registry / @stacksjs/actions / 0.75.344
@stacksjs/actions@0.75.344
The Stacks actions.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe package root initializes and exports actions, while its only lifecycle hook is a prepublish build. The flagged credential use is part of an AWS deployment flow, and the reviewed discovery and tray behaviors are action-driven rather than hidden install-time activity.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Explicit use of development or deployment actions; package-root import only initializes the action runner and exports actions.
Impact
Expected project and cloud changes when the corresponding actions are deliberately invoked; no automatic install-time credential transfer or unrelated host contact was found.
Mechanism
Project discovery writes a generated project manifest; tray actions run project commands; deployment uses AWS credentials for deployment operations.
AI rationale
The package root initializes and exports actions, while its only lifecycle hook is a prepublish build. The flagged credential use is part of an AWS deployment flow, and the reviewed discovery and tray behaviors are action-driven rather than hidden install-time activity.
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest routes the package root to dist/index.js; that entry wires the action runner and exports framework actions.
- The only lifecycle script is prepublishOnly, which runs the build and is not a registry-install hook.
- Package discovery writes a project manifest only when its exported discovery function is called; the root entry does not invoke it.
- The system tray deployment action checks for a confirmation flag before launching the project’s buddy deploy command.
- Deployment reads AWS credentials from the environment or project .env files as part of an AWS deployment flow; no unrelated credential recipient was identified.
Evidence against
- The system tray server is configured with auth disabled, and its API can launch project commands; its deployment route requires a confirmation flag.
- The deployment module performs substantial build and cloud operations when loaded, so importing that specific module has side effects.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
5 flaggeddist/github-release.jsView file
5patternName = generic_password
severity = medium
line = 5
Medium
dist/lint/stx-gate.jsView file
1import{existsSync}from"node:fs";import{join}from"node:path";import process from"node:process";import{Glob}from"bun";export const DEFAULT_STX_LINT_CONFIG={stxGlob:"resources/**/*.st...
L2: `).forEach((line,i)=>{re.lastIndex=0;if(!re.test(line))return;if(ignore){ignore.lastIndex=0;if(ignore.test(line))return}hits.push(`${f}:${i+1} ${line.trim().slice(0,90)}`)})}retur...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/lint/stx-gate.jsView on unpkg · L1dist/discover-packages.jsView file
Findings
3 High5 Medium6 Low
HighCopied Package Dependency Bridgedist/discover-packages.js
HighSemantic Analysis Limiteddist/pantry-lock.js
HighPrevious Version Dangerous Deltadist/dev/system-tray.js
MediumSecret Patterndist/github-release.js
MediumDynamic Requiredist/lint/stx-gate.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @stacksjs/actions@0.75.344.
See all versions of @stacksjs/actions for other recorded verdicts.
- Review the evidence and your use of @stacksjs/actions@0.75.344 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.