registry / typekro / 0.21.1

typekro@0.21.1

A control plane aware framework for orchestrating kubernetes resources like a programmer.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 432 file(s), 2.94 MB of source, external domains: api.github.com, charts.apiseven.com, charts.jetstack.io, cloudnative-pg.github.io, dagster-io.github.io, github.com, helm.cilium.io, hydra.localhost, identity.localhost, json-schema.org, jupyterhub.github.io, k8s.ory.sh, kratos.localhost, kubernetes-sigs.github.io, oathkeeper-api.localhost, typekro.dev

Source & flagged code

4 flagged

package.jsonView file

•name = typekro; similarTo = typeorm

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/core/deployment/kro-factory.jsView file

Lines 1562-1602javascript

1562 return this.evaluateStaticFields(fieldValue, spec);

1563 }

1564 // Keep non-CEL values as-is

1565 return fieldValue;

1566 }

1567 resolveSchemaRefValue(fieldPath, spec) {

1568 const parts = fieldPath.replace(/^spec\./, '').split('.');

1569 let current = spec;

1570 for (const part of parts) {

1571 if (current != null && typeof current === 'object') {

1572 current = current[part];

1573 }

1574 else {

1575 return undefined;

1576 }

1577 }

1578 return current;

1579 }

1580 /**

1581 * Evaluate a static CEL expression that contains only schema references or literal values.

1582 *

1583 * Uses `angular-expressions` for safe AST-based evaluation instead of `new Function()` / `eval()`.

1584 * Spec field references (e.g., `schema.spec.name`, `spec.replicas`) are resolved by passing the

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/core/deployment/kro-factory.jsView on unpkg · L1582

1585 * spec values as a scope object, eliminating string interpolation injection risks entirely.

1586 */

1587 evaluateStaticCelExpression(celExpression, spec) {

1588 const expression = celExpression.expression;

1589 const specRecord = this.createStaticEvaluationScope(spec);

1590 const scopeExpression = this.prepareStaticExpressionForEvaluation(expression);

1591 try {

1592 const evaluator = compileExpression(scopeExpression);

1593 const result = evaluator(specRecord);

1594 return result;

1595 }

1596 catch (error) {

1597 // If evaluation fails, the expression might be an unquoted string like: http://kro-webapp-service

1598 // In this case, return it as-is (it's already a string value)

1599 if (!expression.includes('schema.spec.') && !expression.includes('spec.')) {

1600 this.logger.debug('Static expression evaluation failed, returning as string literal', {

1601 expression,

1602 error: ensureError(error).message,

dist/core/expressions/analysis/source-map.jsView file

Lines 104-144javascript

104 return this.entries.length;

105 }

106 /**

107 * Export mappings to a JSON-serializable format

108 */

109 export() {

110 return {

111 version: '1.0',

112

dist/core/yaml/path-resolver.jsView file

Lines 1-24javascript

1/**

2 * Path resolution system for YAML resources

3 * Handles local files, directories, and Git repositories

4 */

5import * as dns from 'node:dns/promises';

6import * as fs from 'node:fs';

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

Source & flagged code

4 flagged · loading source

package.jsonView file

•name = typekro; similarTo = typeorm

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/core/deployment/kro-factory.jsView file

1582* L1583: * Uses `angular-expressions` for safe AST-based evaluation instead of `new Function()` / `eval()`. L1584: * Spec field references (e.g., `schema.spec.name`, `spec.replicas`) are resolved by passing the

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/core/deployment/kro-factory.jsView on unpkg · L1582

dist/core/expressions/analysis/source-map.jsView file

124*/ L125: import(data) { L126: if (data.version !== '1.0') {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/expressions/analysis/source-map.jsView on unpkg · L124

dist/core/yaml/path-resolver.jsView file

4*/ L5: import * as dns from 'node:dns/promises'; L6: import * as fs from 'node:fs'; ... L80: 'Verify the repository URL and path are correct', L81: 'For private repositories, ensure authentication is configured', L82: 'Try using a specific branch or tag: @main, @v1.0.0', ... L344: originalPath: filePath, L345: resolvedPath: path.isAbsolute(filePath) ? filePath : path.resolve(process.cwd(), filePath), L346: }; ... L474: // TODO: Add authentication support for private repositories L475: // 'Authorization': `token ${process.env.GITHUB_TOKEN}`, L476: },

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/core/yaml/path-resolver.jsView on unpkg · L4

Findings

1 High5 Medium6 Low

HighCloud Metadata Accessdist/core/yaml/path-resolver.js

MediumTyposquat Namepackage.json

MediumDynamic Requiredist/core/expressions/analysis/source-map.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/core/deployment/kro-factory.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

•name = typekro; similarTo = typeorm

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/core/deployment/kro-factory.jsView file

Lines 1562-1602javascript

1562 return this.evaluateStaticFields(fieldValue, spec);

1563 }

1564 // Keep non-CEL values as-is

1565 return fieldValue;

1566 }

1567 resolveSchemaRefValue(fieldPath, spec) {

1568 const parts = fieldPath.replace(/^spec\./, '').split('.');

1569 let current = spec;

1570 for (const part of parts) {

1571 if (current != null && typeof current === 'object') {

1572 current = current[part];

1573 }

1574 else {

1575 return undefined;

1576 }

1577 }

1578 return current;

1579 }

1580 /**

1581 * Evaluate a static CEL expression that contains only schema references or literal values.

1582 *

1583 * Uses `angular-expressions` for safe AST-based evaluation instead of `new Function()` / `eval()`.

1584 * Spec field references (e.g., `schema.spec.name`, `spec.replicas`) are resolved by passing the

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/core/deployment/kro-factory.jsView on unpkg · L1582

1585 * spec values as a scope object, eliminating string interpolation injection risks entirely.

1586 */

1587 evaluateStaticCelExpression(celExpression, spec) {

1588 const expression = celExpression.expression;

1589 const specRecord = this.createStaticEvaluationScope(spec);

1590 const scopeExpression = this.prepareStaticExpressionForEvaluation(expression);

1591 try {

1592 const evaluator = compileExpression(scopeExpression);

1593 const result = evaluator(specRecord);

1594 return result;

1595 }

1596 catch (error) {

1597 // If evaluation fails, the expression might be an unquoted string like: http://kro-webapp-service

1598 // In this case, return it as-is (it's already a string value)

1599 if (!expression.includes('schema.spec.') && !expression.includes('spec.')) {

1600 this.logger.debug('Static expression evaluation failed, returning as string literal', {

1601 expression,

1602 error: ensureError(error).message,

dist/core/expressions/analysis/source-map.jsView file

Lines 104-144javascript

104 return this.entries.length;

105 }

106 /**

107 * Export mappings to a JSON-serializable format

108 */

109 export() {

110 return {

111 version: '1.0',

112

dist/core/yaml/path-resolver.jsView file

Lines 1-24javascript

1/**

2 * Path resolution system for YAML resources

3 * Handles local files, directories, and Git repositories

4 */

5import * as dns from 'node:dns/promises';

6import * as fs from 'node:fs';

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.