registry / @speed.press/kit / 1.7.0

@speed.press/kit@1.7.0

Convert WordPress sites into pixel-faithful Astro frontends

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 39 file(s), 312 KB of source, external domains: 127.0.0.1, aiscan.site, console.anthropic.com, integration.xcloud.host, www.sitemaps.org, xcloud.host

Source & flagged code

5 flagged

templates/regenerator/server.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * xCloud Headless Regenerator Service

4 * Listens for WordPress webhook events and surgically updates static pages.

5 * Runs as a sidecar process inside the Docker container on port 8080.

6 */

7import http from 'http';

8import { createHmac, timingSafeEqual } from 'crypto';

9import { execFile } from 'child_process';

10import { readFileSync, writeFileSync, renameSync, existsSync } from 'fs';

High

Child Process

Package source references child process execution.

templates/regenerator/server.jsView on unpkg · L8

11import { promisify } from 'util';

12import { resolve, dirname } from 'path';

13import { fileURLToPath } from 'url';

14import { mapPost, POSTS_PER_PAGE } from './wp-data.js';

15import { renderCards } from './card-html.js';

17const execFileAsync = promisify(execFile);

18const __dir = dirname(fileURLToPath(import.meta.url));

20const PORT = parseInt(process.env.REGENERATOR_PORT || '8080', 10);

21const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET || '';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

templates/regenerator/server.jsView on unpkg · L6

22const WP_API_URL = process.env.WP_API_URL || '';

23const HTML_DIR = process.env.HTML_DIR || '/var/www/html';

24const MANIFEST_PATH = resolve(__dir, '../dependency-manifest.json');

26const dedup = new Map(); // eventKey → timestamp, for 60s dedup window

28// Interactive WP core blocks → their view script module (relative to the WP root).

src/utils/asset-bundler.jsView file

Lines 1-32javascript

1import { createHash } from 'crypto';

2import { existsSync } from 'fs';

3import { writeFile, mkdir, readFile } from 'fs/promises';

4import { join, dirname, basename } from 'path';

5import fetch from 'node-fetch';

src/utils/mirror/verify.jsView file

Lines 188-228javascript

188 try {

189 let p = decodeURIComponent(req.url.split('?')[0]);

190 if (p.endsWith('/')) p += 'index.html';

191 const { extname } =

templates/docker/start.shView file

•path = templates/docker/start.sh kind = build_helper sizeBytes = 315 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docker/start.shView on unpkg

Source & flagged code

5 flagged · loading source

templates/regenerator/server.jsView file

8import { createHmac, timingSafeEqual } from 'crypto'; L9: import { execFile } from 'child_process'; L10: import { readFileSync, writeFileSync, renameSync, existsSync } from 'fs';

High

Child Process

Package source references child process execution.

templates/regenerator/server.jsView on unpkg · L8

6*/ L7: import http from 'http'; L8: import { createHmac, timingSafeEqual } from 'crypto'; L9: import { execFile } from 'child_process'; L10: import { readFileSync, writeFileSync, renameSync, existsSync } from 'fs'; ... L19: L20: const PORT = parseInt(process.env.REGENERATOR_PORT || '8080', 10); L21: const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET || '';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

templates/regenerator/server.jsView on unpkg · L6

src/utils/asset-bundler.jsView file

12* Usage: L13: * const bundler = new AssetBundler('https://example.com', '/output/dir'); L14: * const localCss = await bundler.rewriteCSSUrls(cssText, cssFileUrl); ... L42: _resolveUrl(ref, cssFileUrl) { L43: if (ref.startsWith('data:')) return ref; L44: try { ... L97: if (!res.ok) throw new Error(`HTTP ${res.status}`); L98: const buf = Buffer.from(await res.arrayBuffer()); L99: await writeFile(localPath, buf);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/utils/asset-bundler.jsView on unpkg · L12

src/utils/mirror/verify.jsView file

208package = @speed.press/kit; repositoryIdentity = xcloud-headless; dependency = pixelmatch L208: ({ chromium } = await import('playwright')); L209: pixelmatch = (await import('pixelmatch')).default; L210: ({ PNG } = await import('pngjs'));

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/utils/mirror/verify.jsView on unpkg · L208

templates/docker/start.shView file

•path = templates/docker/start.sh kind = build_helper sizeBytes = 315 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docker/start.shView on unpkg

Findings

4 High4 Medium5 Low

HighChild Processtemplates/regenerator/server.js

HighShell

HighSame File Env Network Executiontemplates/regenerator/server.js

HighCopied Package Dependency Bridgesrc/utils/mirror/verify.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/docker/start.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/utils/asset-bundler.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

templates/regenerator/server.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * xCloud Headless Regenerator Service

4 * Listens for WordPress webhook events and surgically updates static pages.

5 * Runs as a sidecar process inside the Docker container on port 8080.

6 */

7import http from 'http';

8import { createHmac, timingSafeEqual } from 'crypto';

9import { execFile } from 'child_process';

10import { readFileSync, writeFileSync, renameSync, existsSync } from 'fs';

High

Child Process

Package source references child process execution.

templates/regenerator/server.jsView on unpkg · L8

11import { promisify } from 'util';

12import { resolve, dirname } from 'path';

13import { fileURLToPath } from 'url';

14import { mapPost, POSTS_PER_PAGE } from './wp-data.js';

15import { renderCards } from './card-html.js';

17const execFileAsync = promisify(execFile);

18const __dir = dirname(fileURLToPath(import.meta.url));

20const PORT = parseInt(process.env.REGENERATOR_PORT || '8080', 10);

21const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET || '';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

templates/regenerator/server.jsView on unpkg · L6

22const WP_API_URL = process.env.WP_API_URL || '';

23const HTML_DIR = process.env.HTML_DIR || '/var/www/html';

24const MANIFEST_PATH = resolve(__dir, '../dependency-manifest.json');

26const dedup = new Map(); // eventKey → timestamp, for 60s dedup window

28// Interactive WP core blocks → their view script module (relative to the WP root).

src/utils/asset-bundler.jsView file

Lines 1-32javascript

1import { createHash } from 'crypto';

2import { existsSync } from 'fs';

3import { writeFile, mkdir, readFile } from 'fs/promises';

4import { join, dirname, basename } from 'path';

5import fetch from 'node-fetch';

src/utils/mirror/verify.jsView file

Lines 188-228javascript

188 try {

189 let p = decodeURIComponent(req.url.split('?')[0]);

190 if (p.endsWith('/')) p += 'index.html';

191 const { extname } =

templates/docker/start.shView file

•path = templates/docker/start.sh kind = build_helper sizeBytes = 315 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docker/start.shView on unpkg