registry / @stacksjs/actions / 0.75.277
@stacksjs/actions@0.75.277
The Stacks actions.
AI Security Review
scanned 13d ago · by lpm-firewall-aiSource inspection found no malicious behavior: the package has no install lifecycle hook, and the flagged runtime code aligns with its project tooling and API utilities. Scanner signals for dynamic loading, network access, and environment access do not establish an attack in the inspected contexts.
Static reason
One or more suspicious static signals were detected.
Trigger
These functions run when an application imports or calls the corresponding exported API; the manifest’s prepublishOnly hook runs the build during publishing.
Impact
No confirmed attack impact was established.
Mechanism
The inspected code handles project metadata and caller-requested actions or HTTP requests; it does not show an install-time attack or a hidden credential transfer.
AI rationale
Source inspection found no malicious behavior: the package has no install lifecycle hook, and the flagged runtime code aligns with its project tooling and API utilities. Scanner signals for dynamic loading, network access, and environment access do not establish an attack in the inspected contexts.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the package through dist entrypoints; its prepublishOnly script runs a build, and it declares no install lifecycle hook.
- The package’s discovery code reads project dependency metadata and writes a discovered-package manifest; its lock checker compares declarations with lockfile resolutions.
- The action runner delegates a requested action by name, and the API dependency exports a generic HTTP client whose request method sends to the supplied URL.
- The inspected dependency manifests and entrypoints describe the action runner, API utilities, and authentication library; their scripts show build and typecheck tasks.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
4 flaggeddist/github-release.jsView file
5patternName = generic_password
severity = medium
line = 5
Medium
dist/lint/stx-gate.jsView file
1import{existsSync}from"node:fs";import{join}from"node:path";import process from"node:process";import{Glob}from"bun";export const DEFAULT_STX_LINT_CONFIG={stxGlob:"resources/**/*.st...
L2: `).forEach((line,i)=>{re.lastIndex=0;if(!re.test(line))return;if(ignore){ignore.lastIndex=0;if(ignore.test(line))return}hits.push(`${f}:${i+1} ${line.trim().slice(0,90)}`)})}retur...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/lint/stx-gate.jsView on unpkg · L1dist/discover-packages.jsView file
Findings
2 High5 Medium6 Low
HighCopied Package Dependency Bridgedist/discover-packages.js
HighSemantic Analysis Limiteddist/pantry-lock.js
MediumSecret Patterndist/github-release.js
MediumDynamic Requiredist/lint/stx-gate.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @stacksjs/actions@0.75.277.
See all versions of @stacksjs/actions for other recorded verdicts.
- Review the evidence and your use of @stacksjs/actions@0.75.277 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.