registry / @apex-stack/core / 0.8.1

@apex-stack/core@0.8.1

The full-stack meta-framework for Alpine.js — CLI and runtime

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 28 file(s), 112 KB of source

Source & flagged code

7 flagged

dist/chunk-TWAGSGFN.jsView file

Lines 1-21javascript

1// src/vscode.ts

2import { spawnSync } from "child_process";

3import { existsSync, readFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-TWAGSGFN.jsView on unpkg · L1

4import { createInterface } from "readline";

5import { fileURLToPath } from "url";

6var VSIX = fileURLToPath(new URL("../vscode/apex-alpine.vsix", import.meta.url));

7var VERSION_FILE = fileURLToPath(new URL("../vscode/version.txt", import.meta.url));

8var EXT_ID = "apex-stack.apex-alpine";

9var WIN = process.platform === "win32";

10var EDITOR_CLIS = ["code", "cursor", "windsurf", "codium"];

11function extensionBundled() {

12 return existsSync(VSIX);

13}

14function bundledVersion() {

15 try {

16 const v = readFileSync(VERSION_FILE, "utf8").trim();

17 return v || null;

18 } catch {

19 return null;

20 }

21}

dist/upgrade-YZN6TVNI.jsView file

Lines 24-66javascript

24var WIN = process.platform === "win32";

25function latestPublished() {

26 try {

27 const r = spawnSync("npm", ["view", PKG, "version"], {

dist/server-UVY6DFK2.jsView file

Lines 311-351javascript

311 <code>apex dev</code> looks for <code>pages/*.alpine</code> in <code>${esc(root)}</code>, but found none \u2014 run it from inside your app's folder.

312 ${suggest}

313 Every Apex app has a <code>pages/</code

vscode/apex-alpine.vsixView file

•path = vscode/apex-alpine.vsix kind = high_entropy_blob sizeBytes = 33222 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = compressed_blob sizeBytes = 33222 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = nested_archive_needs_inspection sizeBytes = 33222 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vscode/apex-alpine.vsixView on unpkg

Source & flagged code

7 flagged · loading source

dist/chunk-TWAGSGFN.jsView file

1// src/vscode.ts L2: import { spawnSync } from "child_process"; L3: import { existsSync, readFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-TWAGSGFN.jsView on unpkg · L1

dist/upgrade-YZN6TVNI.jsView file

46} L47: async function maybeSelfUpdate(reexecArgv, choice) { L48: if (choice === false) return false;

High

Shell

Package source references shell execution.

dist/upgrade-YZN6TVNI.jsView on unpkg · L46

44function installGlobalLatest() { L45: return spawnSync("npm", ["install", "-g", `${PKG}@latest`], { stdio: "inherit", shell: WIN }).status === 0; L46: } ... L58: if (!yes) { L59: log(` ${color.gray("Skipped. Update later with")} ${color.cyan(`npm i -g ${PKG}@latest`)} L60: `);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/upgrade-YZN6TVNI.jsView on unpkg · L44

dist/server-UVY6DFK2.jsView file

331const pageId = options.pageId ?? "/pages/index.alpine"; L332: const req = createRequire(import.meta.url); L333: const tryResolve = (spec) => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server-UVY6DFK2.jsView on unpkg · L331

vscode/apex-alpine.vsixView file

•path = vscode/apex-alpine.vsix kind = high_entropy_blob sizeBytes = 33222 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = compressed_blob sizeBytes = 33222 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = nested_archive_needs_inspection sizeBytes = 33222 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vscode/apex-alpine.vsixView on unpkg

Findings

4 High5 Medium4 Low

HighChild Processdist/chunk-TWAGSGFN.js

HighShelldist/upgrade-YZN6TVNI.js

HighRuntime Package Installdist/upgrade-YZN6TVNI.js

HighShips High Entropy Blobvscode/apex-alpine.vsix

MediumDynamic Requiredist/server-UVY6DFK2.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobvscode/apex-alpine.vsix

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNested Archive Needs Inspectionvscode/apex-alpine.vsix

Source & flagged code

7 flagged

dist/chunk-TWAGSGFN.jsView file

Lines 1-21javascript

1// src/vscode.ts

2import { spawnSync } from "child_process";

3import { existsSync, readFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-TWAGSGFN.jsView on unpkg · L1

4import { createInterface } from "readline";

5import { fileURLToPath } from "url";

6var VSIX = fileURLToPath(new URL("../vscode/apex-alpine.vsix", import.meta.url));

7var VERSION_FILE = fileURLToPath(new URL("../vscode/version.txt", import.meta.url));

8var EXT_ID = "apex-stack.apex-alpine";

9var WIN = process.platform === "win32";

10var EDITOR_CLIS = ["code", "cursor", "windsurf", "codium"];

11function extensionBundled() {

12 return existsSync(VSIX);

13}

14function bundledVersion() {

15 try {

16 const v = readFileSync(VERSION_FILE, "utf8").trim();

17 return v || null;

18 } catch {

19 return null;

20 }

21}

dist/upgrade-YZN6TVNI.jsView file

Lines 24-66javascript

24var WIN = process.platform === "win32";

25function latestPublished() {

26 try {

27 const r = spawnSync("npm", ["view", PKG, "version"], {

dist/server-UVY6DFK2.jsView file

Lines 311-351javascript

311 <code>apex dev</code> looks for <code>pages/*.alpine</code> in <code>${esc(root)}</code>, but found none \u2014 run it from inside your app's folder.

312 ${suggest}

313 Every Apex app has a <code>pages/</code

vscode/apex-alpine.vsixView file

•path = vscode/apex-alpine.vsix kind = high_entropy_blob sizeBytes = 33222 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = compressed_blob sizeBytes = 33222 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vscode/apex-alpine.vsixView on unpkg

•path = vscode/apex-alpine.vsix kind = nested_archive_needs_inspection sizeBytes = 33222 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vscode/apex-alpine.vsixView on unpkg