registry / @stacksjs/buddy / 0.70.67

@stacksjs/buddy@0.70.67

⚠ Under review

Meet Buddy. The Stacks runtime.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 71 file(s), 503 KB of source, external domains: 0.0.0.0, 127.0.0.1, api.hetzner.cloud, api.porkbun.com, console.aws.amazon.com, console.hetzner.cloud, github.com, stacksjs.com, us-east-1.console.aws.amazon.com

Source & flagged code

7 flagged

dist/commands/mail.jsView file

Lines 1-26javascript

1import { log, runCommand } from "@stacksjs/cli";

2import { ExitCode } from "@stacksjs/types";

3import { getErrorMessage } from "@stacksjs/utils";

4import { CLI } from "@stacksjs/clapp";

5import { createHash, createHmac, randomBytes } from "crypto";

6import { readFileSync, existsSync } from "node:fs";

7import { execSync } from "node:child_process";

8export function mailCommands(buddy) {

High

Child Process

Package source references child process execution.

dist/commands/mail.jsView on unpkg · L6

9 buddy.command("mail:provision", "Provision this app's mail from config/email.ts onto the shared mail server (domain + DKIM + mailboxes + MX/SPF/DKIM/DMARC DNS). Reusable + idempotent; the same reconcile buddy deploy runs.").option("--ip <ip>", "Mail server IP (defaults to the A record of config.email.domain)").action(async (options) => {

10 const { email: emailConfig } = await import("@stacksjs/config"), domain = emailConfig?.domain;

11 if (!domain) {

12 log.error("config/email.ts has no `domain` \u2014 set it (e.g. domain: 'bughq.org') and add `mailboxes`.");

13 process.exit(ExitCode.FatalError);

14 }

15 let ip = options.ip;

16 if (!ip)

17 try {

18 ip = (await (await import("node:dns")).promises.resolve4(domain))[0];

19 } catch {

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/commands/mail.jsView on unpkg · L1

20 log.error(`Could not resolve an IP for ${domain}. Deploy the site first, or pass --ip <mail-server-ip>.`);

21 process.exit(ExitCode.FatalError);

22 }

23 const { provisionMailTenant, reconcileMailDns } = await import("./deploy");

24 log.info(`Provisioning mail for ${domain} on ${ip}...`);

25 const res = await provisionMailTenant(ip, log);

26 if (res)

Lines 332-399javascript

332 });

333 buddy.command("mail:port25:status", "Check outbound port 25 status on the mail server").option("--provider <provider>", "Cloud provider: aws or hetzner", { default: "aws" }).action(async (options) => {

334 loadEnvFiles();

335 const region = process.env.AWS_REGION ||

dist/config.jsView file

Lines 127-167javascript

127 errors.push({

128 path: key,

129 message: `Unknown configuration key. Valid keys are: ${validKeys.join(", ")}`,

130 value: config[key]

131 });

132 return errors;

133}

134let cachedConfig = null

dist/commands/make.jsView file

Lines 3-43javascript

3 createMiddleware,

4 createMigration,

5 createModel,

6 createNotification,

7 createPage,

8 invoke,

9 makeAction,

10 makeCertificate,

11 makeCommand,

12 makeComponent,

13 makeDatabase,

14 makeFunction,

15 makeJob,

dist/commands/deploy.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @stacksjs/buddy@0.70.65 matchedIdentity = npm:QHN0YWNrc2pzL2J1ZGR5:0.70.65 similarity = 0.986 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/deploy.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/commands/mail.jsView file

6import { readFileSync, existsSync } from "node:fs"; L7: import { execSync } from "node:child_process"; L8: export function mailCommands(buddy) {

High

Child Process

Package source references child process execution.

dist/commands/mail.jsView on unpkg · L6

352log.info(`Found Hetzner server: ${mailServer.name} (${serverIp})`); L353: const result = execSync(`ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 root@${serverIp} "timeout 5 bash -c 'echo QUIT > /dev/tcp/gmail-smtp-in.l.google.com/25' 2>&1 && echo ... L354: printPort25Status(result.trim(), "Hetzner", serverIp);

High

Shell

Package source references shell execution.

