registry / @stacksjs/actions / 0.75.274
@stacksjs/actions@0.75.274
The Stacks actions.
AI Security Review
scanned 13d ago · by lpm-firewall-aiSource inspection resolved the scanner flags as package-aligned framework behavior, and the package has no install lifecycle hook. The inspected API helper uses the URL and credentials supplied through its request methods; no unrelated recipient or automatic credential transfer was found.
Static reason
One or more suspicious static signals were detected.
Trigger
These operations run when their exported framework functions are called; the manifest's prepublish command runs a build.
Impact
No unconsented installation behavior, credential disclosure, destructive action, or other confirmed attack surface was established.
Mechanism
The inspected code reads project metadata, writes generated files under framework storage, validates declared dependencies, and sends HTTP requests to supplied URLs.
AI rationale
Source inspection resolved the scanner flags as package-aligned framework behavior, and the package has no install lifecycle hook. The inspected API helper uses the URL and credentials supplied through its request methods; no unrelated recipient or automatic credential transfer was found.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies the Stacks repository and declares only a build command for prepublish; no install lifecycle hook is present.
- The API fetcher sends requests to the caller-provided URL and attaches credentials only through explicit token or authentication methods.
- The action type generator reads registered routes and writes generated route types under framework storage.
- The action runner delegates named actions to the installed actions package; its manifest has no install lifecycle script.
- The inspected API and authentication dependencies expose their libraries and have no install lifecycle scripts; their request helper performs ordinary HTTP requests.
- Package discovery reads project package metadata and writes a generated manifest; pantry-lock checks workspace declarations and resolved versions.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
4 flaggeddist/github-release.jsView file
5patternName = generic_password
severity = medium
line = 5
Medium
dist/lint/stx-gate.jsView file
1import{existsSync}from"node:fs";import{join}from"node:path";import process from"node:process";import{Glob}from"bun";export const DEFAULT_STX_LINT_CONFIG={stxGlob:"resources/**/*.st...
L2: `).forEach((line,i)=>{re.lastIndex=0;if(!re.test(line))return;if(ignore){ignore.lastIndex=0;if(ignore.test(line))return}hits.push(`${f}:${i+1} ${line.trim().slice(0,90)}`)})}retur...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/lint/stx-gate.jsView on unpkg · L1dist/discover-packages.jsView file
Findings
2 High5 Medium6 Low
HighCopied Package Dependency Bridgedist/discover-packages.js
HighSemantic Analysis Limiteddist/pantry-lock.js
MediumSecret Patterndist/github-release.js
MediumDynamic Requiredist/lint/stx-gate.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @stacksjs/actions@0.75.274.
See all versions of @stacksjs/actions for other recorded verdicts.
- Review the evidence and your use of @stacksjs/actions@0.75.274 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.