registry  /  infra-kit  /  0.1.132

infra-kit@0.1.132

⚠ Under review

infra-kit

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedUrlStrings
Manifest
NoLicense
scanned 21 file(s), 251 KB of source, external domains: 127.0.0.1, acme.atlassian.net, cli.github.com, cmux.com, cursor.com, docs.aws.amazon.com, docs.doppler.com, github.com, registry.npmjs.org, your-domain.atlassian.net, zed.dev

Source & flagged code

5 flagged · loading source
dist/chunk-IGTHMZPR.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = infra-kit@0.1.131 matchedIdentity = npm:aW5mcmEta2l0:0.1.131 similarity = 0.524 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-IGTHMZPR.jsView on unpkg
1import{a as v}from"./chunk-6FU2TRU5.js";import{m as f,q as P}from"./chunk-CHETBZ6M.js";import m from"node:path";var d="infra-kit",h=`${d}@latest`,S=(t,e,n)=>{let r=m.relative(n(m.r... L2: //# sourceMappingURL=chunk-IGTHMZPR.js.map
High
Child Process

Package source references child process execution.

dist/chunk-IGTHMZPR.jsView on unpkg · L1
dist/dev-server.jsView file
1import{d as M,h as ae,l as ue,m as ce,n as de,q as he}from"./chunk-RSF5XAQJ.js";import{A as ee,B as S,C as re,D as te,E as ne,G as ie,H as oe,K as se,Q as O,v as b,w as P,x as R,y ... L2: `).flatMap(e=>{let[r,n,i]=e.trim().split(/\s+/);if(r==null||n==null||i==null)return[];let o=Number(r),s=Number(n),a=Number(i);return!Number.isInteger(o)||!Number.isInteger(s)||!Num... L3: ${e.stack??"(no stack)"}`:String(e);be(` ... L12: `)},yr=(t,e)=>{De.on(t,e)},xe=({onFault:t=vr,register:e=yr}={})=>{let r=n=>i=>{t(n,i)};e("uncaughtException",r("uncaughtException")),e("unhandledRejection",r("unhandledRejection"))... L13: `)})}serverConfig;importCacheBust;logger;server;controllers={};registeredRouteKeys=new Set;getRegisteredRoutes(){return[...this.registeredRouteKeys].sort()}async start(){this.regis... L14: `);r=o.pop()??"";for(let s of o)n(s);r.length>Gr&&(n(r),r="")}),t.on("end",()=>{r!==""&&(n(r),r="")}),t.on("error",i=>{e.appendLog?.(`[infra-kit] ui dev stream error: ${i.message}
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/dev-server.jsView on unpkg · L1
12`)},yr=(t,e)=>{De.on(t,e)},xe=({onFault:t=vr,register:e=yr}={})=>{let r=n=>i=>{t(n,i)};e("uncaughtException",r("uncaughtException")),e("unhandledRejection",r("unhandledRejection"))... L13: `)})}serverConfig;importCacheBust;logger;server;controllers={};registeredRouteKeys=new Set;getRegisteredRoutes(){return[...this.registeredRouteKeys].sort()}async start(){this.regis... L14: `);r=o.pop()??"";for(let s of o)n(s);r.length>Gr&&(n(r),r="")}),t.on("end",()=>{r!==""&&(n(r),r="")}),t.on("error",i=>{e.appendLog?.(`[infra-kit] ui dev stream error: ${i.message}
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/dev-server.jsView on unpkg · L12
dist/chunk-GQHUWUJL.jsView file
1import{a as u,b as O}from"./chunk-RXEMP3VI.js";import{a as $n,b as Sn,c as In,d as An,e as _n,f as Nn,g as On,i as Hr,j as ze,k as Zr,o as Yr,p as ae,q as qe}from"./chunk-RSF5XAQJ.... L2: ${e.packageName} \u2014 ${r}`);for(let t of e.checks){let o=t.status==="pass"?"[PASS]":"[FAIL]";l.info(` ${o} ${t.name}: ${t.message}`)}},Bn=async(e={})=>{let r=await Mi(e),t=[];f... ... L5: ${r} L6: ${t}`,gr=({content:e,body:r,startMarker:t,endMarker:o,placement:n="replace-in-place"})=>{let s=Jn(t,r,o),i=Ze(e,t,o);if(n==="replace-in-place"&&i){let p=e.indexOf(t),d=e.indexOf(o)... L7: ${s} ... L30: // "provider": "jira", L31: // "config": { "baseUrl": "https://acme.atlassian.net", "projectId": 123 } L32: // }, ... L139: } L140: `;import Xi from"node:fs/promises";import Qi from"node:os";var V=async e=>{try{return await Xi.access(e),!0}catch{return!1}},y=e=>{let r=Qi.homedir();return e.startsWith(r)?`~${e.s... L141: `,"utf-8");let n=Mt(e.projectName),s=await oa(t)!==n;return s&&await et.writeFile(t,n,"utf-8"),o&&En(),{configPath:r,examplePath:t,createdConfig:o,refreshedExample:s}},tt=e=>`Creat... ... L149: `,"utf-8"),await B.rm(t,{force:!0}),p?l.info(`\u26A0 Migrated ${y(t)} \u2192 ${y(e)}
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-GQHUWUJL.jsView on unpkg · L1

Findings

1 Critical2 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/chunk-IGTHMZPR.js
HighChild Processdist/chunk-IGTHMZPR.js
HighCommand Output Exfiltrationdist/dev-server.js
MediumDynamic Requiredist/dev-server.js
MediumNetwork
MediumInstall Persistencedist/chunk-GQHUWUJL.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License