registry / kizlo / 0.3.0

kizlo@0.3.0

A headless WordPress toolkit for TypeScript.

Static Scan Results

scanned 17h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 105 file(s), 227 KB of source, external domains: api.friendlycaptcha.com, api.hcaptcha.com, challenges.cloudflare.com, example.com, github.com, kizlo.io, schema.org, verify-api.arkoselabs.com, wp.your-app.com, www.google.com, www.sitemaps.org, your-app.com

Source & flagged code

5 flagged

dist/cli/wp/constants.jsView file

Lines 18-51javascript

18];

19/** Credentials artifact location, relative to the config root. */

20const CREDENTIALS_REL = ".kizlo/test-credentials.json";

21/**

22* DB-side marker written as the final bootstrap step and checked by `isSeeded`.

23* It records that this database holds a completed bootstrap — independent of any

24* fixture content, which is optional and varies per consumer. Bump `SEED_VERSION`

25* to force a reseed when the bootstrap contract changes.

26*/

27const SEED_MARKER_OPTION = "kizlo_test_seeded";

28const SEED_VERSION = "1";

29/** The kizlo core WordPress plugin, always installed during bootstrap. */

30const DEFAULT_PLUGINS = [{

31 name: "kizlo",

32 source: kizloRelease("kizlo")

33}];

34const TEST_ADMIN = {

35 firstName: "Admin",

36 lastName: "",

37 username: "admin",

38 password: "admin_pass",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli/wp/constants.jsView on unpkg · L38

39 email: "admin@example.com"

40};

41const TEST_USER = {

42 firstName: "User",

43 lastName: "",

44 username: "user",

45 email: "user@example.com",

46 password: "user_pass",

Medium

Secret Pattern

Hardcoded password in dist/cli/wp/constants.js

dist/cli/wp/constants.jsView on unpkg · L46

47 role: "subscriber"

48};

50//#endregion

51export { COMPOSE_FILE, CONFIG_FILES, CREDENTIALS_REL, DEFAULT_PLUGINS, DEFAULT_PORT, OPCACHE_INI, REMAP_ENTRYPOINT, SEED_MARKER_OPTION, SEED_VERSION, TEST_ADMIN, TEST_USER };

dist/cli/daemon/generate.jsView file

Lines 9-40javascript

9const CONTRACT_BARREL = [

10 `import type { router } from ".."`,

11 `import contractJson from "./contract.json"`,

12 ``,

13 `export const contract = contractJson as unknown as typeof router`,

14 ``

15].join("\n");

dist/cli/wp/compose/remap-entrypoint.shView file

•path = dist/cli/wp/compose/remap-entrypoint.sh kind = build_helper sizeBytes = 714 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/cli/wp/compose/remap-entrypoint.shView on unpkg

dist/cli/commands/test.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = kizlo@0.2.0 matchedIdentity = npm:a2l6bG8:0.2.0 similarity = 0.776 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/commands/test.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/cli/wp/constants.jsView file

38patternName = generic_password severity = medium line = 38 matchedText = password...ss",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli/wp/constants.jsView on unpkg · L38

46patternName = generic_password severity = medium line = 46 matchedText = password...ss",

Medium

Secret Pattern

Hardcoded password in dist/cli/wp/constants.js

dist/cli/wp/constants.jsView on unpkg · L46

dist/cli/daemon/generate.jsView file

29const entry = path.resolve(cfg.cwd, cfg.serverEntry); L30: const { router } = await jiti.import(entry); L31: if (!router) return false;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/daemon/generate.jsView on unpkg · L29

dist/cli/wp/compose/remap-entrypoint.shView file

•path = dist/cli/wp/compose/remap-entrypoint.sh kind = build_helper sizeBytes = 714 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/cli/wp/compose/remap-entrypoint.shView on unpkg

dist/cli/commands/test.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/commands/test.jsView on unpkg

Findings

1 High7 Medium3 Low

HighPrevious Version Dangerous Deltadist/cli/commands/test.js

MediumSecret Patterndist/cli/wp/constants.js

MediumDynamic Requiredist/cli/daemon/generate.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/cli/wp/compose/remap-entrypoint.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/cli/wp/constants.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/cli/wp/constants.jsView file

Lines 18-51javascript

18];

19/** Credentials artifact location, relative to the config root. */

20const CREDENTIALS_REL = ".kizlo/test-credentials.json";

21/**

22* DB-side marker written as the final bootstrap step and checked by `isSeeded`.

23* It records that this database holds a completed bootstrap — independent of any

24* fixture content, which is optional and varies per consumer. Bump `SEED_VERSION`

25* to force a reseed when the bootstrap contract changes.

26*/

27const SEED_MARKER_OPTION = "kizlo_test_seeded";

28const SEED_VERSION = "1";

29/** The kizlo core WordPress plugin, always installed during bootstrap. */

30const DEFAULT_PLUGINS = [{

31 name: "kizlo",

32 source: kizloRelease("kizlo")

33}];

34const TEST_ADMIN = {

35 firstName: "Admin",

36 lastName: "",

37 username: "admin",

38 password: "admin_pass",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli/wp/constants.jsView on unpkg · L38

39 email: "admin@example.com"

40};

41const TEST_USER = {

42 firstName: "User",

43 lastName: "",

44 username: "user",

45 email: "user@example.com",

46 password: "user_pass",

Medium

Secret Pattern

Hardcoded password in dist/cli/wp/constants.js

dist/cli/wp/constants.jsView on unpkg · L46

47 role: "subscriber"

48};

50//#endregion

51export { COMPOSE_FILE, CONFIG_FILES, CREDENTIALS_REL, DEFAULT_PLUGINS, DEFAULT_PORT, OPCACHE_INI, REMAP_ENTRYPOINT, SEED_MARKER_OPTION, SEED_VERSION, TEST_ADMIN, TEST_USER };

dist/cli/daemon/generate.jsView file

Lines 9-40javascript

9const CONTRACT_BARREL = [

10 `import type { router } from ".."`,

11 `import contractJson from "./contract.json"`,

12 ``,

13 `export const contract = contractJson as unknown as typeof router`,

14 ``

15].join("\n");

dist/cli/wp/compose/remap-entrypoint.shView file

•path = dist/cli/wp/compose/remap-entrypoint.sh kind = build_helper sizeBytes = 714 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/cli/wp/compose/remap-entrypoint.shView on unpkg

dist/cli/commands/test.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/commands/test.jsView on unpkg