registry / ksk-design-system / 2.20.0

ksk-design-system@2.20.0

⚠ Under review

KSK Design System — フリーランス向けマルチテーマ対応デザインシステム

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 22 file(s), 1.38 MB of source, external domains: api.github.com, github.com, line.me, notion.so, registry.npmjs.org, rolldown.rs, social-plugins.line.me, t.me, twitter.com, wa.me, www.facebook.com, www.npmjs.com, www.w3.org

Source & flagged code

3 flagged

bin/lint.jsView file

Lines 1-40javascript

1import { existsSync, readFileSync, readdirSync, statSync } from "node:fs"

2import { basename, extname, isAbsolute, join, relative, resolve } from "node:path"

3import { spawnSync } from "node:child_process"

4import {

5 inspectParallelPaletteCandidates,

6 inspectProductThemeOverrides,

7 loadProductThemeContract,

8} from "./product-theme-override.js"

9import { inspectUnlayeredGlobalOverrides } from "./unlayered-global-override.js"

11// card-child-spacing.js / overlay-footer-padding.js は `import ts from "typescript"` している

12// （P046 / P051 専用エンジン）。typescript は 24MB 前後あり、AST が要るのはこの2ルールだけなので、

13// 該当ルールが実際に有効なとき（rules.json に該当ルールがあり、対象ファイルも存在するとき）

14// だけ動的 import する（issue #409）。typescript が未インストールの consumer では

15// ERR_MODULE_NOT_FOUND で落とさず、該当ルールだけを skip して案内を1行出す。

16const tsEngineModulePromises = new Map()

17function loadTsEngine(specifier) {

18 if (!tsEngineModulePromises.has(specifier)) {

19 tsEngineModulePromises.set(

20 specifier,

21 import(specifier).catch((error) => {

22 return { __unavailable: true, error }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lint.jsView on unpkg · L20

23 }),

24 )

25 }

26 return tsEngineModulePromises.get(specifier)

27}

29/**

30 * TypeScript AST を使うエンジン。engine 名 → { module, export, label }。

31 * label は typescript 不在で skip するときの案内文に使う。

32 */

33const TS_ENGINES = {

34 "card-direct-child-spacing": {

35 module: "./card-child-spacing.js",

36 exportName: "inspectCardChildSpacing",

37 label: "P046（Card 直下の子要素スペーシング）",

38 },

39 "overlay-footer-padding": {

40 module: "./overlay-footer-padding.js",

bin/init.jsView file

Lines 5-45javascript

5// AI エージェントは node_modules 配下のファイルを自動で読まないため、

6// プロジェクトルートに AGENTS.md / CLAUDE.md（node_modules 内の DS ルールを

7// 参照する薄いポインタ）を置く必要がある。

8//

9// 設置は **明示実行のみ**（`npx ksk-ds init`）。install 時に自動で置く

10// postinstall フックは v1.60.0 で廃止した。install-time にプロジェクトルートへ

11// AI 指示ファイルを書き込む挙動は、サプライチェーン検査で

12// 「同意なき AI エージェント制御面の設置」として Critical 判定されるため

13// （LPM Firewall が 1.49.2 / 1.51.1 をこの理由でブロック判定）。

14//

15// Usage:

src/styles/source-safelist.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/styles/source-safelist.cssView on unpkg

Source & flagged code

3 flagged · loading source

bin/lint.jsView file

20specifier, L21: import(specifier).catch((error) => { L22: return { __unavailable: true, error }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lint.jsView on unpkg · L20

bin/init.jsView file

25Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: execution+network L25: import { fileURLToPath } from "node:url" L26: import { spawnSync } from "node:child_process" L27: L28: const __dirname = dirname(fileURLToPath(import.meta.url)) L29: const pkgRoot = resolve(__dirname, "..") ... L40: * L41: * stdout がパイプのとき Node の書き込みは非同期で、process.exit() は未フラッシュ分を L42: * 捨てる。`ksk-ds lint --format json | jq` のように出力が 64KB（パイプバッファ1個分）を ... L50: if (process.stdout.writable) { L51: await new Promise((resolve) => process.stdout.write("", () => resolve())) L52: } ... L223: "--depth=1",

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/init.jsView on unpkg · L25

src/styles/source-safelist.cssView file

Findings

2 High3 Medium4 Low

HighEntrypoint Build Divergencebin/init.js

HighSemantic Analysis Limitedsrc/styles/source-safelist.css

MediumDynamic Requirebin/lint.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to ksk-design-system@2.20.0.

See all versions of ksk-design-system for other recorded verdicts.

Review the evidence and your use of ksk-design-system@2.20.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 00:53:52.195Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.