registry / @stacksjs/actions / 0.75.270
@stacksjs/actions@0.75.270
The Stacks actions.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe manifest has no install-time lifecycle hook; prepublishOnly runs the package build. Inspected flagged behavior is consistent with the package’s stated framework functions, and no concrete attack behavior was found.
Static reason
One or more suspicious static signals were detected.
Trigger
Consumers import the package or invoke its exported framework, build, or generation functions.
Impact
No confirmed attack surface was established in the inspected paths.
Mechanism
The inspected code registers an action runner, generates framework files from project data, checks dependency lock consistency, and provides caller-directed HTTP utilities.
AI rationale
The manifest has no install-time lifecycle hook; prepublishOnly runs the package build. Inspected flagged behavior is consistent with the package’s stated framework functions, and no concrete attack behavior was found.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exports the built entrypoints and its only lifecycle hook is prepublishOnly, which runs a build.
- The API dependency’s fetcher performs requests to the URL passed by its caller; its entrypoint exports general HTTP utilities.
- The action runner imports this package only as a fallback when no runner is registered, and the package entrypoint registers its local runAction function.
- Package discovery builds a manifest from project package metadata, supports dry runs, and writes the generated manifest through the configured storage path.
- The pantry-lock checker compares declared dependency ranges with resolved versions; route type generation writes generated route data to the framework auto-import path.
- The inspected auth dependency is an authentication library with ordinary package exports; no attack behavior was identified in the inspected paths.
Evidence against
- Scanner signals for network access, environment variables, dynamic loading, and possible secrets do not establish malicious behavior in the inspected source.
- Static semantic analysis reported a limit for pantry-lock.js, but its inspected source performs dependency lock consistency checks.
Source & flagged code
4 flaggeddist/github-release.jsView file
5patternName = generic_password
severity = medium
line = 5
Medium
dist/lint/stx-gate.jsView file
1import{existsSync}from"node:fs";import{join}from"node:path";import process from"node:process";import{Glob}from"bun";export const DEFAULT_STX_LINT_CONFIG={stxGlob:"resources/**/*.st...
L2: `).forEach((line,i)=>{re.lastIndex=0;if(!re.test(line))return;if(ignore){ignore.lastIndex=0;if(ignore.test(line))return}hits.push(`${f}:${i+1} ${line.trim().slice(0,90)}`)})}retur...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/lint/stx-gate.jsView on unpkg · L1dist/discover-packages.jsView file
Findings
2 High5 Medium6 Low
HighCopied Package Dependency Bridgedist/discover-packages.js
HighSemantic Analysis Limiteddist/pantry-lock.js
MediumSecret Patterndist/github-release.js
MediumDynamic Requiredist/lint/stx-gate.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @stacksjs/actions@0.75.270.
See all versions of @stacksjs/actions for other recorded verdicts.
- Review the evidence and your use of @stacksjs/actions@0.75.270 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.