registry / @apex-stack/core / 0.21.0

@apex-stack/core@0.21.0

The full-stack meta-framework for Alpine.js — CLI and runtime

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious install-time attack surface. The main residual risk is user-invoked installation of a bundled first-party editor syntax extension into VS Code-compatible editors.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit apex new/upgrade --vscode or interactive prompt acceptance

Impact

Installs Apex .alpine syntax-highlighting extension; no extension runtime code found in bundled VSIX

Mechanism

first-party bundled VSIX installation via editor CLI

Rationale

Source inspection supports a warning for guarded first-party editor extension setup and runtime package-manager operations, but not a publish block. The VSIX appears syntax-only and all risky actions are user-invoked or prompted rather than install-time mutation.

Evidence

package.jsondist/cli.jsdist/upgrade-363YDSK6.jsdist/chunk-TWAGSGFN.jsdist/mcp-CH7L4GF3.jsvscode/apex-alpine.vsixtarget project directorytarget project package.jsontarget project scaffold/template files

Network endpoints1

localhost:3000/mcp

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/chunk-TWAGSGFN.js can install bundled vscode/apex-alpine.vsix into code/cursor/windsurf/codium after prompt or --vscode.
dist/upgrade-363YDSK6.js runs npm view and optional npm install -g @apex-stack/core@latest for CLI self-update.
dist/upgrade-363YDSK6.js may rewrite scaffold files and bump @apex-stack/* deps when user runs apex upgrade.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks.
dist/cli.js behavior is user-invoked CLI scaffolding: copies templates, optional npm install, optional git init.
vscode/apex-alpine.vsix contains manifest, grammar, language config, icon/readme only; no main or activationEvents.
dist/mcp-CH7L4GF3.js connects only to user-supplied/default local MCP URL for an explicit apex mcp command.
No credential harvesting, destructive cleanup outside build output, remote payload download, or import-time execution found.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 43 file(s), 162 KB of source, external domains: 127.0.0.1, openapi.vercel.sh

Source & flagged code

8 flagged

dist/upgrade-363YDSK6.jsView file

Lines 1-70javascript

1import {

2 applyFeature,

3 featureList

4} from "./chunk-R4UEBZU7.js";

5import {

6 cmpVersion,

7 offerExtension,

8 promptYesNo

9} from "./chunk-TWAGSGFN.js";

10import {

11 VERSION,

12 banner,

13 color

14} from "./chunk-3FZG6IJZ.js";

16// src/commands/upgrade.ts

17import { spawnSync as spawnSync2 } from "child_process";

18import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/upgrade-363YDSK6.jsView on unpkg · L16

19import { basename, dirname, join, relative, resolve as resolve2 } from "path";

20import { fileURLToPath as fileURLToPath2 } from "url";

21import { defineCommand } from "citty";

23// src/selfUpdate.ts

24import { spawnSync } from "child_process";

25import { resolve, sep } from "path";

26import { fileURLToPath } from "url";

27var PKG = "@apex-stack/core";

28var WIN = process.platform === "win32";

29function latestPublished() {

30 try {

31 const r = spawnSync("npm", ["view", PKG, "version"], {

32 encoding: "utf8",

33 timeout: 4e3,

34 shell: WIN

35 });

36 if (r.status !== 0 || !r.stdout) return null;

37 const v = r.stdout.trim();

38 return /^\d+\.\d+\.\d+/.test(v) ? v : null;

39 } catch {

40 return null;

41 }

42}

43function isGlobalInstall() {

44 const self = fileURLToPath(import.meta.url);

45 const localRoot = resolve(process.cwd(), "node_modules") + sep;

46 return !self.startsWith(localRoot);

47}

48function installGlobalLatest() {

49 return spawnSync("npm", ["install", "-g", `${PKG}@latest`], { stdio: "inherit", shell: WIN }).status === 0;

50}

51async function maybeSelfUpdate(reexecArgv, choice) {

52 if (choice === false) return false;

High

Shell

Package source references shell execution.

dist/upgrade-363YDSK6.jsView on unpkg · L50

53 if (!isGlobalInstall()) return false;

54 const latest = latestPublished();

55 if (!latest || cmpVersion(latest, VERSION) <= 0) return false;

56 const log = console.log;

57 log(

58 `

59 ${color.cyan("\u2191")} A newer Apex CLI is available: ${color.gray(VERSION)} \u2192 ${color.green(latest)}`

60 );

61 const yes = choice ?? (process.stdin.isTTY ? await promptYesNo(` Update the global CLI now?`) : false);

62 if (!yes) {

63 log(` ${color.gray("Skipped. Update later with")} ${color.cyan(`npm i -g ${PKG}@latest`)}

64`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/upgrade-363YDSK6.jsView on unpkg · L48

65 return false;

66 }

67 if (!installGlobalLatest()) {

68 log(` ${color.red("\u2717")} Global update failed \u2014 run ${color.cyan(`npm i -g ${PKG}@latest`)}

69`);

70 return false;

dist/chunk-S77I7EPX.jsView file

Lines 37-77javascript

37} from "h3";

38var MIME = {

39 ".js": "text/javascript",

40 ".mjs": "text/javascript",

41 ".css": "text/css",

42 ".html": "text/html",

vscode/apex-alpine.vsixView file

•path = vscode/apex-alpine.vsix kind = high_entropy_blob sizeBytes = 33222 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = compressed_blob sizeBytes = 33222 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = nested_archive_needs_inspection sizeBytes = 33222 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vscode/apex-alpine.vsixView on unpkg

dist/build-J64UPHXY.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @apex-stack/core@0.20.0 matchedIdentity = npm:QGFwZXgtc3RhY2svY29yZQ:0.20.0 similarity = 0.953 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/build-J64UPHXY.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/upgrade-363YDSK6.jsView file

