registry / ksk-design-system / 2.2.0

ksk-design-system@2.2.0

KSK Design System — フリーランス向けマルチテーマ対応デザインシステム

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 1.24 MB of source, external domains: api.github.com, github.com, notion.so, registry.npmjs.org, social-plugins.line.me, t.me, twitter.com, wa.me, www.facebook.com, www.npmjs.com, www.w3.org

Source & flagged code

3 flagged

bin/init.jsView file

Lines 5-45javascript

5// AI エージェントは node_modules 配下のファイルを自動で読まないため、

6// プロジェクトルートに AGENTS.md / CLAUDE.md（node_modules 内の DS ルールを

7// 参照する薄いポインタ）を置く必要がある。

8//

9// 設置は **明示実行のみ**（`npx ksk-ds init`）。install 時に自動で置く

10// postinstall フックは v1.60.0 で廃止した。install-time にプロジェクトルートへ

11// AI 指示ファイルを書き込む挙動は、サプライチェーン検査で

12// 「同意なき AI エージェント制御面の設置」として Critical 判定されるため

13// （LPM Firewall が 1.49.2 / 1.51.1 をこの理由でブロック判定）。

14//

15// Usage:

16// npx ksk-design-system init # AGENTS.md + CLAUDE.md を設置

17// npx ksk-design-system init --force # 既存ファイルを上書き

18// npx ksk-design-system demo [dir] # DS リポを clone + setup（お試し用）

19// npx ksk-ds lint src # contracts/rules.json に基づき consumer UI を検査

20// npx ksk-ds check-duplicates src # DS と同名のローカル実装を検査

21// npx ksk-ds codemod <name> ./src # scripts/codemod/<name>.mjs を実行

23import { copyFileSync, existsSync, readdirSync } from "node:fs"

24import { dirname, join, resolve } from "node:path"

25import { fileURLToPath } from "node:url"

26import { spawnSync } from "node:child_process"

28const __dirname = dirname(fileURLToPath(import.meta.url))

29const pkgRoot = resolve(__dirname, "..")

31const args = process.argv.slice(2)

32const cmd = args[0] || "init"

33const force = args.includes("--force")

35/** scripts/codemod/ 配下にあるが codemod として呼べないもの（雛形・読み取り専用スキャナ） */

36const NON_CODEMOD = new Set(["template", "check-migration"])

38/**

39 * 出力を掃いてから終了する（issue #394）。

40 *

41 * stdout がパイプのとき Node の書き込みは非同期で、process.exit() は未フラッシュ分を

42 * 捨てる。`ksk-ds lint --format json | jq` のように出力が 64KB（パイプバッファ1個分）を

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/init.jsView on unpkg · L25

43 * 超えると、そこで切られた壊れた JSON が相手に渡っていた。ファイルへのリダイレクトでは

44 * 書き込みが同期なので再現せず、パイプのときだけ壊れる。

45 *

•matchType = previous_version_dangerous_delta matchedPackage = ksk-design-system@2.0.1 matchedIdentity = npm:a3NrLWRlc2lnbi1zeXN0ZW0:2.0.1 similarity = 0.850 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/init.jsView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

Source & flagged code

3 flagged · loading source

bin/init.jsView file

25Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: execution+network L25: import { fileURLToPath } from "node:url" L26: import { spawnSync } from "node:child_process" L27: L28: const __dirname = dirname(fileURLToPath(import.meta.url)) L29: const pkgRoot = resolve(__dirname, "..") ... L40: * L41: * stdout がパイプのとき Node の書き込みは非同期で、process.exit() は未フラッシュ分を L42: * 捨てる。`ksk-ds lint --format json | jq` のように出力が 64KB（パイプバッファ1個分）を ... L50: if (process.stdout.writable) { L51: await new Promise((resolve) => process.stdout.write("", () => resolve())) L52: } ... L223: "--depth=1",

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/init.jsView on unpkg · L25

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/init.jsView on unpkg

package.jsonView file

Findings

3 High2 Medium4 Low

HighEntrypoint Build Divergencebin/init.js

HighSemantic Analysis Limitedpackage.json

HighPrevious Version Dangerous Deltabin/init.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to ksk-design-system@2.2.0.

See all versions of ksk-design-system for other recorded verdicts.

Review the evidence and your use of ksk-design-system@2.2.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-11 05:29:21.728Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.