registry / @apex-stack/core / 0.1.14

@apex-stack/core@0.1.14

The full-stack meta-framework for Alpine.js — CLI and runtime

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 51.7 KB of source

Source & flagged code

2 flagged

dist/start-VJJXI4W3.jsView file

Lines 26-66javascript

26 getRequestURL,

27 setResponseHeader,

28 setResponseStatus,

29 toNodeListener

30} from "h3";

31var MIME = {

32 ".js": "text/javascript",

33 ".mjs": "text/javascript",

34 ".css": "text/css",

35 ".html": "text/html",

36 ".json": "application/json",

37 ".svg": "image/svg+xml",

38 ".png": "image/png",

39 ".jpg": "image/jpeg",

40 ".ico": "image/x-icon",

41 ".woff2": "font/woff2"

42};

43async function startProdServer(options) {

44 const dir = options.dir;

45 const port = options.port ?? 3e3;

46 const manifest = JSON.parse(readFileSync(join(dir, "apex-manifest.json"), "utf8"));

47 const importServer = (relFile) => import(pathToFileURL(join(dir, "server", relFile)).href);

48 const registry = {};

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/start-VJJXI4W3.jsView on unpkg · L46

49 let componentCss = "";

50 for (const [name, file] of Object.entries(manifest.components)) {

51 const mod = await importServer(file);

52 registry[name] = { template: mod.template, rootXData: mod.rootXData, scopeId: mod.scopeId };

53 if (mod.css) componentCss += `${mod.css}

54`;

55 }

56 const apiEntries = [];

57 for (const { name, serverFile } of manifest.api) {

58 const mod = await importServer(serverFile);

59 apiEntries.push(...expandApiModule(name, mod.default));

60 }

61 const serverFileFor = new Map(manifest.routes.map((r) => [r.pageId, r.serverFile]));

62 const loadModule = (id) => importServer(serverFileFor.get(id));

63 const app = createApp();

64 app.use(

65 defineEventHandler((event) => {

66 if (event.method !== "GET") return;

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @apex-stack/core@0.1.12 matchedIdentity = npm:QGFwZXgtc3RhY2svY29yZQ:0.1.12 similarity = 0.813 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/start-VJJXI4W3.jsView file

46const manifest = JSON.parse(readFileSync(join(dir, "apex-manifest.json"), "utf8")); L47: const importServer = (relFile) => import(pathToFileURL(join(dir, "server", relFile)).href); L48: const registry = {};

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/start-VJJXI4W3.jsView on unpkg · L46

dist/cli.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Findings

1 High3 Medium3 Low

HighPrevious Version Dangerous Deltadist/cli.js

MediumDynamic Requiredist/start-VJJXI4W3.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

dist/start-VJJXI4W3.jsView file

Lines 26-66javascript

26 getRequestURL,

27 setResponseHeader,

28 setResponseStatus,

29 toNodeListener

30} from "h3";

31var MIME = {

32 ".js": "text/javascript",

33 ".mjs": "text/javascript",

34 ".css": "text/css",

35 ".html": "text/html",

36 ".json": "application/json",

37 ".svg": "image/svg+xml",

38 ".png": "image/png",

39 ".jpg": "image/jpeg",

40 ".ico": "image/x-icon",

41 ".woff2": "font/woff2"

42};

43async function startProdServer(options) {

44 const dir = options.dir;

45 const port = options.port ?? 3e3;

46 const manifest = JSON.parse(readFileSync(join(dir, "apex-manifest.json"), "utf8"));

47 const importServer = (relFile) => import(pathToFileURL(join(dir, "server", relFile)).href);

48 const registry = {};

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/start-VJJXI4W3.jsView on unpkg · L46

49 let componentCss = "";

50 for (const [name, file] of Object.entries(manifest.components)) {

51 const mod = await importServer(file);

52 registry[name] = { template: mod.template, rootXData: mod.rootXData, scopeId: mod.scopeId };

53 if (mod.css) componentCss += `${mod.css}

54`;

55 }

56 const apiEntries = [];

57 for (const { name, serverFile } of manifest.api) {

58 const mod = await importServer(serverFile);

59 apiEntries.push(...expandApiModule(name, mod.default));

60 }

61 const serverFileFor = new Map(manifest.routes.map((r) => [r.pageId, r.serverFile]));

62 const loadModule = (id) => importServer(serverFileFor.get(id));

63 const app = createApp();

64 app.use(

65 defineEventHandler((event) => {

66 if (event.method !== "GET") return;

dist/cli.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg