registry / cdk-insights / 1.59.2

cdk-insights@1.59.2

⚠ Under review

AWS CDK security and cost analysis CLI. Free static scans via npm — no account needed. Sign up free to add AI-powered insights.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 3.28 MB of source, external domains: api.cdkinsights.dev, api.github.com, cdkinsights.dev, docs.aws.amazon.com, dotenvx.com, github.com, http-intake.logs, raw.githubusercontent.com, s2zhmjbwlj.execute-api.eu-west-2.amazonaws.com, sqs.eu-west-2.amazonaws.com, yargs.js.org

Source & flagged code

8 flagged

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = cdk-insights@1.57.0 matchedIdentity = npm:Y2RrLWluc2lnaHRz:1.57.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

2549${z.info("\u{1F4CB} Falling back to static analysis only")}`),e.log(z.comment("\u{1F4A1} Upgrade to Pro for unlimited AI analysis: https://cdkinsights.dev/pricing")),e.log(`${z.com... L2550: `))}}},q=N1();var MA=e=>e&&(e.Name||e.ResourceName||e.FunctionName)||"Unnamed";var pp=null,BA=e=>{pp=e};var mp=()=>{if(pp&&!process.env.CI)try{pp.saveToDisk(),Je.info("\u{1F4BE} Ca... L2551: `).map(t=>t.trim()).filter(Boolean).join(`

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2549

2545${z.primary.bold("\u{1F381} CDK Insights Trial")}`),e.log(z.comment("\u2500".repeat(50))),e.log(`${Ee} Status: ${ye.bold(Ge)}`),de&&e.log(`\u{1F4E6} Plan: ${z.info.bold(de.charAt(0... L2546: ${z.comment("\u{1F4A1} Next Steps:")}`),te?(e.log(z.error(" \u274C Trial expired - upgrade to continue")),e.log(z.comment(" \u{1F517} https://cdkinsights.dev/pricing"))):ee>=90... L2547: `)},displayQuotaWarning:T=>{let{currentResourcesAnalyzed:O,maxResources:Q,requestedResources:fe,isTrial:te}=T;if(!te)return;O+fe>Q&&(e.log(` ... L2549: ${z.info("\u{1F4CB} Falling back to static analysis only")}`),e.log(z.comment("\u{1F4A1} Upgrade to Pro for unlimited AI analysis: https://cdkinsights.dev/pricing")),e.log(`${z.com... L2550: `))}}},q=N1();var MA=e=>e&&(e.Name||e.ResourceName||e.FunctionName)|

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L2545

1"use strict";var II=Object.create;var ra=Object.defineProperty;var kI=Object.getOwnPropertyDescriptor;var EI=Object.getOwnPropertyNames;var RI=Object.getPrototypeOf,TI=Object.proto... L2: `;Le.DEFAULT_CONTENT_TYPE="application/octet-stream";Le.prototype.append=function(e,t,s){s=s||{},typeof s=="string"&&(s={filename:s});var r=Nu.prototype.append.bind(this);if((typeo...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

dist/entry.jsView file

1#!/usr/bin/env node L2: "use strict";var l9=Object.create;var hg=Object.defineProperty;var u9=Object.getOwnPropertyDescriptor;var d9=Object.getOwnPropertyNames;var p9=Object.getPrototypeOf,f9=Object.proto... L3: `);let n;for(;(n=x9.exec(s))!=null;){let r=n[1],i=n[2]||"";i=i.trim();let o=i[0];i=i.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),o==='"'&&(i=i.replace(/\\n/g,` L4: `),i=i.replace(/\\r/g,"\r")),e[r]=i}return e}function v9(t){let e=sD(t),s=Xt.configDotenv({path:e});if(!s.parsed){let o=new Error(`MISSING_DATA: Cannot parse ${e} for an unknown re... L5: `).forEach(function(o){r=o.indexOf(":"),s=o.substring(0,r).trim().toLowerCase(),n=o.substring(r+1).trim(),!(!s||e[s]&&yj[s])&&(s==="set-cookie"?e[s]?e[s].push(n):e[s]=[n]:e[s]=e[s]... L6: `)}getSetCookie(){return this.get("set-cookie")||

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/entry.jsView on unpkg · L1

1Trigger-reachable chain: manifest.bin -> dist/entry.js L1: #!/usr/bin/env node L2: "use strict";var l9=Object.create;var hg=Object.defineProperty;var u9=Object.getOwnPropertyDescriptor;var d9=Object.getOwnPropertyNames;var p9=Object.getPrototypeOf,f9=Object.proto... L3: `);let n;for(;(n=x9.exec(s))!=null;){let r=n[1],i=n[2]||"";i=i.trim();let o=i[0];i=i.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),o==='"'&&(i=i.replace(/\\n/g,` L4: `),i=i.replace(/\\r/g,"\r")),e[r]=i}return e}function v9(t){let e=sD(t),s=Xt.configDotenv({path:e});if(!s.parsed){let o=new Error(`MISSING_DATA: Cannot parse ${e} for an unknown re... L5: `).forEach(function(o){r=o.indexOf(":"),s=o.substring(0,r).trim().toLowerCase(),n=o.substring(r+1).trim(),!(!s||e[s]&&yj[s])&&(s==="set-cookie"?e[s]?e[s].push(n):e[s]=[n]:e[s]=e[s]..

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/entry.jsView on unpkg · L1

Source & flagged code

8 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code