registry / blitzframes / 0.1.3

blitzframes@0.1.3

⚠ Under review

Static Scan Results

scanned 24d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 11 file(s), 41.8 KB of source, external domains: blitzframes.com, github.com, www.remotion.dev

Source & flagged code

4 flagged

src/benchmark.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = blitzframes@0.1.2 matchedIdentity = npm:YmxpdHpmcmFtZXM:0.1.2 similarity = 0.909 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/benchmark.mjsView on unpkg

1/** The comparison: the composition rendered on the stock and BlitzFrames functions, interleaved. */ L2: import {spawn} from 'node:child_process'; L3: import {existsSync} from 'node:fs';

High

Child Process

Package source references child process execution.

src/benchmark.mjsView on unpkg · L1

src/project.mjsView file

25try { L26: const require = createRequire(join(dir, 'package.json')); L27: // A CommonJS entry imported from ESM exposes only what the lexer detects; merge default and named exports.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/project.mjsView on unpkg · L25

src/guided.mjsView file

1/** npx blitzframes with no arguments: token, credentials, project, functions, benchmark, setup. */ L2: import {createInterface} from 'node:readline'; L3: import {existsSync} from 'node:fs'; L4: import {execSync} from 'node:child_process'; L5: import {join, resolve} from 'node:path';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/guided.mjsView on unpkg · L1

Source & flagged code

4 flagged · loading source

src/benchmark.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/benchmark.mjsView on unpkg

1/** The comparison: the composition rendered on the stock and BlitzFrames functions, interleaved. */ L2: import {spawn} from 'node:child_process'; L3: import {existsSync} from 'node:fs';

High

Child Process

Package source references child process execution.

src/benchmark.mjsView on unpkg · L1

src/project.mjsView file

25try { L26: const require = createRequire(join(dir, 'package.json')); L27: // A CommonJS entry imported from ESM exposes only what the lexer detects; merge default and named exports.

Medium

Findings

1 Critical3 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltasrc/benchmark.mjs

HighChild Processsrc/benchmark.mjs

HighShell

HighRuntime Package Installsrc/guided.mjs

MediumDynamic Requiresrc/project.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to blitzframes@0.1.3.

See version security history for other recorded verdicts.

Review the evidence and your use of blitzframes@0.1.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-14 10:49:37.768Z (UTC).