registry / @astrale-os/sdk / 0.4.5

@astrale-os/sdk@0.4.5

⚠ Under review

Astrale Remote Domain SDK - Define and deploy domains as standalone Hono servers

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 128 file(s), 440 KB of source, external domains: bun.sh

Source & flagged code

3 flagged

package.jsonView file

Lines 83-114json

83 "@hono/node-server": "^1.19.0"

84 },

85 "peerDependenciesMeta": {

86 "@hono/node-server": {

87 "optional": true

88 }

89 },

90 "lint-staged": {

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.preinstall = node -e "try{require('./.check-workspace.cjs')}catch{}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.preinstall = node -e "try{require('./.check-workspace.cjs')}catch{}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/server/start.jsView file

10// bundles (wrangler/esbuild) traverse it even though they never call it. A L11: // literal import() would make them resolve the optional peer and fail. L12: const nodeServerModule = '@hono/node-server';

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server/start.jsView on unpkg · L10

Findings

1 Critical1 High5 Medium4 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

MediumDynamic Requiredist/server/start.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/server/start.jsView file

Lines 1-30javascript

1/**

2 * Node HTTP convenience starter.

3 *

4 * Dynamically imports `@hono/node-server` so the SDK stays runtime-agnostic

5 * — only Node consumers actually pull in the dep. For Bun / Deno /

6 * Cloudflare, consumers go through `server.app.fetch` directly.

7 */

8export async function startNodeServer(app, port = 3000) {

9 // Opaque specifier: the `./server` barrel re-exports this module, so worker

10 // bundles (wrangler/esbuild) traverse it even though they never call it. A

11 // literal import() would make them resolve the optional peer and fail.

12 const nodeServerModule = '@hono/node-server';

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server/start.jsView on unpkg · L10

13 const { serve } = (await import(nodeServerModule));

14 // oxlint-disable-next-line no-explicit-any

15 const server = serve({ fetch: app.fetch, port });

16 await new Promise((resolve, reject) => {

17 if (server.listening)

18 return resolve();

19 server.once('listening', () => resolve());

20 // Without this, a bind failure (e.g. EADDRINUSE on a busy port) emits

21 // `'error'` and never `'listening'`, leaving the Promise — and startup —

22 // hung forever with no diagnostic.

23 server.once('error', (err) => reject(err));

24 });

25 const address = server.address();

26 const actualPort = address?.port ?? port;

27 return {

28 port: actualPort,

29 close: () => new Promise((resolve, reject) => {

30 server.close((err) => (err ? reject(err) : resolve()));