registry / theokit / 0.14.0

theokit@0.14.0

⚠ Under review

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 139 file(s), 954 KB of source, external domains: api.anthropic.com, api.openai.com, cdn.jsdelivr.net, openrouter.ai, theokit.dev

Source & flagged code

5 flagged

dist/router-TLEAOFID.jsView file

Lines 1-64javascript

1#!/usr/bin/env node

2import "tsx/esm";

4// src/cli/commands/migrate/router.ts

5import { execFileSync } from "child_process";

6import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/router-TLEAOFID.jsView on unpkg · L4

7import { createServer } from "net";

8import { dirname, resolve } from "path";

10// src/cli/commands/migrate/router-codemod.ts

11import { readdirSync, statSync } from "fs";

12import { extname, join, relative, sep } from "path";

13var ROUTE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);

14var TEST_OR_SPEC_RE = /\.(test|spec)\.[jt]sx?$/;

15var RouterMigrationCollisionError = class extends Error {

16 name = "RouterMigrationCollisionError";

17 from;

18 to;

19 constructor(from, to) {

20 super(

21 `Router migration collision: ${from} would rename to ${to}, but that file already exists (case-insensitive match). Resolve manually.`

22 );

23 this.from = from;

24 this.to = to;

25 }

26};

27function computeDepthDelta(from, to, routesDir) {

28 const depthOf = (p) => {

29 const rel = relative(routesDir, p).replace(/\\/g, "/");

30 return rel.split("/").length - 1;

31 };

32 return depthOf(to) - depthOf(from);

33}

34function rewriteRelativeImports(source, delta) {

35 if (delta <= 0) return source;

36 const prefix = "../".repeat(delta);

37 const transformSpecifier = (specifier) => {

38 if (specifier.startsWith("./")) return `${prefix}${specifier.slice(2)}`;

39 return `${prefix}${specifier}`;

40 };

41 const fromRe = /\bfrom\s+(['"])(\.{1,2}\/[^'"]+)\1/g;

42 const dynRe = /\bimport\s*$\s*(['"])(\.{1,2}\/[^'"]+)\1\s*$/g;

43 const sideRe = /\bimport\s+(['"])(\.{1,2}\/[^'"]+)\1/g;

44 const fromSub = (_m, q, spec) => `from ${q}${transformSpecifier(spec)}${q}`;

45 const dynSub = (_m, q, spec) => `import(${q}${transformSpecifier(spec)}${q})`;

46 const sideSub = (_m, q, spec) => `import ${q}${transformSpecifier(spec)}${q}`;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/router-TLEAOFID.jsView on unpkg · L44

47 return source.replace(fromRe, fromSub).replace(dynRe, dynSub).replace(sideRe, sideSub);

48}

49function isTestOrSpecFile(filePath) {

50 return TEST_OR_SPEC_RE.test(filePath);

51}

52function hasDotOutsideBrackets(segment) {

53 let depth = 0;

54 for (const ch of segment) {

55 if (ch === "[") depth++;

56 else if (ch === "]") depth--;

57 else if (ch === "." && depth === 0) return true;

58 }

59 return false;

60}

61function splitDottedSegmentOutsideBrackets(segment) {

62 const parts = [];

63 let current = "";

64 let depth = 0;

dist/chunk-45C3WUQ7.jsView file

Lines 494-534javascript

494}

495function installLifecycleHandlers(proc, stopAll) {

496 proc.on("exit", () => {

497 });

498 proc.on("SIGINT", () => {

499 void stopAll().finally

dist/db-3UNAMSFK.jsView file

Lines 13-53javascript

13}

14function assertBinExists(cwd, bin) {

15 const binPath = resolve(cwd, "node_modules", ".bin", bin);

16 if (!existsSync(binPath)) {

17 throw new

dist/chunk-2J7XU3PW.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = theokit@0.12.1 matchedIdentity = npm:dGhlb2tpdA:0.12.1 similarity = 0.758 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-2J7XU3PW.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/router-TLEAOFID.jsView file

4// src/cli/commands/migrate/router.ts L5: import { execFileSync } from "child_process"; L6: import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/router-TLEAOFID.jsView on unpkg · L4

44const fromSub = (_m, q, spec) => `from ${q}${transformSpecifier(spec)}${q}`; L45: const dynSub = (_m, q, spec) => `import(${q}${transformSpecifier(spec)}${q})`; L46: const sideSub = (_m, q, spec) => `import ${q}${transformSpecifier(spec)}${q}`;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/router-TLEAOFID.jsView on unpkg · L44

dist/chunk-45C3WUQ7.jsView file

514cwd, L515: shell: true, L516: env,

High

Shell

Package source references shell execution.

