registry / @stacksjs/actions / 0.75.323
@stacksjs/actions@0.75.323
The Stacks actions.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe package's only lifecycle hook builds before publishing, and its import-time action-runner setup is consistent with its purpose. The AWS credential flow is in the deployment helper, while the stacksjs.com match is email-template content; no automatic credential exfiltration or unrelated action was found.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing the root configures the action runner; deployment and release behavior occurs through their respective helper flows.
Impact
No malicious impact identified; these operations match the package's framework purpose.
Mechanism
AWS credentials are used by the deployment flow, while GitHub credentials support GitHub release operations; no foreign credential transfer was identified.
AI rationale
The package's only lifecycle hook builds before publishing, and its import-time action-runner setup is consistent with its purpose. The AWS credential flow is in the deployment helper, while the stacksjs.com match is email-template content; no automatic credential exfiltration or unrelated action was found.
Evidence
dist/index.jsdist/deploy/index.jsdist/github-release.jsdist/bump.js
Network endpoints2
api.github.comgithub.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only declared lifecycle hook is prepublishOnly, which runs the package build.
- The root import configures the action runner and re-exports package APIs.
- The deployment helper loads AWS credentials and uses them in the framework deployment flow.
- The GitHub release helper obtains GitHub credentials for GitHub release operations.
- The stacksjs.com reference appears in a welcome email template, not as an AWS credential destination.
Evidence against
- Deployment code can read AWS credentials from environment variables or project .env files.
- The package includes network and filesystem operations for deployment, release publishing, and framework tasks.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
4 flaggeddist/github-release.jsView file
5patternName = generic_password
severity = medium
line = 5
Medium
dist/lint/stx-gate.jsView file
1import{existsSync}from"node:fs";import{join}from"node:path";import process from"node:process";import{Glob}from"bun";export const DEFAULT_STX_LINT_CONFIG={stxGlob:"resources/**/*.st...
L2: `).forEach((line,i)=>{re.lastIndex=0;if(!re.test(line))return;if(ignore){ignore.lastIndex=0;if(ignore.test(line))return}hits.push(`${f}:${i+1} ${line.trim().slice(0,90)}`)})}retur...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/lint/stx-gate.jsView on unpkg · L1dist/discover-packages.jsView file
Findings
2 High5 Medium6 Low
HighCopied Package Dependency Bridgedist/discover-packages.js
HighSemantic Analysis Limiteddist/pantry-lock.js
MediumSecret Patterndist/github-release.js
MediumDynamic Requiredist/lint/stx-gate.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @stacksjs/actions@0.75.323.
See all versions of @stacksjs/actions for other recorded verdicts.
- Review the evidence and your use of @stacksjs/actions@0.75.323 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.