registry / @stacksjs/actions / 0.75.388
@stacksjs/actions@0.75.388
The Stacks actions.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package has no install hook; its prepublishOnly script runs a build, and importing its main entry registers an action runner. The flagged AWS credential handling is consistent with deployment code using AWS services, and the review found no evidence that credentials are sent to stacksjs.com or another unrelated host.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Importing the main entry registers the action runner; cloud deployment behavior is in the deployment module.
Impact
No unauthorized collection, unrelated credential transfer, or other malicious impact was established.
Mechanism
The main entry registers a handler and exports APIs. Deployment code reads project AWS configuration and uses AWS clients for deployment tasks.
AI rationale
The package has no install hook; its prepublishOnly script runs a build, and importing its main entry registers an action runner. The flagged AWS credential handling is consistent with deployment code using AWS services, and the review found no evidence that credentials are sent to stacksjs.com or another unrelated host.
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only lifecycle script is prepublishOnly, which runs the build.
- The package entry point registers an action runner and exports package APIs.
- The deployment module reads AWS credentials from the project environment and assigns them to AWS-specific environment variables.
- The deployment code uses an ECR client to obtain an ECR authorization token.
Evidence against
- The deployment module performs cloud operations and reads credentials, but this behavior is consistent with a deployment tool.
- The flagged stacksjs.com references occur in deployment email content and site links; no credential transfer to that host was identified.
- The source-similarity alerts did not establish concealed or unrelated behavior.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
16 flaggeddist/github-release.jsView file
5patternName = generic_password
severity = medium
line = 5
Medium
dist/lint/stx-gate.jsView file
1import{existsSync}from"node:fs";import{join}from"node:path";import process from"node:process";import{Glob}from"bun";export const DEFAULT_STX_LINT_CONFIG={stxGlob:"resources/**/*.st...
L2: `).forEach((line,i)=>{re.lastIndex=0;if(!re.test(line))return;if(ignore){ignore.lastIndex=0;if(ignore.test(line))return}hits.push(`${f}:${i+1} ${line.trim().slice(0,90)}`)})}retur...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/lint/stx-gate.jsView on unpkg · L1dist/discover-packages.jsView file
Findings
14 High5 Medium6 Low
HighCopied Package Dependency Bridgedist/discover-packages.js
HighSemantic Analysis Limiteddist/pantry-lock.js
HighKnown Malware Source Similaritydist/setup/ssl.js
HighKnown Malware Source Similaritydist/deploy/index.js
HighKnown Malware Source Similaritydist/dev/system-tray.js
HighKnown Malware Source Similaritydist/project-scripts.js
HighKnown Malware Source Similaritydist/upgrade/framework-utils.js
HighKnown Malware Source Similaritydist/upgrade/framework.js
HighKnown Malware Source Similaritydist/dev/dashboard-supervisor.js
HighKnown Malware Source Similaritydist/make.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @stacksjs/actions@0.75.388.
See all versions of @stacksjs/actions for other recorded verdicts.
- Review the evidence and your use of @stacksjs/actions@0.75.388 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.