Loading npm security reports…
cli for blok
Static analysis completed at 0.0% confidence. No malicious behavior was detected; 28 low-signal pattern(s) were surfaced and cleared.
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/index.jsView on unpkg · L1This report applies to blokctl@2.5.3.
See version security history for other recorded verdicts.
Evidence last updated: .
Package source references dynamic require/import behavior.
dist/scaffold-repo/triggers/websocket/src/WebSocketTrigger.tsView on unpkg · L401A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/commands/inertia/ssr.jsView on unpkg · L1Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/services/posthog.jsView on unpkg · L9A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/services/posthog.jsView on unpkg · L9Package ships non-JavaScript build or shell helper files.
dist/scaffold-repo/sdks/python3/bin/worker.pyView on unpkgPackage hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
dist/scaffold-repo/sdks/python3/tests/test_grpc_server.pyView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/commands/create/spa.js#virtual:normalized:round1View on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/commands/build/index.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/commands/create/node.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/commands/dev/index.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/commands/install/node.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/commands/publish/node.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/commands/routes/index.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/js-worker.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/commands/generate/NodeFileWriter.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/runtime-detector.jsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/commands/create/project.jsView on unpkgSource spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/index.jsView on unpkg · L1Package ships non-JavaScript build or shell helper files.
dist/scaffold-repo/sdks/python3/bin/worker.pyView on unpkgPackage hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
dist/scaffold-repo/sdks/python3/tests/test_grpc_server.pyView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/commands/create/spa.js#virtual:normalized:round1View on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/commands/build/index.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/commands/create/node.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/commands/dev/index.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/commands/install/node.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/commands/publish/node.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/commands/routes/index.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/js-worker.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/commands/generate/NodeFileWriter.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/runtime-detector.jsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/commands/create/project.jsView on unpkgPackage source references dynamic require/import behavior.
dist/scaffold-repo/triggers/websocket/src/WebSocketTrigger.tsView on unpkg · L401A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/commands/inertia/ssr.jsView on unpkg · L1Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/services/posthog.jsView on unpkg · L9A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/services/posthog.jsView on unpkg · L9