dist/commands/mail.jsView on unpkg · L352

379const result = await ssm.runShellCommand(instanceId, [ L380: 'timeout 5 bash -c "echo QUIT > /dev/tcp/gmail-smtp-in.l.google.com/25" 2>&1 && echo PORT_25_OPEN || echo PORT_25_BLOCKED' L381: ], { timeoutSeconds: 15, maxWaitMs: 20000, pollIntervalMs: 2000 }); ... L390: loadEnvFiles(); L391: const domain = process.env.APP_DOMAIN || process.env.MAIL_DOMAIN || "stacksjs.com", port = Number.parseInt(options.port, 10), mailboxes = ["chris", "blake", "glenn"], users = {}, g... L392: for (const name of mailboxes) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/mail.jsView on unpkg · L379

1import { log, runCommand } from "@stacksjs/cli"; L2: import { ExitCode } from "@stacksjs/types"; L3: import { getErrorMessage } from "@stacksjs/utils"; ... L6: import { readFileSync, existsSync } from "node:fs"; L7: import { execSync } from "node:child_process"; L8: export function mailCommands(buddy) { ... L17: try { L18: ip = (await (await import("node:dns")).promises.resolve4(domain))[0]; L19: } catch { ... L33: try { L34: const password = options.password || randomBytes(16).toString("base64").replace(/[+/=]/g, "").substring(0, 16), passwordHash = createHash("sha256").update(password).digest("hex"), ... L35: await new DynamoDBClient(process.env.AWS_REGION || "us-east-1").putItem({

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/commands/mail.jsView on unpkg · L1

dist/config.jsView file

147log.debug(`Loading buddy config from ${configPath}`); L148: const configModule = await import(configPath), config = configModule.default || configModule, validationErrors = validateConfig(config); L149: if (validationErrors.length > 0) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config.jsView on unpkg · L147

dist/commands/make.jsView file

23package = @stacksjs/buddy; repositoryIdentity = stacks; dependency = @stacksjs/actions L23: setDryRun L24: } from "@stacksjs/actions"; L25: import { intro, italic, onUnknownSubcommand, outro } from "@stacksjs/cli";

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/commands/make.jsView on unpkg · L23

dist/commands/deploy.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/deploy.jsView on unpkg

Findings

1 Critical5 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/commands/deploy.js

HighChild Processdist/commands/mail.js

HighShelldist/commands/mail.js

HighSame File Env Network Executiondist/commands/mail.js

HighCredential Exfiltrationdist/commands/mail.js

HighCopied Package Dependency Bridgedist/commands/make.js

MediumDynamic Requiredist/config.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/commands/mail.jsView file

Lines 1-26javascript

1import { log, runCommand } from "@stacksjs/cli";

2import { ExitCode } from "@stacksjs/types";

3import { getErrorMessage } from "@stacksjs/utils";

4import { CLI } from "@stacksjs/clapp";

5import { createHash, createHmac, randomBytes } from "crypto";

6import { readFileSync, existsSync } from "node:fs";

7import { execSync } from "node:child_process";

8export function mailCommands(buddy) {

High

Child Process

Package source references child process execution.

dist/commands/mail.jsView on unpkg · L6

10 const { email: emailConfig } = await import("@stacksjs/config"), domain = emailConfig?.domain;

11 if (!domain) {

12 log.error("config/email.ts has no `domain` \u2014 set it (e.g. domain: 'bughq.org') and add `mailboxes`.");

13 process.exit(ExitCode.FatalError);

14 }

15 let ip = options.ip;

16 if (!ip)

17 try {

18 ip = (await (await import("node:dns")).promises.resolve4(domain))[0];

19 } catch {

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/commands/mail.jsView on unpkg · L1

20 log.error(`Could not resolve an IP for ${domain}. Deploy the site first, or pass --ip <mail-server-ip>.`);

21 process.exit(ExitCode.FatalError);

22 }

23 const { provisionMailTenant, reconcileMailDns } = await import("./deploy");

24 log.info(`Provisioning mail for ${domain} on ${ip}...`);

25 const res = await provisionMailTenant(ip, log);

26 if (res)

Lines 332-399javascript

332 });

334 loadEnvFiles();

335 const region = process.env.AWS_REGION ||

dist/config.jsView file

Lines 127-167javascript

127 errors.push({

128 path: key,

129 message: `Unknown configuration key. Valid keys are: ${validKeys.join(", ")}`,

130 value: config[key]

131 });

132 return errors;

133}

134let cachedConfig = null

dist/commands/make.jsView file

Lines 3-43javascript

3 createMiddleware,

4 createMigration,

5 createModel,

6 createNotification,

7 createPage,

8 invoke,

9 makeAction,

10 makeCertificate,

11 makeCommand,

12 makeComponent,

13 makeDatabase,

14 makeFunction,

15 makeJob,

dist/commands/deploy.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/deploy.jsView on unpkg