registry / infra-kit / 0.1.125

infra-kit@0.1.125

infra-kit

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 180 file(s), 606 KB of source, external domains: acme.atlassian.net, cli.github.com, cursor.com, docs.aws.amazon.com, docs.doppler.com, github.com, your-domain.atlassian.net, zed.dev

Source & flagged code

2 flagged

src/lib/package-validator/loader/config-loader.tsView file

Lines 40-78typescript

40 *

41 * @example

42 * await loadPackageConfig('/repo/packages/serverless-config')

43 * // => { requiredScripts: [], requiredFiles: ['serverless.common.yml'], turboTasks: [] }

44 */

45export const loadPackageConfig = async (

46 packageDir: string,

47 baseline: Readonly<ResolvedPackageRules> = DEFAULT_RULES,

48): Promise<ResolvedPackageRules> => {

49 const configPath = path.join(packageDir, PACKAGE_CONFIG_FILE)

51 if (!(await pathExists(configPath))) {

52 throw new Error(`${PACKAGE_CONFIG_FILE} not found at ${configPath}`)

53 }

55 // Cache-bust with the file mtime so repeated loads (long-running MCP server)

56 // pick up edits without a process restart. `.ts` configs load via Node's

57 // native type stripping (the repo requires Node >= 24).

58 const stat = await fs.stat(configPath)

59 const moduleUrl = `${pathToFileURL(configPath).href}?mtime=${Number(stat.mtimeMs)}`

61 const imported = (await import(moduleUrl)) as { default?: unknown }

62 const rawExport = imported.default

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/lib/package-validator/loader/config-loader.tsView on unpkg · L60

64 if (rawExport === undefined) {

65 throw new Error(`${PACKAGE_CONFIG_FILE} at ${configPath} has no default export`)

66 }

68 const resolvedExport = typeof rawExport === 'function' ? await (rawExport as () => unknown)() : rawExport

70 const parsed = packageConfigSchema.safeParse(resolvedExport)

72 if (!parsed.success) {

73 throw new Error(`Invalid ${PACKAGE_CONFIG_FILE} at ${configPath}: ${z.prettifyError(parsed.error)}`)

74 }

76 return resolvePackageConfig(parsed.data, baseline)

77}

dist/chunk-VI7TEWVJ.jsView file

Lines 1-21javascript

1import{b as Ie,c as Tt,d as $t,e as ur,f as fn}from"./chunk-WA4BQRDC.js";import hn from"node:process";import Pt from"pino";import ci from"pino-pretty";var gn="/tmp/mcp-infra-kit.log",xp=()=>{let

Source & flagged code

2 flagged · loading source

src/lib/package-validator/loader/config-loader.tsView file

60L61: const imported = (await import(moduleUrl)) as { default?: unknown } L62: const rawExport = imported.default

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/lib/package-validator/loader/config-loader.tsView on unpkg · L60

dist/chunk-VI7TEWVJ.jsView file

1import{b as Ie,c as Tt,d as $t,e as ur,f as fn}from"./chunk-WA4BQRDC.js";import hn from"node:process";import Pt from"pino";import ci from"pino-pretty";var gn="/tmp/mcp-infra-kit.lo... L2: `).filter(Boolean),o={release:fi,feature:gi};return t.map(o[e]).filter(n=>n!==null)},xn=e=>{let r=e.trimEnd();if(!r.endsWith("]"))return null;let t=r.lastIndexOf("[");if(t===-1)ret... L3: ${e.packageName} \u2014 ${r}`);for(let t of e.checks){let o=t.status==="pass"?"[PASS]":"[FAIL]";c.info(` ${o} ${t.name}: ${t.message}`)}},$n=async(e={})=>{let r=await Ai(e),t=[];f... ... L6: ${r} L7: ${t}`,wr=({content:e,body:r,startMarker:t,endMarker:o,placement:n="replace-in-place"})=>{let s=Pn(t,r,o),i=He(e,t,o);if(n==="replace-in-place"&&i){let p=e.indexOf(t),d=e.indexOf(o)... L8: ${s} L9: `:`${s} L10: `};import O from"node:fs";import kr from"node:path";import Gt from"node:fs/promises";import Fi from"node:os";import vr from"node:path";import{z as y}from"zod";var In="infra-kit.jso... L11: `),_n=e=>{if(O.existsSync(e)&&O.lstatSync(e).isSymbolicLink())throw new Error(`Refusing to write ${e} because the destination is a symlink`)},Nn=e=>{let r=new Date().toISOString().... ... L61: // "provider": "jira", L6

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-VI7TEWVJ.jsView on unpkg · L1

Findings

5 Medium5 Low

MediumDynamic Requiresrc/lib/package-validator/loader/config-loader.ts

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/chunk-VI7TEWVJ.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

src/lib/package-validator/loader/config-loader.tsView file

Lines 40-78typescript

40 *

41 * @example

42 * await loadPackageConfig('/repo/packages/serverless-config')

43 * // => { requiredScripts: [], requiredFiles: ['serverless.common.yml'], turboTasks: [] }

44 */

45export const loadPackageConfig = async (

46 packageDir: string,

47 baseline: Readonly<ResolvedPackageRules> = DEFAULT_RULES,

48): Promise<ResolvedPackageRules> => {

49 const configPath = path.join(packageDir, PACKAGE_CONFIG_FILE)

51 if (!(await pathExists(configPath))) {

52 throw new Error(`${PACKAGE_CONFIG_FILE} not found at ${configPath}`)

53 }

55 // Cache-bust with the file mtime so repeated loads (long-running MCP server)

56 // pick up edits without a process restart. `.ts` configs load via Node's

57 // native type stripping (the repo requires Node >= 24).

58 const stat = await fs.stat(configPath)

59 const moduleUrl = `${pathToFileURL(configPath).href}?mtime=${Number(stat.mtimeMs)}`

61 const imported = (await import(moduleUrl)) as { default?: unknown }

62 const rawExport = imported.default

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/lib/package-validator/loader/config-loader.tsView on unpkg · L60

64 if (rawExport === undefined) {

65 throw new Error(`${PACKAGE_CONFIG_FILE} at ${configPath} has no default export`)

66 }

68 const resolvedExport = typeof rawExport === 'function' ? await (rawExport as () => unknown)() : rawExport

70 const parsed = packageConfigSchema.safeParse(resolvedExport)

72 if (!parsed.success) {

73 throw new Error(`Invalid ${PACKAGE_CONFIG_FILE} at ${configPath}: ${z.prettifyError(parsed.error)}`)

74 }

76 return resolvePackageConfig(parsed.data, baseline)

77}

dist/chunk-VI7TEWVJ.jsView file

Lines 1-21javascript

1import{b as Ie,c as Tt,d as $t,e as ur,f as fn}from"./chunk-WA4BQRDC.js";import hn from"node:process";import Pt from"pino";import ci from"pino-pretty";var gn="/tmp/mcp-infra-kit.log",xp=()=>{let