registry / @speed.press/kit / 1.8.0

@speed.press/kit@1.8.0

Convert WordPress sites into pixel-faithful Astro frontends

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 41 file(s), 336 KB of source, external domains: 127.0.0.1, aiscan.site, console.anthropic.com, integration.xcloud.host, www.sitemaps.org, xcloud.host

Source & flagged code

3 flagged

src/utils/asset-bundler.jsView file

Lines 1-32javascript

1import { createHash } from 'crypto';

2import { existsSync } from 'fs';

3import { writeFile, mkdir, readFile } from 'fs/promises';

4import { join, dirname, basename } from 'path';

5import fetch

Source & flagged code

3 flagged · loading source

src/utils/asset-bundler.jsView file

12* Usage: L13: * const bundler = new AssetBundler('https://example.com', '/output/dir'); L14: * const localCss = await bundler.rewriteCSSUrls(cssText, cssFileUrl); ... L42: _resolveUrl(ref, cssFileUrl) { L43: if (ref.startsWith('data:')) return ref; L44: try { ... L97: if (!res.ok) throw new Error(`HTTP ${res.status}`); L98: const buf = Buffer.from(await res.arrayBuffer()); L99: await writeFile(localPath, buf);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/utils/asset-bundler.jsView on unpkg · L12

src/utils/mirror/verify.jsView file

208package = @speed.press/kit; repositoryIdentity = xcloud-headless; dependency = pixelmatch L208: ({ chromium } = await import('playwright')); L209: pixelmatch = (await import('pixelmatch')).default; L210: ({ PNG } = await import('pngjs'));

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/utils/mirror/verify.jsView on unpkg · L208

templates/docker/start.shView file

•path = templates/docker/start.sh kind = build_helper sizeBytes = 870 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docker/start.shView on unpkg

Findings

1 High4 Medium5 Low

HighCopied Package Dependency Bridgesrc/utils/mirror/verify.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/docker/start.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/utils/asset-bundler.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

src/utils/mirror/verify.jsView file

Lines 188-228javascript

188 try {

189 let p = decodeURIComponent(req.url.split('?')[0]);

190 if (p.endsWith('/')) p += 'index.html';

191 const { extname } = await import('node:path');

192 const fp = join(rootDir, p.replace(/^\/+/, ''));

193 const { readFile: rf } = await import('node:fs/promises');

194 const buf = await rf(fp);

195 res.writeHead(200, { 'Content-Type': MIME[extname(fp).toLowerCase()] || 'application/octet-stream' });

196 res.end(buf);

197 } catch {

198 res.writeHead(404); res.end('not found');

199 }

200 });

201 return new Promise((resolve) => server.listen(0, '127.0.0.1', () => resolve({ server, port: server.address().port })));

202}

203

204/** Visual diff (best-effort; needs Playwright + Chromium). Adds screenshots + mismatch %. */

205export async function visualReport({ projectDir, url, outDir, maxPages = 10 }) {

206 let chromium, pixelmatch, PNG;

207 try {

208 ({ chromium } = await import('playwright'));

209 pixelmatch = (await import('pixelmatch')).default;

210 ({ PNG } = await import('pngjs'));

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/utils/mirror/verify.jsView on unpkg · L208

211 } catch (err) {

212 return { kind: 'visual', skipped: `Chromium/deps unavailable: ${err.message}` };

213 }

214

215 const origin = new URL(url).origin;

216 const publicDir = join(projectDir, 'public');

217 const manifestPath = join(projectDir, 'dependency-manifest.json');

218 let pageIndex = [];

219 try { pageIndex = JSON.parse(await readFile(manifestPath, 'utf8')).page_index || []; } catch { /* ignore */ }

220 pageIndex = pageIndex.slice(0, maxPages);

221

222 await mkdir(outDir, { recursive: true });

223 const { server, port } = await serveDir(publicDir);

224 const browser = await chromium.launch({ headless: true });

225 const ctx = await browser.newContext({

226 viewport: { width: 1280, height: 800 },

227 userAgent: 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36',

228 ignoreHTTPSErrors: true,