@stacksjs/actions@0.75.272
The Stacks actions.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe automatic postinstall hook setup creates an unresolved risk because it may alter the consumer project’s Git behavior. The flagged route generator only writes generated route data to framework storage, and no concrete malicious behavior was established.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing the dependency tree containing @stacksjs/gitit.
Impact
This may change Git commit behavior or modify staged files, but no broader or malicious effect was confirmed.
Mechanism
Its postinstall invokes a Git hook installer, with configuration for a staged-file fixer and a commit-message check; the installer’s full behavior is not established by the inspected source.
AI rationale
The automatic postinstall hook setup creates an unresolved risk because it may alter the consumer project’s Git behavior. The flagged route generator only writes generated route data to framework storage, and no concrete malicious behavior was established.
Evidence
package.json.lpm-dependency-evidence-72312175-832c-4bef-b1af-d417a62e87dd/17/npm-linux/package.json
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest includes @stacksjs/gitit as a dependency, and an upgrade module imports its template download function.
- The dependency’s postinstall starts a Git hook installer automatically during dependency installation.
- The dependency configures a pre-commit staged-file fixer and a commit-message check.
- The flagged route generator writes generated route data to the framework’s storage path.
Evidence against
- The inspected source does not establish the Git hook installer’s full scope or show credential collection, unrelated network transfer, or destructive behavior.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
4 flaggeddist/github-release.jsView file
5patternName = generic_password
severity = medium
line = 5
Medium
dist/lint/stx-gate.jsView file
1import{existsSync}from"node:fs";import{join}from"node:path";import process from"node:process";import{Glob}from"bun";export const DEFAULT_STX_LINT_CONFIG={stxGlob:"resources/**/*.st...
L2: `).forEach((line,i)=>{re.lastIndex=0;if(!re.test(line))return;if(ignore){ignore.lastIndex=0;if(ignore.test(line))return}hits.push(`${f}:${i+1} ${line.trim().slice(0,90)}`)})}retur...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/lint/stx-gate.jsView on unpkg · L1dist/discover-packages.jsView file
Findings
2 High5 Medium6 Low
HighCopied Package Dependency Bridgedist/discover-packages.js
HighSemantic Analysis Limiteddist/pantry-lock.js
MediumSecret Patterndist/github-release.js
MediumDynamic Requiredist/lint/stx-gate.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @stacksjs/actions@0.75.272.
See all versions of @stacksjs/actions for other recorded verdicts.
- Review the evidence and your use of @stacksjs/actions@0.75.272 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.