registry / sdtk-kit / 1.18.0

sdtk-kit@1.18.0

Install all six SDTK toolkits in one command. Meta-package for sdtk-spec-kit, sdtk-code-kit, sdtk-ops-kit, sdtk-design-kit, sdtk-wiki-kit, and sdtk-agent-kit.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 21 file(s), 116 KB of source, external domains: sdtk.dev

Source & flagged code

7 flagged

package.jsonView file

Lines 4-44json

4 "description": "Install all six SDTK toolkits in one command. Meta-package for sdtk-spec-kit, sdtk-code-kit, sdtk-ops-kit, sdtk-design-kit, sdtk-wiki-kit, and sdtk-agent-kit.",

5 "type": "commonjs",

6 "bin": {

7 "sdtk": "bin/sdtk.js",

8 "sdtk-spec": "bin/sdtk-spec.js",

9 "sdtk-code": "bin/sdtk-code.js",

10 "sdtk-ops": "bin/sdtk-ops.js",

11 "sdtk-design": "bin/sdtk-design.js",

12 "sdtk-wiki": "bin/sdtk-wiki.js",

13 "sdtk-agent": "bin/sdtk-agent.js"

14 },

15 "files": [

16 "bin/",

17 "src/",

18 "scripts/",

19 "assets/",

20 "README.md",

21 "LICENSE"

22 ],

23 "scripts": {

24 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "test": "node scripts/unified-init.test.js && node scripts/unified-runtime.test.js && node scripts/evolve.test.js",

26 "install:smoke:local": "node scripts/install-smoke.js --mode local",

27 "install:smoke:published": "node scripts/install-smoke.js --mode published --package sdtk-kit@latest",

28 "pack:smoke": "npm pack --dry-run"

29 },

30 "dependencies": {

31 "sdtk-spec-kit": "^0.6.0",

32 "sdtk-code-kit": "^0.3.0",

33 "sdtk-ops-kit": "^0.2.4",

34 "sdtk-design-kit": "^0.6.0",

35 "sdtk-wiki-kit": "^0.8.0",

36 "sdtk-agent-kit": "^0.4.0"

37 },

38 "engines": {

39 "node": ">=18.13.0"

40 },

41 "keywords": [

42 "sdtk",

43 "sdtk-kit",

44 "sdtk-spec",

scripts/evolve.test.jsView file

Lines 83-124javascript

83 const d = draft();

84 delete d.edits[0][field];

85 const errs = validateDraft(d);

86 assert.ok(errs.some((m) => m.includes(field)), `${

bin/sdtk-ops.jsView file

Lines 1-7javascript

1#!/usr/bin/env node

2"use strict";

4// Bin shim — re-exports the sdtk-ops CLI from the sdtk-ops-kit dependency.

5// See bin/sdtk-spec.js for the rationale behind these shims.

6require("sdtk-ops-kit/bin/sdtk-ops.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/sdtk-ops.jsView on unpkg · L5

scripts/unified-runtime.test.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sdtk-kit@1.14.0 matchedIdentity = npm:c2R0ay1raXQ:1.14.0 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/unified-runtime.test.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/evolve.test.jsView file

103patternName = aws_access_key severity = critical line = 103 matchedText = assert.o... 0);

Critical

Critical Secret

Package contains a critical-looking secret pattern.

scripts/evolve.test.jsView on unpkg · L103

103patternName = aws_access_key severity = critical line = 103 matchedText = assert.o... 0);

Critical

Secret Pattern

AWS access key ID in scripts/evolve.test.js

scripts/evolve.test.jsView on unpkg · L103

104patternName = private_key_rsa severity = critical line = 104 matchedText = assert.o... 0);

Critical

Secret Pattern

RSA private key in scripts/evolve.test.js

scripts/evolve.test.jsView on unpkg · L104

bin/sdtk-ops.jsView file

5// See bin/sdtk-spec.js for the rationale behind these shims. L6: require("sdtk-ops-kit/bin/sdtk-ops.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/sdtk-ops.jsView on unpkg · L5

scripts/unified-runtime.test.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/unified-runtime.test.jsView on unpkg

Findings

3 Critical2 High5 Medium4 Low

CriticalCritical Secretscripts/evolve.test.js

CriticalSecret Patternscripts/evolve.test.js

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltascripts/unified-runtime.test.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/sdtk-ops.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

package.jsonView file

Lines 4-44json

4 "description": "Install all six SDTK toolkits in one command. Meta-package for sdtk-spec-kit, sdtk-code-kit, sdtk-ops-kit, sdtk-design-kit, sdtk-wiki-kit, and sdtk-agent-kit.",

5 "type": "commonjs",

6 "bin": {

7 "sdtk": "bin/sdtk.js",

8 "sdtk-spec": "bin/sdtk-spec.js",

9 "sdtk-code": "bin/sdtk-code.js",

10 "sdtk-ops": "bin/sdtk-ops.js",

11 "sdtk-design": "bin/sdtk-design.js",

12 "sdtk-wiki": "bin/sdtk-wiki.js",

13 "sdtk-agent": "bin/sdtk-agent.js"

14 },

15 "files": [

16 "bin/",

17 "src/",

18 "scripts/",

19 "assets/",

20 "README.md",

21 "LICENSE"

22 ],

23 "scripts": {

24 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "test": "node scripts/unified-init.test.js && node scripts/unified-runtime.test.js && node scripts/evolve.test.js",

26 "install:smoke:local": "node scripts/install-smoke.js --mode local",

27 "install:smoke:published": "node scripts/install-smoke.js --mode published --package sdtk-kit@latest",

28 "pack:smoke": "npm pack --dry-run"

29 },

30 "dependencies": {

31 "sdtk-spec-kit": "^0.6.0",

32 "sdtk-code-kit": "^0.3.0",

33 "sdtk-ops-kit": "^0.2.4",

34 "sdtk-design-kit": "^0.6.0",

35 "sdtk-wiki-kit": "^0.8.0",

36 "sdtk-agent-kit": "^0.4.0"

37 },

38 "engines": {

39 "node": ">=18.13.0"

40 },

41 "keywords": [

42 "sdtk",

43 "sdtk-kit",

44 "sdtk-spec",

scripts/evolve.test.jsView file

Lines 83-124javascript

83 const d = draft();

84 delete d.edits[0][field];

85 const errs = validateDraft(d);

86 assert.ok(errs.some((m) => m.includes(field)), `${

bin/sdtk-ops.jsView file

Lines 1-7javascript

1#!/usr/bin/env node

2"use strict";

4// Bin shim — re-exports the sdtk-ops CLI from the sdtk-ops-kit dependency.

5// See bin/sdtk-spec.js for the rationale behind these shims.

6require("sdtk-ops-kit/bin/sdtk-ops.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/sdtk-ops.jsView on unpkg · L5

scripts/unified-runtime.test.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/unified-runtime.test.jsView on unpkg