registry / openstylus / 0.7.0

openstylus@0.7.0

Brand-neutral, code-on-disk canvas for iterating on rendered React/CSS assets. One local node-24 process hosts a Streamable-HTTP canvas-loop MCP + a first-party SSE channel + the web UI over one node:sqlite sidecar; the engine is config-parameterized and

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

CopyleftLicense

scanned 116 file(s), 2.32 MB of source, external domains: github.com, html.spec.whatwg.org, pro.reactflow.dev, react.dev, reactflow.dev, storybook.js.org, testing-library.com, testing-playground.com, www.w3.org

Source & flagged code

3 flagged

dist/web/assets/realm-Bp0dxzok.jsView file

264patternName = generic_password severity = medium line = 264 matchedText = `+t),t},...r"?`

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/web/assets/realm-Bp0dxzok.jsView on unpkg · L264

dist/ds/manifest.jsView file

Lines 271-311javascript

271}

272/**

273 * Read a manifest from disk and validate it. Two formats, one recommendation:

274 * • `.json` — THE convention (every shipped DS uses it): an inert declaration, re-read fresh on every

275 * projection, statically reviewable (the diff IS the declaration), `$schema`-validated in editors,

276 * and readable by tools that must never execute the DS. The conformance gate's declaration-keyed

277 * behavior (e.g. the `kind:"asset"` exemption) rests on these bytes being deliberate and inert.

278 * • `.ts`/`.js` — the composition escape hatch (a module's `default` or `manifest` export) for a DS

279 * that legitimately computes/composes its declaration. EXECUTED to read; same Zod validation.

280 */

281export async function loadManifestFile(absPath) {

282 if (!existsSync(absPath)) {

283 return invalid([{ field: "(file)", message: `manifest not found at ${absPath}` }]);

284 }

285 let raw;

286 try {

287 if (absPath.endsWith(".json")) {

288 raw = JSON.parse(readFileSync(absPath, "utf8"));

289 }

290 else {

291 // Bust the ESM module cache with the file's mtime so an EDITED module manifest is re-read live —

292 // "re-derivation is registration" must hold for both formats (a plain `import(absPath)` freezes

293 // the first read for the life of the process). An unchanged file re-uses its cached module, so

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ds/manifest.jsView on unpkg · L291

294 // module instances stay bounded by edit count. `pathToFileURL` keeps the specifier a real URL

295 // (a raw absolute path cannot carry a query and breaks on drive-letter platforms). The param is

296 // `t` — Vite's own HMR cache-bust convention, which its transform pipeline strips; an arbitrary

297 // query name is misread as a loader hint under a Vite-driven runtime (vitest), a plain opaque

298 // query under bare node either way.

299 // (Truncated to integer ms: a fractional mtime puts a `.` in the URL tail, which an esbuild-backed

300 // transform then misreads as the file extension → "Invalid loader value".)

301 const url = pathToFileURL(absPath);

302 url.searchParams.set("t", String(Math.trunc(statSync(absPath).mtimeMs)));

303 const mod = (await import(__rewriteRelativeImportExtension(url.href)));

304 raw = mod.default ?? mod.manifest;

305 }

306 }

307 catch (e) {

308 return invalid([{ field: "(file)", message: `could not read manifest: ${e.message}` }]);

309 }

310 return loadManifest(raw);

311}

dist/ds/lint.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = openstylus@0.3.0 matchedIdentity = npm:b3BlbnN0eWx1cw:0.3.0 similarity = 0.657 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/ds/lint.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/web/assets/realm-Bp0dxzok.jsView file

264patternName = generic_password severity = medium line = 264 matchedText = `+t),t},...r"?`

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/web/assets/realm-Bp0dxzok.jsView on unpkg · L264

dist/ds/manifest.jsView file

291// Bust the ESM module cache with the file's mtime so an EDITED module manifest is re-read live — L292: // "re-derivation is registration" must hold for both formats (a plain `import(absPath)` freezes L293: // the first read for the life of the process). An unchanged file re-uses its cached module, so

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ds/manifest.jsView on unpkg · L291

dist/ds/lint.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/ds/lint.jsView on unpkg

Findings

1 High6 Medium7 Low

HighPrevious Version Dangerous Deltadist/ds/lint.js

MediumSecret Patterndist/web/assets/realm-Bp0dxzok.js

MediumDynamic Requiredist/ds/manifest.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

3 flagged

dist/web/assets/realm-Bp0dxzok.jsView file

264patternName = generic_password severity = medium line = 264 matchedText = `+t),t},...r"?`

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/web/assets/realm-Bp0dxzok.jsView on unpkg · L264

dist/ds/manifest.jsView file

Lines 271-311javascript

271}

272/**

273 * Read a manifest from disk and validate it. Two formats, one recommendation:

274 * • `.json` — THE convention (every shipped DS uses it): an inert declaration, re-read fresh on every

275 * projection, statically reviewable (the diff IS the declaration), `$schema`-validated in editors,

276 * and readable by tools that must never execute the DS. The conformance gate's declaration-keyed

277 * behavior (e.g. the `kind:"asset"` exemption) rests on these bytes being deliberate and inert.

278 * • `.ts`/`.js` — the composition escape hatch (a module's `default` or `manifest` export) for a DS

279 * that legitimately computes/composes its declaration. EXECUTED to read; same Zod validation.

280 */

281export async function loadManifestFile(absPath) {

282 if (!existsSync(absPath)) {

283 return invalid([{ field: "(file)", message: `manifest not found at ${absPath}` }]);

284 }

285 let raw;

286 try {

287 if (absPath.endsWith(".json")) {

288 raw = JSON.parse(readFileSync(absPath, "utf8"));

289 }

290 else {

291 // Bust the ESM module cache with the file's mtime so an EDITED module manifest is re-read live —

292 // "re-derivation is registration" must hold for both formats (a plain `import(absPath)` freezes

293 // the first read for the life of the process). An unchanged file re-uses its cached module, so

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ds/manifest.jsView on unpkg · L291

294 // module instances stay bounded by edit count. `pathToFileURL` keeps the specifier a real URL

295 // (a raw absolute path cannot carry a query and breaks on drive-letter platforms). The param is

296 // `t` — Vite's own HMR cache-bust convention, which its transform pipeline strips; an arbitrary

297 // query name is misread as a loader hint under a Vite-driven runtime (vitest), a plain opaque

298 // query under bare node either way.

299 // (Truncated to integer ms: a fractional mtime puts a `.` in the URL tail, which an esbuild-backed

300 // transform then misreads as the file extension → "Invalid loader value".)

301 const url = pathToFileURL(absPath);

302 url.searchParams.set("t", String(Math.trunc(statSync(absPath).mtimeMs)));

303 const mod = (await import(__rewriteRelativeImportExtension(url.href)));

304 raw = mod.default ?? mod.manifest;

305 }

306 }

307 catch (e) {

308 return invalid([{ field: "(file)", message: `could not read manifest: ${e.message}` }]);

309 }

310 return loadManifest(raw);

311}

dist/ds/lint.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/ds/lint.jsView on unpkg