registry / blitzframes / 0.1.8

blitzframes@0.1.8

⚠ Under review

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 11 file(s), 42.0 KB of source, external domains: blitzframes.com, github.com, www.remotion.dev

Source & flagged code

3 flagged

src/benchmark.mjsView file

1/** The comparison: the composition rendered on the stock and BlitzFrames functions, interleaved. */ L2: import {spawn} from 'node:child_process'; L3: import {existsSync} from 'node:fs';

High

Child Process

Package source references child process execution.

src/benchmark.mjsView on unpkg · L1

src/project.mjsView file

25try { L26: const require = createRequire(join(dir, 'package.json')); L27: // A CommonJS entry imported from ESM exposes only what the lexer detects; merge default and named exports.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/project.mjsView on unpkg · L25

src/guided.mjsView file

1/** npx blitzframes with no arguments: token, credentials, project, functions, benchmark, setup. */ L2: import {createInterface} from 'node:readline'; L3: import {existsSync} from 'node:fs'; L4: import {execSync} from 'node:child_process'; L5: import {join, resolve} from 'node:path';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/guided.mjsView on unpkg · L1

Source & flagged code

3 flagged · loading source

src/benchmark.mjsView file

1/** The comparison: the composition rendered on the stock and BlitzFrames functions, interleaved. */ L2: import {spawn} from 'node:child_process'; L3: import {existsSync} from 'node:fs';

High

Child Process

Package source references child process execution.

src/benchmark.mjsView on unpkg · L1

src/project.mjsView file

25try { L26: const require = createRequire(join(dir, 'package.json')); L27: // A CommonJS entry imported from ESM exposes only what the lexer detects; merge default and named exports.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/project.mjsView on unpkg · L25

src/guided.mjsView file

Findings

3 High3 Medium5 Low

HighChild Processsrc/benchmark.mjs

HighShell

HighRuntime Package Installsrc/guided.mjs

MediumDynamic Requiresrc/project.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to blitzframes@0.1.8.

See version security history for other recorded verdicts.

Review the evidence and your use of blitzframes@0.1.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-27 07:35:40.285Z (UTC).