Loading npm security reports…

typekro@0.27.0: Suspicious npm security report (Warn) | LPM Firewall

registry / typekro / 0.27.0

typekro@0.27.0

A control plane aware framework for orchestrating kubernetes resources like a programmer.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 485 file(s), 3.30 MB of source, external domains: api.github.com, charts.apiseven.com, charts.jetstack.io, charts.rook.io, clickhouse.github.io, clickstack-otel-collector.clickstack.svc.cluster.local, cloudnative-pg.github.io, dagster-io.github.io, github.com, helm.altinity.com, helm.cilium.io, hydra.localhost, identity.localhost, json-schema.org, jupyterhub.github.io, k8s.ory.sh, kratos.localhost, kubernetes-sigs.github.io, nats-io.github.io, oathkeeper-api.localhost, open-telemetry.github.io, typekro.dev

Source & flagged code

4 flagged

package.jsonView file

•name = typekro; similarTo = typeorm

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/core/deployment/kro-factory.jsView file

Lines 2268-2308javascript

2268 return this.evaluateStaticFields(fieldValue, spec);

2269 }

2270 // Keep non-CEL values as-is

2271 return fieldValue;

2272 }

2273 resolveSchemaRefValue(fieldPath, spec) {

2274 const parts = fieldPath.replace(/^spec\./, '').split('.');

2275 let current = spec;

2276 for (const part of parts) {

2277 if (current != null && typeof current === 'object') {

2278 current = current[part];

2279 }

2280 else {

2281 return undefined;

2282 }

2283 }

2284 return current;

2285 }

2286 /**

2287 * Evaluate a static CEL expression that contains only schema references or literal values.

2288 *

2289 * Uses `angular-expressions` for safe AST-based evaluation instead of `new Function()` / `eval()`.

2290 * Spec field references (e.g., `schema.spec.name`, `spec.replicas`) are resolved by passing the

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/core/deployment/kro-factory.jsView on unpkg · L2288

2291 * spec values as a scope object, eliminating string interpolation injection risks entirely.

2292 */

2293 evaluateStaticCelExpression(celExpression, spec) {

2294 const expression = celExpression.expression;

2295 try {

2296 return evaluateSchemaCelExpression(celExpression, spec);

2297 }

2298 catch (error) {

2299 // If evaluation fails, the expression might be an unquoted string like: http://kro-webapp-service

2300 // In this case, return it as-is (it's already a string value)

2301 if (!expression.includes('schema.spec.') && !expression.includes('spec.')) {

2302 this.logger.debug('Static expression evaluation failed, returning as string literal', {

2303 expression,

2304 error: ensureError(error).message,

2305 });

2306 return expression;

2307 }

2308 this.logger.warn('Failed to evaluate expression safely', {

dist/core/expressions/analysis/source-map.jsView file

Lines 104-144javascript

104 return this.entries.length;

105 }

106 /**

107 * Export mappings to a JSON-serializable format

108 */

109 export() {

110 return {

dist/core/yaml/path-resolver.jsView file

Lines 1-24javascript

1/**

2 * Path resolution system for YAML resources

3 * Handles local files, directories, and Git repositories

4 */

5import * as dns from 'node:dns/promises';

6import * as fs from

Source & flagged code

4 flagged · loading source

package.jsonView file

•name = typekro; similarTo = typeorm

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/core/deployment/kro-factory.jsView file

2288* L2289: * Uses `angular-expressions` for safe AST-based evaluation instead of `new Function()` / `eval()`. L2290: * Spec field references (e.g., `schema.spec.name`, `spec.replicas`) are resolved by passing the

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/core/deployment/kro-factory.jsView on unpkg · L2288

dist/core/expressions/analysis/source-map.jsView file

124*/ L125: import(data) { L126: if (data.version !== '1.0') {

Findings

1 High5 Medium6 Low

HighCloud Metadata Accessdist/core/yaml/path-resolver.js

MediumTyposquat Namepackage.json

MediumDynamic Requiredist/core/expressions/analysis/source-map.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/core/deployment/kro-factory.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

•name = typekro; similarTo = typeorm

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/core/deployment/kro-factory.jsView file

Lines 2268-2308javascript

2268 return this.evaluateStaticFields(fieldValue, spec);

2269 }

2270 // Keep non-CEL values as-is

2271 return fieldValue;

2272 }

2273 resolveSchemaRefValue(fieldPath, spec) {

2274 const parts = fieldPath.replace(/^spec\./, '').split('.');

2275 let current = spec;

2276 for (const part of parts) {

2277 if (current != null && typeof current === 'object') {

2278 current = current[part];

2279 }

2280 else {

2281 return undefined;

2282 }

2283 }

2284 return current;

2285 }

2286 /**

2287 * Evaluate a static CEL expression that contains only schema references or literal values.

2288 *

2289 * Uses `angular-expressions` for safe AST-based evaluation instead of `new Function()` / `eval()`.

2290 * Spec field references (e.g., `schema.spec.name`, `spec.replicas`) are resolved by passing the

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/core/deployment/kro-factory.jsView on unpkg · L2288

2291 * spec values as a scope object, eliminating string interpolation injection risks entirely.

2292 */

2293 evaluateStaticCelExpression(celExpression, spec) {

2294 const expression = celExpression.expression;

2295 try {

2296 return evaluateSchemaCelExpression(celExpression, spec);

2297 }

2298 catch (error) {

2299 // If evaluation fails, the expression might be an unquoted string like: http://kro-webapp-service

2300 // In this case, return it as-is (it's already a string value)

2301 if (!expression.includes('schema.spec.') && !expression.includes('spec.')) {

2302 this.logger.debug('Static expression evaluation failed, returning as string literal', {

2303 expression,

2304 error: ensureError(error).message,

2305 });

2306 return expression;

2307 }

2308 this.logger.warn('Failed to evaluate expression safely', {

dist/core/expressions/analysis/source-map.jsView file

Lines 104-144javascript

104 return this.entries.length;

105 }

106 /**

107 * Export mappings to a JSON-serializable format

108 */

109 export() {

110 return {

dist/core/yaml/path-resolver.jsView file

Lines 1-24javascript

1/**

2 * Path resolution system for YAML resources

3 * Handles local files, directories, and Git repositories

4 */

5import * as dns from 'node:dns/promises';

6import * as fs from