dist/chunk-45C3WUQ7.jsView on unpkg · L514

dist/db-3UNAMSFK.jsView file

33console.log("\n \u25B8 Running drizzle-kit push...\n"); L34: execSync("npx drizzle-kit push", { cwd, stdio: "inherit" }); L35: return { status: "success", message: "Database migrated successfully", action: dbAction };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/db-3UNAMSFK.jsView on unpkg · L33

dist/chunk-2J7XU3PW.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-2J7XU3PW.jsView on unpkg

Findings

1 Critical3 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/chunk-2J7XU3PW.js

HighChild Processdist/router-TLEAOFID.js

HighShelldist/chunk-45C3WUQ7.js

HighRuntime Package Installdist/db-3UNAMSFK.js

MediumDynamic Requiredist/router-TLEAOFID.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/router-TLEAOFID.jsView file

Lines 1-64javascript

1#!/usr/bin/env node

2import "tsx/esm";

4// src/cli/commands/migrate/router.ts

5import { execFileSync } from "child_process";

6import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/router-TLEAOFID.jsView on unpkg · L4

7import { createServer } from "net";

8import { dirname, resolve } from "path";

10// src/cli/commands/migrate/router-codemod.ts

11import { readdirSync, statSync } from "fs";

12import { extname, join, relative, sep } from "path";

13var ROUTE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);

14var TEST_OR_SPEC_RE = /\.(test|spec)\.[jt]sx?$/;

15var RouterMigrationCollisionError = class extends Error {

16 name = "RouterMigrationCollisionError";

17 from;

18 to;

19 constructor(from, to) {

20 super(

21 `Router migration collision: ${from} would rename to ${to}, but that file already exists (case-insensitive match). Resolve manually.`

22 );

23 this.from = from;

24 this.to = to;

25 }

26};

27function computeDepthDelta(from, to, routesDir) {

28 const depthOf = (p) => {

29 const rel = relative(routesDir, p).replace(/\\/g, "/");

30 return rel.split("/").length - 1;

31 };

32 return depthOf(to) - depthOf(from);

33}

34function rewriteRelativeImports(source, delta) {

35 if (delta <= 0) return source;

36 const prefix = "../".repeat(delta);

37 const transformSpecifier = (specifier) => {

38 if (specifier.startsWith("./")) return `${prefix}${specifier.slice(2)}`;

39 return `${prefix}${specifier}`;

40 };

41 const fromRe = /\bfrom\s+(['"])(\.{1,2}\/[^'"]+)\1/g;

42 const dynRe = /\bimport\s*$\s*(['"])(\.{1,2}\/[^'"]+)\1\s*$/g;

43 const sideRe = /\bimport\s+(['"])(\.{1,2}\/[^'"]+)\1/g;

44 const fromSub = (_m, q, spec) => `from ${q}${transformSpecifier(spec)}${q}`;

45 const dynSub = (_m, q, spec) => `import(${q}${transformSpecifier(spec)}${q})`;

46 const sideSub = (_m, q, spec) => `import ${q}${transformSpecifier(spec)}${q}`;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/router-TLEAOFID.jsView on unpkg · L44

47 return source.replace(fromRe, fromSub).replace(dynRe, dynSub).replace(sideRe, sideSub);

48}

49function isTestOrSpecFile(filePath) {

50 return TEST_OR_SPEC_RE.test(filePath);

51}

52function hasDotOutsideBrackets(segment) {

53 let depth = 0;

54 for (const ch of segment) {

55 if (ch === "[") depth++;

56 else if (ch === "]") depth--;

57 else if (ch === "." && depth === 0) return true;

58 }

59 return false;

60}

61function splitDottedSegmentOutsideBrackets(segment) {

62 const parts = [];

63 let current = "";

64 let depth = 0;

dist/chunk-45C3WUQ7.jsView file

Lines 494-534javascript

494}

495function installLifecycleHandlers(proc, stopAll) {

496 proc.on("exit", () => {

497 });

498 proc.on("SIGINT", () => {

499 void stopAll().finally

dist/db-3UNAMSFK.jsView file

Lines 13-53javascript

13}

14function assertBinExists(cwd, bin) {

15 const binPath = resolve(cwd, "node_modules", ".bin", bin);

16 if (!existsSync(binPath)) {

17 throw new

dist/chunk-2J7XU3PW.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-2J7XU3PW.jsView on unpkg