registry / kcgrouter / 0.4.0

kcgrouter@0.4.0

Lightweight AI proxy gateway — route chat completions to upstream providers

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 180 file(s), 701 KB of source, external domains: api.anthropic.com, api.commandcode.ai, api.openai.com, api.xiaomimimo.com, codewhisperer.us-east-1.amazonaws.com, generativelanguage.googleapis.com, github.com, q.us-east-1.amazonaws.com, www.w3.org

Source & flagged code

3 flagged

package.jsonView file

Lines 15-55json

15 "scripts/postinstall.mjs",

16 "bunfig.toml",

17 "!src/**/__tests__/**",

18 "!src/**/*.test.ts",

19 "!src/**/*.test.tsx",

20 "!src/test-setup.ts"

21 ],

22 "engines": {

23 "bun": ">=1.2.3"

24 },

25 "scripts": {

26 "dev": "bun --hot src/index.ts",

27 "start": "NODE_ENV=production bun src/index.ts",

28 "build": "bun run build.ts",

29 "check": "biome check --write ./src",

30 "lint": "biome lint --write ./src",

31 "format": "biome format --write ./src",

32 "gen-env": "bash scripts/gen-env.sh",

33 "generate-icon": "bun scripts/generate-icon.ts",

34 "test": "bash scripts/test.sh",

35 "postinstall": "bun scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L35

36 "prepublishOnly": "bun run build"

37 },

38 "dependencies": {

39 "@clack/prompts": "^1.7.0",

40 "@radix-ui/react-label": "^2.1.7",

41 "@radix-ui/react-select": "^2.2.6",

42 "@radix-ui/react-slot": "^1.2.3",

43 "bun-plugin-tailwind": "^0.1.2",

44 "class-variance-authority": "^0.7.1",

45 "clsx": "^2.1.1",

46 "jsonc-parser": "^3.3.1",

47 "lucide-react": "^1",

48 "radix-ui": "^1.6.7",

49 "react": "^19",

50 "react-dom": "^19",

51 "recharts": "^3.10.1",

52 "sonner": "^2.0.7",

53 "tailwind-merge": "^3.3.1",

54 "tailwindcss": "^4.1.11",

55 "tw-animate-css": "^1.4.0"

src/cli/daemon.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = kcgrouter@0.3.0 matchedIdentity = npm:a2Nncm91dGVy:0.3.0 similarity = 0.733 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli/daemon.tsView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code