registry / infra-kit / 0.1.131

infra-kit@0.1.131

infra-kit

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 25 file(s), 246 KB of source, external domains: 127.0.0.1, acme.atlassian.net, cli.github.com, cmux.com, cursor.com, docs.aws.amazon.com, docs.doppler.com, github.com, registry.npmjs.org, your-domain.atlassian.net, zed.dev

Source & flagged code

4 flagged

dist/dev-server.jsView file

Lines 1-23javascript

1import{b as V,c as Pe}from"./chunk-C2HRONYA.js";import{d as ge,e as fe,f as ve,i as ye}from"./chunk-6YAKVQZN.js";import{A as ae,B as A,C as le,D as pe,E as ue,G as ce,H as de,K as I,L as N,M as w,S as O,v as S,w as k,x as L,y as se,z as $}from"./chunk-X2L4F2VM.js";import{a as G}from"./chunk-6FU2TRU5.js";import{d as me,m as he}from"./chunk-CHETBZ6M.js";import{a as H,b as j,c as U}from"./chunk-LTKR3F4N.js";import{Command as Lt}from"commander";import x from"node:process";import{pathToFileURL as $t}from"node:url";import*as Ee from"node:path";import vr from"node:process";var er=t=>({pane:{surfaces: ...

2`).flatMap(e=>{let[r,n,i]=e.trim().split(/\s+/);if(r==null||n==null||i==null)return[];let o=Number(r),s=Number(n),a=Number(i);return!Number.isInteger(o)||!Number.isInteger(s)||!Number.isInteger(a)?[]:[{pid:o,ppid:s,pgid:a}]}),ar=(t,e,r)=>{let n=new Map;for(let a of e){let l=n.get(a.ppid);l?l.push(a):n.set(a.ppid,[a])}let i=new Set([t]),o=new Set([t]),s=[t];for(let a=0;a<s.length;a+=1)for(let l of n.get(s[a]??-1)??[])o.has(l.pid)||(o.add(l.pid),i.add(l.pgid),s.push(l.pid));return[...i].filter(a=>a>1&&a!==r)},K=()=>{try{return sr(rr(ir,["-eo","pid=,ppid=,pgid="],{encoding:"utf8",maxBuffer:8<<20} ...

High

Child Process

Package source references child process execution.

dist/dev-server.jsView on unpkg · L1

3${e.stack??"(no stack)"}`:String(e);Ae(`

4\u2717 Teardown failed while handling ${t}: ${r}

5`)},F=({onSignal:t,exit:e=hr,register:r=gr,forceReap:n=xe})=>{let i=null,o=s=>{if(i!==null){if(s!==i)return;Ae(`

6\u26A0 Received ${s} again \u2014 force-quitting.

7`),n(),e(Se(s));return}i=s,(async()=>{try{await t(s)}catch(a){fr(s,a)}finally{e(Se(s))}})()};for(let s of cr)r(s,()=>o(s))};var yr=(t,e)=>t.

8Received ${e}, closing cmux dev workspace ${t}...`),await ve(t)}})},Re=async t=>{let e=k(vr.cwd()),r=wr(e,$(t.include));if(r.length===0){S.warn("No API apps found to run");return}let n=Pr(t.presetDef),i=yr(r.map(u=>({app:u.name,targets:n.get(u.name)})),t.watch??!1),o=we(i),s=`${Ee.basename(e)} dev`,a=await fe({cwd:e,title:s,layout:o});br(r,a),Dr(a);let l=setInterval(()=>{l.refresh()},2**30);await new Promise(()=>{})};import Ce from"node:process";var xr=t=>{try{Ce.stderr.write(t)}catch{}},Sr=(t,e)=>{let r=e instanceof Error?`${e.message}

9${e.stack??"(no stack)"}`:String(e);xr(`

10\u26A0\uFE0F ${t}: ${r}

11 dev-server kept alive (likely a bug in a handler's async path); restart if it misbehaves.

12`)},Ar=(t,e)=>{Ce.on(t,e)},Te=({onFault:t=Sr,register:e=Ar}={})=>{let r=n=>i=>{t(n,i)};e("uncaughtException",r("uncaughtException")),e("unhandledRejection",r("unhandledRejection"))};import yt from"chokidar";import{exec as Pt,execFileSync as wt}from"node:child_process";import*as m from"node:fs";import bt from"node:net";import Dt from"node:os";import*as g from"node:path";import d from"node:process";import xt from"node:util";import{execFile as Er}from"node:child_process";import*as ke from"node:fs";import*as M from"node:path";import{promisify as Rr}from"node:util";var Cr=Rr(Er),Tr=t=>{try{let e=JS ...

