registry / typekro / 0.28.0

typekro@0.28.0

A control plane aware framework for orchestrating kubernetes resources like a programmer.

Static Scan Results

scanned 19h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 502 file(s), 3.45 MB of source, external domains: api.github.com, charts.apiseven.com, charts.jetstack.io, charts.rook.io, clickhouse.github.io, clickstack-otel-collector.clickstack.svc.cluster.local, cloudnative-pg.github.io, dagster-io.github.io, github.com, helm.altinity.com, helm.cilium.io, helm.goharbor.io, hydra.localhost, identity.localhost, json-schema.org, jupyterhub.github.io, k8s.ory.sh, kratos.localhost, kubernetes-sigs.github.io, nats-io.github.io, oathkeeper-api.localhost, open-telemetry.github.io, typekro.dev

Source & flagged code

5 flagged

package.jsonView file

•name = typekro; similarTo = typeorm

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/core/deployment/kro-factory.jsView file

Lines 2354-2394javascript

2354 return this.evaluateStaticFields(fieldValue, spec);

2355 }

2356 // Keep non-CEL values as-is

2357 return fieldValue;

2358 }

2359 resolveSchemaRefValue(fieldPath, spec) {

2360 const parts = fieldPath.replace(/^spec\./, '').split('.');

2361 let current = spec;

2362 for (const part of parts) {

2363 if (current != null && typeof current === 'object') {

2364 current = current[part];

2365 }

2366 else {

2367 return undefined;

2368 }

2369 }

2370 return current;

2371 }

2372 /**

2373 * Evaluate a static CEL expression that contains only schema references or literal values.

2374 *

2375 * Uses `angular-expressions` for safe AST-based evaluation instead of `new Function()` / `eval()`.

2376 * Spec field references (e.g., `schema.spec.name`, `spec.replicas`) are resolved by passing the

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/core/deployment/kro-factory.jsView on unpkg · L2374

2377 * spec values as a scope object, eliminating string interpolation injection risks entirely.

2378 */

2379 evaluateStaticCelExpression(celExpression, spec) {

2380 const expression = celExpression.expression;

2381 try {

2382 return evaluateSchemaCelExpression(celExpression, spec);

2383 }

2384 catch (error) {

2385 // If evaluation fails, the expression might be an unquoted string like: http://kro-webapp-service

2386 // In this case, return it as-is (it's already a string value)

2387 if (!expression.includes('schema.spec.') && !expression.includes('spec.')) {

2388 this.logger.debug('Static expression evaluation failed, returning as string literal', {

2389 expression,

2390 error: ensureError(error).message,

2391 });

2392 return expression;

2393 }

2394 this.logger.warn('Failed to evaluate expression safely', {

dist/core/expressions/analysis/source-map.jsView file

Lines 104-144javascript

104 return this.entries.length;

105 }

106 /**

107 * Export mappings to a JSON-serializable format

108 */

109 export() {

110 return {

dist/core/yaml/path-resolver.jsView file

Lines 1-24javascript

1/**

2 * Path resolution system for YAML resources

3 * Handles local files, directories, and Git repositories

4 */

5import * as dns from 'node:dns/promises';

6import * as fs from

dist/core/containers/exec.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = typekro@0.27.0 matchedIdentity = npm:dHlwZWtybw:0.27.0 similarity = 0.783 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core/containers/exec.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code