registry / @speed.press/kit / 1.7.2

@speed.press/kit@1.7.2

Convert WordPress sites into pixel-faithful Astro frontends

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 39 file(s), 313 KB of source, external domains: 127.0.0.1, aiscan.site, console.anthropic.com, integration.xcloud.host, www.sitemaps.org, xcloud.host

Source & flagged code

4 flagged

src/utils/asset-bundler.jsView file

Lines 1-32javascript

1import { createHash } from 'crypto';

2import { existsSync } from 'fs';

3import { writeFile, mkdir, readFile } from 'fs/promises';

4import { join, dirname, basename } from 'path';

5import fetch from 'node-fetch';

7/**

8 * AssetBundler — downloads CSS-referenced assets (fonts, images, SVGs) to a

9 * local directory and rewrites url() references in CSS so the resulting CSS is

10 * fully self-contained.

11 *

12 * Usage:

13 * const bundler = new AssetBundler('https://example.com', '/output/dir');

14 * const localCss = await bundler.rewriteCSSUrls(cssText, cssFileUrl);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/utils/asset-bundler.jsView on unpkg · L12

15 * await bundler.buildThemeCSS(stylesheetList); // writes theme.css

16 */

17export class AssetBundler {

18 /**

19 * @param {string} baseUrl - Origin of the WordPress site (e.g. "https://example.com")

20 * @param {string} outDir - Absolute path to the extract-design output directory

21 */

22 constructor(baseUrl, outDir) {

23 this.baseUrl = baseUrl.replace(/\/$/, '');

24 this.outDir = outDir;

25 this.assetsDir = join(outDir, 'assets');

26 this.manifestPath = join(this.assetsDir, 'manifest.json');

27 /** @type {Record<string, { localFile: string; originalUrl: string; size: number; error?: string }>} */

28 this._manifest = {};

29 }

31 // ─── Internal helpers ────────────────────────────────────────────────────────

src/utils/mirror/verify.jsView file

Lines 188-228javascript

188 try {

189 let p = decodeURIComponent(req.url.split('?')[0]);

190 if (p.endsWith('/')) p += 'index.html';

191 const { extname } =

templates/docker/start.shView file

•path = templates/docker/start.sh kind = build_helper sizeBytes = 870 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docker/start.shView on unpkg

templates/regenerator/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @speed.press/kit@1.7.1 matchedIdentity = npm:QHNwZWVkLnByZXNzL2tpdA:1.7.1 similarity = 0.974 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

templates/regenerator/server.jsView on unpkg

Source & flagged code

4 flagged · loading source

src/utils/asset-bundler.jsView file

12* Usage: L13: * const bundler = new AssetBundler('https://example.com', '/output/dir'); L14: * const localCss = await bundler.rewriteCSSUrls(cssText, cssFileUrl); ... L42: _resolveUrl(ref, cssFileUrl) { L43: if (ref.startsWith('data:')) return ref; L44: try { ... L97: if (!res.ok) throw new Error(`HTTP ${res.status}`); L98: const buf = Buffer.from(await res.arrayBuffer()); L99: await writeFile(localPath, buf);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/utils/asset-bundler.jsView on unpkg · L12

src/utils/mirror/verify.jsView file

208package = @speed.press/kit; repositoryIdentity = xcloud-headless; dependency = pixelmatch L208: ({ chromium } = await import('playwright')); L209: pixelmatch = (await import('pixelmatch')).default; L210: ({ PNG } = await import('pngjs'));

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/utils/mirror/verify.jsView on unpkg · L208

templates/docker/start.shView file

•path = templates/docker/start.sh kind = build_helper sizeBytes = 870 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docker/start.shView on unpkg

templates/regenerator/server.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

templates/regenerator/server.jsView on unpkg

Findings

2 High4 Medium5 Low

HighCopied Package Dependency Bridgesrc/utils/mirror/verify.js

HighPrevious Version Dangerous Deltatemplates/regenerator/server.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/docker/start.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/utils/asset-bundler.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

src/utils/asset-bundler.jsView file

Lines 1-32javascript

1import { createHash } from 'crypto';

2import { existsSync } from 'fs';

3import { writeFile, mkdir, readFile } from 'fs/promises';

4import { join, dirname, basename } from 'path';

5import fetch from 'node-fetch';

7/**

8 * AssetBundler — downloads CSS-referenced assets (fonts, images, SVGs) to a

9 * local directory and rewrites url() references in CSS so the resulting CSS is

10 * fully self-contained.

11 *

12 * Usage:

13 * const bundler = new AssetBundler('https://example.com', '/output/dir');

14 * const localCss = await bundler.rewriteCSSUrls(cssText, cssFileUrl);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/utils/asset-bundler.jsView on unpkg · L12

15 * await bundler.buildThemeCSS(stylesheetList); // writes theme.css

16 */

17export class AssetBundler {

18 /**

19 * @param {string} baseUrl - Origin of the WordPress site (e.g. "https://example.com")

20 * @param {string} outDir - Absolute path to the extract-design output directory

21 */

22 constructor(baseUrl, outDir) {

23 this.baseUrl = baseUrl.replace(/\/$/, '');

24 this.outDir = outDir;

25 this.assetsDir = join(outDir, 'assets');

26 this.manifestPath = join(this.assetsDir, 'manifest.json');

27 /** @type {Record<string, { localFile: string; originalUrl: string; size: number; error?: string }>} */

28 this._manifest = {};

29 }

src/utils/mirror/verify.jsView file

Lines 188-228javascript

188 try {

189 let p = decodeURIComponent(req.url.split('?')[0]);

190 if (p.endsWith('/')) p += 'index.html';

191 const { extname } =

templates/docker/start.shView file

•path = templates/docker/start.sh kind = build_helper sizeBytes = 870 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docker/start.shView on unpkg

templates/regenerator/server.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

templates/regenerator/server.jsView on unpkg