13`)})}serverConfig;importCacheBust;logger;server;controllers={};registeredRouteKeys=new Set;getRegisteredRoutes(){return[...this.registeredRouteKeys].sort()}async start(){this.registerHealthRoute(),await Promise.all(this.loadRoutes());let e=await this.listenWithFallback();return this.serverConfig.port=e,this.logger.info(`Server listening on http://127.0.0.1:${e}`,{address:`http://127.0.0.1:${e}`}),e}async listenWithFallback(){let e=this.serverConfig.port;if(e!=null)try{return await this.server.listen({port:e,host:"127.0.0.1"}),this.readBoundPort()}catch(r){if(!nt(r))throw r}return await this.se ...

14`);r=o.pop()??"";for(let s of o)n(s);r.length>vt&&(n(r),r="")}),t.on("end",()=>{r!==""&&(n(r),r="")}),t.on("error",i=>{e.appendLog?.(`[infra-kit] ui dev stream error: ${i.message}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/dev-server.jsView on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/dev-server.jsView on unpkg · L12

15`)})},Ve=({packageNames:t,cwd:e,concurrency:r,env:n,appendLog:i,onLine:o,onUnexpectedExit:s})=>{let a=t.map(u=>`--filter=${u}`),l=lt("pnpm",["exec","turbo","run","dev",...a,`--concurrency=${r}`,"--env-mode=loose","--only","--output-logs=new-only","--no-update-notifier","--ui=stream"],{cwd:e,detached:!0,stdio:["ignore","pipe","pipe"],env:{...pt.env,...n}});return Ge(l.stdout,{appendLog:i,onLine:o}),Ge(l.stderr,{appendLog:i,onLine:o}),_(l,void 0,s)};var v=ze();function ze(){return g.join(he(),d.env[me]??"no-session","logs.txt")}function St(){v=ze(),m.mkdirSync(g.dirname(v),{recursive:!0}),m.writ ...

17`)}function Je(t){let e=Dt.homedir();return t===e||t.startsWith(`${e}${g.sep}`)?`~${t.slice(e.length)}`:t}function Ke(t){return t.map

18`)[0]?.trim()??"";return r===""?"unknown error (see the log)":r},te=class t{monorepoRoot;devContextDir;appServers=[];watchDebounceTimers=new Map;watcher=null;static WATCH_DEBOUNCE_MS=400;restartWorkChain=Promise.resolve();static PORT_RELEASE_DELAY_MS=200;livenessTimer=null;livenessFailures=new Map;static LIVENESS_INTERVAL_MS=5e3;static LIVENESS_FAILURE_THRESHOLD=2;options;runBuild;turboWatchFactory;turboWatch=null;uiDevFactory;uiDev=null;uiLogStream=null;dryRunner;failedApps=[];renderer;healthProbe;proxy;proxyPort;registeredAliases=new Set;uiPortMap={};shuttingDown=!1;closureMap=null;closureBu ...

19`)}let r=await Ye(e);Te(),F({onSignal:async n=>{x.stdout.write(`

20Received ${n}, shutting down dev-server...

21`),await r.shutdown()}})},Ut=(t,e,r)=>!t.preset&&!t.app&&!t.self&&!t.cmux&&!t.watch&&!t.verbose&&!t.routes&&!t.proxyPort&&e&&!r,_t=t=>({watch:t.watch,cmux:t.cmux,include:t.include??null,preset:t.preset,presetDef:t.presetDef,self:!1,verbose:!1,routes:

22//# sourceMappingURL=dev-server.js.map

Long lines were clipped for display.

dist/chunk-CHETBZ6M.jsView file

Lines 1-4javascript

1import T from"node:crypto";import r from"node:fs";import F from"node:os";import n from"node:path";import A from"node:process";var V="env-load.sh",a="env-clear.sh",p="projects",O=7200,

Source & flagged code

4 flagged · loading source

dist/dev-server.jsView file

High

Child Process

Package source references child process execution.

dist/dev-server.jsView on unpkg · L1

1import{b as V,c as Pe}from"./chunk-C2HRONYA.js";import{d as ge,e as fe,f as ve,i as ye}from"./chunk-6YAKVQZN.js";import{A as ae,B as A,C as le,D as pe,E as ue,G as ce,H as de,K as ... L2: `).flatMap(e=>{let[r,n,i]=e.trim().split(/\s+/);if(r==null||n==null||i==null)return[];let o=Number(r),s=Number(n),a=Number(i);return!Number.isInteger(o)||!Number.isInteger(s)||!Num... L3: ${e.stack??"(no stack)"}`:String(e);Ae(` ... L12: `)},Ar=(t,e)=>{Ce.on(t,e)},Te=({onFault:t=Sr,register:e=Ar}={})=>{let r=n=>i=>{t(n,i)};e("uncaughtException",r("uncaughtException")),e("unhandledRejection",r("unhandledRejection"))... L13: `)})}serverConfig;importCacheBust;logger;server;controllers={};registeredRouteKeys=new Set;getRegisteredRoutes(){return[...this.registeredRouteKeys].sort()}async start(){this.regis... L14: `);r=o.pop()??"";for(let s of o)n(s);r.length>vt&&(n(r),r="")}),t.on("end",()=>{r!==""&&(n(r),r="")}),t.on("error",i=>{e.appendLog?.(`[infra-kit] ui dev stream error: ${i.message}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/dev-server.jsView on unpkg · L1

