registry / blitzframes / 0.1.2

blitzframes@0.1.2

⚠ Under review

Static Scan Results

scanned 24d ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 11 file(s), 41.5 KB of source, external domains: blitzframes.com, github.com, www.remotion.dev

Source & flagged code

3 flagged

src/benchmark.mjsView file

1/** The comparison: the composition rendered on the stock and BlitzFrames functions, interleaved. */ L2: import {spawn} from 'node:child_process'; L3: import {existsSync} from 'node:fs';

High

Child Process

Package source references child process execution.

src/benchmark.mjsView on unpkg · L1

src/project.mjsView file

25try { L26: const require = createRequire(join(dir, 'package.json')); L27: // A CommonJS entry imported from ESM exposes only what the lexer detects; merge default and named exports.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/project.mjsView on unpkg · L25

src/guided.mjsView file

1/** npx blitzframes with no arguments: token, credentials, project, functions, benchmark, setup. */ L2: import {createInterface} from 'node:readline'; L3: import {existsSync} from 'node:fs'; L4: import {execSync} from 'node:child_process'; L5: import {join, resolve} from 'node:path';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/guided.mjsView on unpkg · L1

Source & flagged code

3 flagged · loading source

src/benchmark.mjsView file

1/** The comparison: the composition rendered on the stock and BlitzFrames functions, interleaved. */ L2: import {spawn} from 'node:child_process'; L3: import {existsSync} from 'node:fs';

High

Child Process

Package source references child process execution.

src/benchmark.mjsView on unpkg · L1

src/project.mjsView file

25try { L26: const require = createRequire(join(dir, 'package.json')); L27: // A CommonJS entry imported from ESM exposes only what the lexer detects; merge default and named exports.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/project.mjsView on unpkg · L25

src/guided.mjsView file

Findings

3 High3 Medium5 Low

HighChild Processsrc/benchmark.mjs

HighShell

HighRuntime Package Installsrc/guided.mjs

MediumDynamic Requiresrc/project.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to blitzframes@0.1.2.

See version security history for other recorded verdicts.

Review the evidence and your use of blitzframes@0.1.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-14 09:43:50.379Z (UTC).