registry / @apex-stack/core / 0.45.3

@apex-stack/core@0.45.3

The full-stack meta-framework for Alpine.js — CLI and runtime

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 54 file(s), 345 KB of source, external domains: 127.0.0.1, api.postmarkapp.com, api.resend.com, openapi.vercel.sh, schemas.android.com

Source & flagged code

7 flagged

dist/chunk-TWAGSGFN.jsView file

Lines 1-21javascript

1// src/vscode.ts

2import { spawnSync } from "child_process";

3import { existsSync, readFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-TWAGSGFN.jsView on unpkg · L1

4import { createInterface } from "readline";

5import { fileURLToPath } from "url";

6var VSIX = fileURLToPath(new URL("../vscode/apex-alpine.vsix", import.meta.url));

7var VERSION_FILE = fileURLToPath(new URL("../vscode/version.txt", import.meta.url));

8var EXT_ID = "apex-stack.apex-alpine";

9var WIN = process.platform === "win32";

10var EDITOR_CLIS = ["code", "cursor", "windsurf", "codium"];

11function extensionBundled() {

12 return existsSync(VSIX);

13}

14function bundledVersion() {

15 try {

16 const v = readFileSync(VERSION_FILE, "utf8").trim();

17 return v || null;

18 } catch {

19 return null;

20 }

21}

dist/chunk-7AI224N4.jsView file

Lines 4-44javascript

4import { delimiter, isAbsolute, join } from "path";

5var isWindows = process.platform === "win32";

6function resolveBin(cmd) {

7 const exts

dist/chunk-ZRVXXPOE.jsView file

Lines 94-134javascript

94 ".mjs": "text/javascript",

95 ".css": "text/css",

96 ".html": "text/html",

97 ".json": "application/json",

98 ".webmanifest":

dist/upgrade-L54XA4E5.jsView file

Lines 28-68javascript

28var WIN = process.platform === "win32";

29function latestPublished() {

30 try {

31 const r = spawnSync

vscode/apex-alpine.vsixView file

•path = vscode/apex-alpine.vsix kind = high_entropy_blob sizeBytes = 33222 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = compressed_blob sizeBytes = 33222 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = nested_archive_needs_inspection sizeBytes = 33222 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vscode/apex-alpine.vsixView on unpkg

Source & flagged code

7 flagged · loading source

dist/chunk-TWAGSGFN.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code