16// src/commands/upgrade.ts L17: import { spawnSync as spawnSync2 } from "child_process"; L18: import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/upgrade-363YDSK6.jsView on unpkg · L16

50} L51: async function maybeSelfUpdate(reexecArgv, choice) { L52: if (choice === false) return false;

High

Shell

Package source references shell execution.

dist/upgrade-363YDSK6.jsView on unpkg · L50

48function installGlobalLatest() { L49: return spawnSync("npm", ["install", "-g", `${PKG}@latest`], { stdio: "inherit", shell: WIN }).status === 0; L50: } ... L62: if (!yes) { L63: log(` ${color.gray("Skipped. Update later with")} ${color.cyan(`npm i -g ${PKG}@latest`)} L64: `);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/upgrade-363YDSK6.jsView on unpkg · L48

dist/chunk-S77I7EPX.jsView file

57const publicConfig = runtimeConfig.public ?? {}; L58: const importServer = (relFile) => import(pathToFileURL(join(dir, "server", relFile)).href); L59: const registry = {};

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-S77I7EPX.jsView on unpkg · L57

vscode/apex-alpine.vsixView file

•path = vscode/apex-alpine.vsix kind = high_entropy_blob sizeBytes = 33222 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = compressed_blob sizeBytes = 33222 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = nested_archive_needs_inspection sizeBytes = 33222 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vscode/apex-alpine.vsixView on unpkg

dist/build-J64UPHXY.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/build-J64UPHXY.jsView on unpkg

Findings

1 Critical4 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/build-J64UPHXY.js

HighChild Processdist/upgrade-363YDSK6.js

HighShelldist/upgrade-363YDSK6.js

HighRuntime Package Installdist/upgrade-363YDSK6.js

HighShips High Entropy Blobvscode/apex-alpine.vsix

MediumDynamic Requiredist/chunk-S77I7EPX.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobvscode/apex-alpine.vsix

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionvscode/apex-alpine.vsix

Source & flagged code

8 flagged

dist/upgrade-363YDSK6.jsView file

Lines 1-70javascript

1import {

2 applyFeature,

3 featureList

4} from "./chunk-R4UEBZU7.js";

5import {

6 cmpVersion,

7 offerExtension,

8 promptYesNo

9} from "./chunk-TWAGSGFN.js";

10import {

11 VERSION,

12 banner,

13 color

14} from "./chunk-3FZG6IJZ.js";

16// src/commands/upgrade.ts

17import { spawnSync as spawnSync2 } from "child_process";

18import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/upgrade-363YDSK6.jsView on unpkg · L16

19import { basename, dirname, join, relative, resolve as resolve2 } from "path";

20import { fileURLToPath as fileURLToPath2 } from "url";

21import { defineCommand } from "citty";

23// src/selfUpdate.ts

24import { spawnSync } from "child_process";

25import { resolve, sep } from "path";

26import { fileURLToPath } from "url";

27var PKG = "@apex-stack/core";

28var WIN = process.platform === "win32";

29function latestPublished() {

30 try {

31 const r = spawnSync("npm", ["view", PKG, "version"], {

32 encoding: "utf8",

33 timeout: 4e3,

34 shell: WIN

35 });

36 if (r.status !== 0 || !r.stdout) return null;

37 const v = r.stdout.trim();

38 return /^\d+\.\d+\.\d+/.test(v) ? v : null;

39 } catch {

40 return null;

41 }

42}

43function isGlobalInstall() {

44 const self = fileURLToPath(import.meta.url);

45 const localRoot = resolve(process.cwd(), "node_modules") + sep;

46 return !self.startsWith(localRoot);

47}

48function installGlobalLatest() {

49 return spawnSync("npm", ["install", "-g", `${PKG}@latest`], { stdio: "inherit", shell: WIN }).status === 0;

50}

51async function maybeSelfUpdate(reexecArgv, choice) {

52 if (choice === false) return false;

High

Shell

Package source references shell execution.

dist/upgrade-363YDSK6.jsView on unpkg · L50

53 if (!isGlobalInstall()) return false;

54 const latest = latestPublished();

55 if (!latest || cmpVersion(latest, VERSION) <= 0) return false;

56 const log = console.log;

57 log(

58 `

59 ${color.cyan("\u2191")} A newer Apex CLI is available: ${color.gray(VERSION)} \u2192 ${color.green(latest)}`

60 );

61 const yes = choice ?? (process.stdin.isTTY ? await promptYesNo(` Update the global CLI now?`) : false);

62 if (!yes) {

63 log(` ${color.gray("Skipped. Update later with")} ${color.cyan(`npm i -g ${PKG}@latest`)}

64`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/upgrade-363YDSK6.jsView on unpkg · L48

65 return false;

66 }

67 if (!installGlobalLatest()) {

68 log(` ${color.red("\u2717")} Global update failed \u2014 run ${color.cyan(`npm i -g ${PKG}@latest`)}

69`);

70 return false;

dist/chunk-S77I7EPX.jsView file

Lines 37-77javascript

37} from "h3";

38var MIME = {

39 ".js": "text/javascript",

40 ".mjs": "text/javascript",

41 ".css": "text/css",

42 ".html": "text/html",

vscode/apex-alpine.vsixView file

•path = vscode/apex-alpine.vsix kind = high_entropy_blob sizeBytes = 33222 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = compressed_blob sizeBytes = 33222 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = nested_archive_needs_inspection sizeBytes = 33222 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vscode/apex-alpine.vsixView on unpkg

dist/build-J64UPHXY.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/build-J64UPHXY.jsView on unpkg