12`)},Ar=(t,e)=>{Ce.on(t,e)},Te=({onFault:t=Sr,register:e=Ar}={})=>{let r=n=>i=>{t(n,i)};e("uncaughtException",r("uncaughtException")),e("unhandledRejection",r("unhandledRejection"))... L13: `)})}serverConfig;importCacheBust;logger;server;controllers={};registeredRouteKeys=new Set;getRegisteredRoutes(){return[...this.registeredRouteKeys].sort()}async start(){this.regis... L14: `);r=o.pop()??"";for(let s of o)n(s);r.length>vt&&(n(r),r="")}),t.on("end",()=>{r!==""&&(n(r),r="")}),t.on("error",i=>{e.appendLog?.(`[infra-kit] ui dev stream error: ${i.message}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/dev-server.jsView on unpkg · L12

dist/chunk-CHETBZ6M.jsView file

1import T from"node:crypto";import r from"node:fs";import F from"node:os";import n from"node:path";import A from"node:process";var V="env-load.sh",a="env-clear.sh",p="projects",O=72... L2: `)){if(!_){let c=I.exec(s);c&&o.push(c[1])}_=L(s,_)}return o},R=()=>{let t=A.env.XDG_CACHE_HOME,e=t&&t.length>0?t:n.join(F.homedir(),".cache");return n.join(e,"infra-kit")},f=()=>{... L3: //# sourceMappingURL=chunk-CHETBZ6M.js.map

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-CHETBZ6M.jsView on unpkg · L1

Findings

2 High4 Medium6 Low

HighChild Processdist/dev-server.js

HighCommand Output Exfiltrationdist/dev-server.js

MediumDynamic Requiredist/dev-server.js

MediumNetwork

MediumInstall Persistencedist/chunk-CHETBZ6M.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/dev-server.jsView file

Lines 1-23javascript

1import{b as V,c as Pe}from"./chunk-C2HRONYA.js";import{d as ge,e as fe,f as ve,i as ye}from"./chunk-6YAKVQZN.js";import{A as ae,B as A,C as le,D as pe,E as ue,G as ce,H as de,K as I,L as N,M as w,S as O,v as S,w as k,x as L,y as se,z as $}from"./chunk-X2L4F2VM.js";import{a as G}from"./chunk-6FU2TRU5.js";import{d as me,m as he}from"./chunk-CHETBZ6M.js";import{a as H,b as j,c as U}from"./chunk-LTKR3F4N.js";import{Command as Lt}from"commander";import x from"node:process";import{pathToFileURL as $t}from"node:url";import*as Ee from"node:path";import vr from"node:process";var er=t=>({pane:{surfaces: ...

High

Child Process

Package source references child process execution.

dist/dev-server.jsView on unpkg · L1

3${e.stack??"(no stack)"}`:String(e);Ae(`

4\u2717 Teardown failed while handling ${t}: ${r}

5`)},F=({onSignal:t,exit:e=hr,register:r=gr,forceReap:n=xe})=>{let i=null,o=s=>{if(i!==null){if(s!==i)return;Ae(`

6\u26A0 Received ${s} again \u2014 force-quitting.

7`),n(),e(Se(s));return}i=s,(async()=>{try{await t(s)}catch(a){fr(s,a)}finally{e(Se(s))}})()};for(let s of cr)r(s,()=>o(s))};var yr=(t,e)=>t.

9${e.stack??"(no stack)"}`:String(e);xr(`

10\u26A0\uFE0F ${t}: ${r}

11 dev-server kept alive (likely a bug in a handler's async path); restart if it misbehaves.

14`);r=o.pop()??"";for(let s of o)n(s);r.length>vt&&(n(r),r="")}),t.on("end",()=>{r!==""&&(n(r),r="")}),t.on("error",i=>{e.appendLog?.(`[infra-kit] ui dev stream error: ${i.message}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/dev-server.jsView on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/dev-server.jsView on unpkg · L12

17`)}function Je(t){let e=Dt.homedir();return t===e||t.startsWith(`${e}${g.sep}`)?`~${t.slice(e.length)}`:t}function Ke(t){return t.map

19`)}let r=await Ye(e);Te(),F({onSignal:async n=>{x.stdout.write(`

20Received ${n}, shutting down dev-server...

22//# sourceMappingURL=dev-server.js.map

Long lines were clipped for display.

dist/chunk-CHETBZ6M.jsView file

Lines 1-4javascript

1import T from"node:crypto";import r from"node:fs";import F from"node:os";import n from"node:path";import A from"node:process";var V="env-load.sh",a="env-clear.sh",p="projects",O=7200,