registry / @apex-stack/core / 0.1.15

@apex-stack/core@0.1.15

The full-stack meta-framework for Alpine.js — CLI and runtime

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 54.0 KB of source

Source & flagged code

2 flagged

dist/start-BZJZSQHW.jsView file

Lines 28-68javascript

28 getRequestURL,

29 setResponseHeader,

30 setResponseStatus,

31 toNodeListener

32} from "h3";

33var MIME = {

34 ".js": "text/javascript",

35 ".mjs": "text/javascript",

36 ".css": "text/css",

37 ".html": "text/html",

38 ".json": "application/json",

39 ".svg": "image/svg+xml",

40 ".png": "image/png",

41 ".jpg": "image/jpeg",

42 ".ico": "image/x-icon",

43 ".woff2": "font/woff2"

44};

45async function startProdServer(options) {

46 const dir = options.dir;

47 const port = options.port ?? 3e3;

48 const manifest = JSON.parse(readFileSync(join(dir, "apex-manifest.json"), "utf8"));

49 const importServer = (relFile) => import(pathToFileURL(join(dir, "server", relFile)).href);

50 const registry = {};

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/start-BZJZSQHW.jsView on unpkg · L48

51 let componentCss = "";

52 for (const [name, file] of Object.entries(manifest.components)) {

53 const mod = await importServer(file);

54 registry[name] = { template: mod.template, rootXData: mod.rootXData, scopeId: mod.scopeId };

55 if (mod.css) componentCss += `${mod.css}

56`;

57 }

58 const apiEntries = [];

59 for (const { name, serverFile } of manifest.api) {

60 const mod = await importServer(serverFile);

61 apiEntries.push(...expandApiModule(name, mod.default));

62 }

63 const serverFileFor = new Map(manifest.routes.map((r) => [r.pageId, r.serverFile]));

64 const loadModule = (id) => importServer(serverFileFor.get(id));

65 const app = createApp();

66 app.use(

67 defineEventHandler((event) => {

68 if (event.method !== "GET") return;

dist/server-OXKBXSET.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @apex-stack/core@0.1.14 matchedIdentity = npm:QGFwZXgtc3RhY2svY29yZQ:0.1.14 similarity = 0.438 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server-OXKBXSET.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/start-BZJZSQHW.jsView file

48const manifest = JSON.parse(readFileSync(join(dir, "apex-manifest.json"), "utf8")); L49: const importServer = (relFile) => import(pathToFileURL(join(dir, "server", relFile)).href); L50: const registry = {};

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/start-BZJZSQHW.jsView on unpkg · L48

dist/server-OXKBXSET.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server-OXKBXSET.jsView on unpkg

Findings

1 High3 Medium3 Low

HighPrevious Version Dangerous Deltadist/server-OXKBXSET.js

MediumDynamic Requiredist/start-BZJZSQHW.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

dist/start-BZJZSQHW.jsView file

Lines 28-68javascript

28 getRequestURL,

29 setResponseHeader,

30 setResponseStatus,

31 toNodeListener

32} from "h3";

33var MIME = {

34 ".js": "text/javascript",

35 ".mjs": "text/javascript",

36 ".css": "text/css",

37 ".html": "text/html",

38 ".json": "application/json",

39 ".svg": "image/svg+xml",

40 ".png": "image/png",

41 ".jpg": "image/jpeg",

42 ".ico": "image/x-icon",

43 ".woff2": "font/woff2"

44};

45async function startProdServer(options) {

46 const dir = options.dir;

47 const port = options.port ?? 3e3;

48 const manifest = JSON.parse(readFileSync(join(dir, "apex-manifest.json"), "utf8"));

49 const importServer = (relFile) => import(pathToFileURL(join(dir, "server", relFile)).href);

50 const registry = {};

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/start-BZJZSQHW.jsView on unpkg · L48

51 let componentCss = "";

52 for (const [name, file] of Object.entries(manifest.components)) {

53 const mod = await importServer(file);

54 registry[name] = { template: mod.template, rootXData: mod.rootXData, scopeId: mod.scopeId };

55 if (mod.css) componentCss += `${mod.css}

56`;

57 }

58 const apiEntries = [];

59 for (const { name, serverFile } of manifest.api) {

60 const mod = await importServer(serverFile);

61 apiEntries.push(...expandApiModule(name, mod.default));

62 }

63 const serverFileFor = new Map(manifest.routes.map((r) => [r.pageId, r.serverFile]));

64 const loadModule = (id) => importServer(serverFileFor.get(id));

65 const app = createApp();

66 app.use(

67 defineEventHandler((event) => {

68 if (event.method !== "GET") return;

dist/server-OXKBXSET.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server-OXKBXSET.jsView on unpkg