registry / @apex-stack/core / 0.24.1

@apex-stack/core@0.24.1

The full-stack meta-framework for Alpine.js — CLI and runtime

Static Scan Results

scanned 58m ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 45 file(s), 170 KB of source, external domains: 127.0.0.1, openapi.vercel.sh

Source & flagged code

7 flagged

dist/mcp-server-UWYPGDUU.jsView file

Lines 1-28javascript

1import {

2 VERSION

3} from "./chunk-3FZG6IJZ.js";

4import {

5 scanPages

6} from "./chunk-XBH3TTYG.js";

8// src/commands/mcp-server.ts

9import { spawnSync } from "child_process";

10import { existsSync, readdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/mcp-server-UWYPGDUU.jsView on unpkg · L8

11import { join, resolve } from "path";

12import { fileURLToPath } from "url";

13import { defineCommand } from "citty";

14import { z } from "zod";

15var CLI = fileURLToPath(new URL("./cli.js", import.meta.url));

16var KINDS = [

17 "page",

18 "component",

19 "api",

20 "service",

21 "store",

22 "layout",

23 "middleware",

24 "test",

25 "model",

26 "migration",

27 "auth"

28];

dist/upgrade-363YDSK6.jsView file

Lines 28-70javascript

28var WIN = process.platform === "win32";

29function latestPublished() {

30 try {

31 const r = spawnSync("npm", ["view", PKG, "version"], {

dist/migrate-IKSGKDDU.jsView file

Lines 3-43javascript

3import { join, resolve } from "path";

4import { pathToFileURL } from "url";

5import { defineCommand } from "citty";

6var migrateCommand = defineCommand({

7 meta: {

8 name: "migrate",

vscode/apex-alpine.vsixView file

•path = vscode/apex-alpine.vsix kind = high_entropy_blob sizeBytes = 33222 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = compressed_blob sizeBytes = 33222 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = nested_archive_needs_inspection sizeBytes = 33222 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vscode/apex-alpine.vsixView on unpkg

Source & flagged code

7 flagged · loading source

dist/mcp-server-UWYPGDUU.jsView file

8// src/commands/mcp-server.ts L9: import { spawnSync } from "child_process"; L10: import { existsSync, readdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/mcp-server-UWYPGDUU.jsView on unpkg · L8

dist/upgrade-363YDSK6.jsView file

50} L51: async function maybeSelfUpdate(reexecArgv, choice) { L52: if (choice === false) return false;

High

Shell

Package source references shell execution.

dist/upgrade-363YDSK6.jsView on unpkg · L50

48function installGlobalLatest() { L49: return spawnSync("npm", ["install", "-g", `${PKG}@latest`], { stdio: "inherit", shell: WIN }).status === 0; L50: } ... L62: if (!yes) { L63: log(` ${color.gray("Skipped. Update later with")} ${color.cyan(`npm i -g ${PKG}@latest`)} L64: `);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/upgrade-363YDSK6.jsView on unpkg · L48

dist/migrate-IKSGKDDU.jsView file

23try { L24: const require2 = createRequire(join(root, "package.json")); L25: data = await import(pathToFileURL(require2.resolve("@apex-stack/data")).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/migrate-IKSGKDDU.jsView on unpkg · L23

vscode/apex-alpine.vsixView file

•path = vscode/apex-alpine.vsix kind = high_entropy_blob sizeBytes = 33222 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = compressed_blob sizeBytes = 33222 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = nested_archive_needs_inspection sizeBytes = 33222 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vscode/apex-alpine.vsixView on unpkg

Findings

4 High5 Medium5 Low

HighChild Processdist/mcp-server-UWYPGDUU.js

HighShelldist/upgrade-363YDSK6.js

HighRuntime Package Installdist/upgrade-363YDSK6.js

HighShips High Entropy Blobvscode/apex-alpine.vsix

MediumDynamic Requiredist/migrate-IKSGKDDU.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobvscode/apex-alpine.vsix

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionvscode/apex-alpine.vsix

Source & flagged code

7 flagged

dist/mcp-server-UWYPGDUU.jsView file

Lines 1-28javascript

1import {

2 VERSION

3} from "./chunk-3FZG6IJZ.js";

4import {

5 scanPages

6} from "./chunk-XBH3TTYG.js";

8// src/commands/mcp-server.ts

9import { spawnSync } from "child_process";

10import { existsSync, readdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/mcp-server-UWYPGDUU.jsView on unpkg · L8

11import { join, resolve } from "path";

12import { fileURLToPath } from "url";

13import { defineCommand } from "citty";

14import { z } from "zod";

15var CLI = fileURLToPath(new URL("./cli.js", import.meta.url));

16var KINDS = [

17 "page",

18 "component",

19 "api",

20 "service",

21 "store",

22 "layout",

23 "middleware",

24 "test",

25 "model",

26 "migration",

27 "auth"

28];

dist/upgrade-363YDSK6.jsView file

Lines 28-70javascript

28var WIN = process.platform === "win32";

29function latestPublished() {

30 try {

31 const r = spawnSync("npm", ["view", PKG, "version"], {

dist/migrate-IKSGKDDU.jsView file

Lines 3-43javascript

3import { join, resolve } from "path";

4import { pathToFileURL } from "url";

5import { defineCommand } from "citty";

6var migrateCommand = defineCommand({

7 meta: {

8 name: "migrate",

vscode/apex-alpine.vsixView file

•path = vscode/apex-alpine.vsix kind = high_entropy_blob sizeBytes = 33222 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = compressed_blob sizeBytes = 33222 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = nested_archive_needs_inspection sizeBytes = 33222 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vscode/apex-alpine.vsixView on unpkg