registry / @apex-stack/core / 0.7.1

@apex-stack/core@0.7.1

The full-stack meta-framework for Alpine.js — CLI and runtime

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 28 file(s), 104 KB of source

Source & flagged code

5 flagged

dist/server-2FN6GV3M.jsView file

Lines 297-337javascript

297 <p class="sub"><code>apex dev</code> looks for <code>pages/*.alpine</code> in <code>${esc(root)}</code>, but found none \u2014 run it from inside your app's folder.</p>

298 ${suggest}

299 <p class="foot">Every Apex app has a <code>pages/</code> directory with at least <code>pages/index.alpine</code>.</p>`;

300 return page("No Apex app \u2014 Apex JS", body);

301}

302function renderNotFoundPage(url, routes) {

303 const list = routes.length ? routes.map((r) => `<li>${esc(r.pattern)}</li>`).join("") : "<li>no pages yet \u2014 add pages/index.alpine</li>";

304 const body = `

305 <div class="brand">${MARK} Apex JS <span class="pill nf">404</span></div>

306 <p class="kind nf">404 \u2014 Not found</p>

307 <h1>No route matches <code>${esc(url)}</code></h1>

308 <p class="sub">These routes are available:</p>

309 <ul class="routes">${list}</ul>

310 <p class="foot">Add a file under <code>pages/</code> to create a new route.</p>`;

311 return page("404 \u2014 Apex JS", body);

312}

313

314// src/dev/server.ts

315async function startDevServer(options) {

316 const port = options.port ?? 3e3;

317 const pageId = options.pageId ?? "/pages/index.alpine";

318 const req = createRequire(import.meta.url);

319 const tryResolve = (spec) => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server-2FN6GV3M.jsView on unpkg · L317

320 try {

321 return req.resolve(spec);

322 } catch {

323 return void 0;

324 }

325 };

326 const alpine = tryResolve("alpinejs");

327 const kit = tryResolve("@apex-stack/kit");

328 const coreClient = fileURLToPath(new URL("./client.js", import.meta.url));

329 const coreSelf = fileURLToPath(new URL("./index.js", import.meta.url));

330 const alias = {

331 "@apex-stack/core/client": coreClient,

332 "@apex-stack/core": coreSelf

333 };

334 if (alpine) alias.alpinejs = alpine;

335 if (kit) alias["@apex-stack/kit"] = kit;

336 const plugins = [apex({ clientRuntime: "@apex-stack/core/client" })];

337 let hasTailwind = false;

vscode/apex-alpine.vsixView file

•path = vscode/apex-alpine.vsix kind = high_entropy_blob sizeBytes = 10577 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = compressed_blob sizeBytes = 10577 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = nested_archive_needs_inspection sizeBytes = 10577 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vscode/apex-alpine.vsixView on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @apex-stack/core@0.5.0 matchedIdentity = npm:QGFwZXgtc3RhY2svY29yZQ:0.5.0 similarity = 0.607 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/server-2FN6GV3M.jsView file

317const pageId = options.pageId ?? "/pages/index.alpine"; L318: const req = createRequire(import.meta.url); L319: const tryResolve = (spec) => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server-2FN6GV3M.jsView on unpkg · L317

vscode/apex-alpine.vsixView file

•path = vscode/apex-alpine.vsix kind = high_entropy_blob sizeBytes = 10577 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = compressed_blob sizeBytes = 10577 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = nested_archive_needs_inspection sizeBytes = 10577 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vscode/apex-alpine.vsixView on unpkg

dist/cli.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Findings

2 High5 Medium4 Low

HighShips High Entropy Blobvscode/apex-alpine.vsix

HighPrevious Version Dangerous Deltadist/cli.js

MediumDynamic Requiredist/server-2FN6GV3M.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobvscode/apex-alpine.vsix

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNested Archive Needs Inspectionvscode/apex-alpine.vsix

Source & flagged code

5 flagged

dist/server-2FN6GV3M.jsView file

Lines 297-337javascript

297 <p class="sub"><code>apex dev</code> looks for <code>pages/*.alpine</code> in <code>${esc(root)}</code>, but found none \u2014 run it from inside your app's folder.</p>

298 ${suggest}

299 <p class="foot">Every Apex app has a <code>pages/</code> directory with at least <code>pages/index.alpine</code>.</p>`;

300 return page("No Apex app \u2014 Apex JS", body);

301}

302function renderNotFoundPage(url, routes) {

303 const list = routes.length ? routes.map((r) => `<li>${esc(r.pattern)}</li>`).join("") : "<li>no pages yet \u2014 add pages/index.alpine</li>";

304 const body = `

305 <div class="brand">${MARK} Apex JS <span class="pill nf">404</span></div>

306 <p class="kind nf">404 \u2014 Not found</p>

307 <h1>No route matches <code>${esc(url)}</code></h1>

308 <p class="sub">These routes are available:</p>

309 <ul class="routes">${list}</ul>

310 <p class="foot">Add a file under <code>pages/</code> to create a new route.</p>`;

311 return page("404 \u2014 Apex JS", body);

312}

313

314// src/dev/server.ts

315async function startDevServer(options) {

316 const port = options.port ?? 3e3;

317 const pageId = options.pageId ?? "/pages/index.alpine";

318 const req = createRequire(import.meta.url);

319 const tryResolve = (spec) => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server-2FN6GV3M.jsView on unpkg · L317

320 try {

321 return req.resolve(spec);

322 } catch {

323 return void 0;

324 }

325 };

326 const alpine = tryResolve("alpinejs");

327 const kit = tryResolve("@apex-stack/kit");

328 const coreClient = fileURLToPath(new URL("./client.js", import.meta.url));

329 const coreSelf = fileURLToPath(new URL("./index.js", import.meta.url));

330 const alias = {

331 "@apex-stack/core/client": coreClient,

332 "@apex-stack/core": coreSelf

333 };

334 if (alpine) alias.alpinejs = alpine;

335 if (kit) alias["@apex-stack/kit"] = kit;

336 const plugins = [apex({ clientRuntime: "@apex-stack/core/client" })];

337 let hasTailwind = false;

vscode/apex-alpine.vsixView file

•path = vscode/apex-alpine.vsix kind = high_entropy_blob sizeBytes = 10577 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = compressed_blob sizeBytes = 10577 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = nested_archive_needs_inspection sizeBytes = 10577 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vscode/apex-alpine.vsixView on unpkg

dist/cli.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg