh\n" + L46: " — e.g. `npm install -g bun` or `curl -fsSL https://bun.sh/install | bash` — then re-run.",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/okf.mjsView on unpkg · L18

27if (typeof Bun !== "undefined") { L28: await import(entry); L29: } else {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/okf.mjsView on unpkg · L27

viz.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

viz.tsView on unpkg

Findings

2 High3 Medium3 Low

HighSandbox Evasion Gated Capabilitybin/okf.mjs

HighPrevious Version Dangerous Deltaviz.ts

MediumDynamic Requirebin/okf.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

bin/okf.mjsView file

Lines 1-47javascript

1#!/usr/bin/env node

2// npm/bunx entry point. okf runs on Bun — Bun.TOML, Bun.build (+ the Svelte

3// plugin at `okf viz` time), and Bun.Glob are used at CLI runtime, so node

4// cannot host it directly. The node shebang is deliberate: bunx respects it,

5// so both `bunx @kriswill/okflight` and `npx @kriswill/okflight` land here

6// under node and we re-exec through a bun; `bunx --bun @kriswill/okflight`

7// (or a bun-run invocation) hits the typeof-Bun fast path and imports the

8// CLI in-process.

9//

10// Bun lookup order: the PATH (the common case — bunx users by definition,

11// and any machine with bun installed), then the `bun` optionalDependency

12// npm brings alongside this package (flat and nested install layouts), so

13// plain `npx @kriswill/okflight` works with no prerequisites. A machine with none of

14// these gets an explanation instead of a cryptic ENOENT.

15//

16// OKF_PROG makes usage/help print the name the user actually typed

17// (okflight or okf, per the bin symlink) rather than "bun okf.ts".

19import { spawnSync } from "node:child_process";

20import { existsSync } from "node:fs";

21import { basename } from "node:path";

22import { fileURLToPath } from "node:url";

24const entry = fileURLToPath(new URL("../okf.ts", import.meta.url));

25process.env.OKF_PROG ??= basename(process.argv[1] ?? "", ".mjs") || "okf";

27if (typeof Bun !== "undefined") {

28 await import(entry);

29} else {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/okf.mjsView on unpkg · L27

30 const isWin = process.platform === "win32";

31 const local = ["../node_modules/.bin/bun", "../../.bin/bun"] // nested (global installs) and flat layouts

32 .map((rel) => fileURLToPath(new URL(rel + (isWin ? ".cmd" : ""), import.meta.url)))

33 .filter((p) => existsSync(p));

34 for (const bun of ["bun", ...local]) {

35 // .cmd shims need a shell; node refuses to spawn them directly.

36 const r = spawnSync(bun, [entry, ...process.argv.slice(2)], { stdio: "inherit", shell: bun.endsWith(".cmd") });

37 if (r.error && r.error.code === "ENOENT") continue; // not on PATH — try the next candidate

38 if (r.error) throw r.error;

39 process.exit(r.status ?? 1);

40 }

41 // Every candidate ENOENT'd — no bun anywhere.

42 console.error(

43 "okf: the Bun runtime is required (this CLI uses Bun.build/Bun.TOML at runtime and cannot run under node).\n" +

44 " Installing the okflight package normally brings bun along as an optional dependency; it seems to be\n" +

45 " missing here (--no-optional install, or an unsupported platform). Install bun from https://bun.sh\n" +

46 " — e.g. `npm install -g bun` or `curl -fsSL https://bun.sh/install | bash` — then re-run.",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/okf.mjsView on unpkg · L18

47 );

viz.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

viz.tsView on unpkg