registry / @hachej/boring-core / 0.1.62

@hachej/boring-core@0.1.62

Foundation package for boring-ui-v2 apps: DB, auth, config, HTTP app factory, and frontend app shell.

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 548 KB of source, external domains: 127.0.0.1, api.lemonsqueezy.com, api.resend.com, api.stripe.com, calendly.com, fonts.googleapis.com, fonts.gstatic.com

Source & flagged code

1 flagged

dist/app/server/index.jsView file

Lines 953-993javascript

953import { fileURLToPath } from "url";

954function appRootFromImportMeta(importMetaUrl, levelsUp = 2) {

955 return path2.resolve(path2.dirname(fileURLToPath(importMetaUrl)), "../".repeat(levelsUp));

956}

957

958// src/app/server/devServer.ts

959var DEFAULT_FRONTEND_PORT = 5173;

960async function startCoreWorkspaceAgentDevServer({

961 appRoot,

962 buildServer,

963 frontendPort = DEFAULT_FRONTEND_PORT,

964 eventPrefix = "core-workspace-agent"

965}) {

966 const app = await buildServer({ appRoot, serveFrontend: false });

967 const address = await app.listen({

968 host: app.config.host,

969 port: app.config.port

970 });

971 app.log.info({ event: `${eventPrefix}.server.ready`, address }, `${eventPrefix}.server.ready`);

972 const apiPort = Number(new URL(address).port);

973 const apiTarget = `http://127.0.0.1:${apiPort}`;

974 const requireFromApp = createRequire(path3.join(appRoot, "package.json"));

975 const viteEntry = requireFromApp.resolve("vite");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/app/server/index.jsView on unpkg · L973

976 const viteModule = await import(pathToFileURL(viteEntry).href);

977 const vite = await viteModule.createServer({

978 root: appRoot,

979 server: {

980 port: frontendPort,

981 strictPort: false,

982 host: true,

983 proxy: {

984 "/api": apiTarget,

985 "/health": apiTarget,

986 "/dev-login": apiTarget,

987 "/auth": {

988 target: apiTarget,

989 changeOrigin: true,

990 bypass(req) {

991 const accept = req.headers.accept ?? "";

992 if (req.method === "GET" && accept.includes("text/html")) {

993 return req.url;

Source & flagged code

1 flagged · loading source

dist/app/server/index.jsView file

973const apiTarget = `http://127.0.0.1:${apiPort}`; L974: const requireFromApp = createRequire(path3.join(appRoot, "package.json")); L975: const viteEntry = requireFromApp.resolve("vite");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/app/server/index.jsView on unpkg · L973

Findings

3 Medium4 Low

MediumDynamic Requiredist/app/server/index.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/app/server/index.jsView file

Lines 953-993javascript

953import { fileURLToPath } from "url";

954function appRootFromImportMeta(importMetaUrl, levelsUp = 2) {

955 return path2.resolve(path2.dirname(fileURLToPath(importMetaUrl)), "../".repeat(levelsUp));

956}

957

958// src/app/server/devServer.ts

959var DEFAULT_FRONTEND_PORT = 5173;

960async function startCoreWorkspaceAgentDevServer({

961 appRoot,

962 buildServer,

963 frontendPort = DEFAULT_FRONTEND_PORT,

964 eventPrefix = "core-workspace-agent"

965}) {

966 const app = await buildServer({ appRoot, serveFrontend: false });

967 const address = await app.listen({

968 host: app.config.host,

969 port: app.config.port

970 });

971 app.log.info({ event: `${eventPrefix}.server.ready`, address }, `${eventPrefix}.server.ready`);

972 const apiPort = Number(new URL(address).port);

973 const apiTarget = `http://127.0.0.1:${apiPort}`;

974 const requireFromApp = createRequire(path3.join(appRoot, "package.json"));

975 const viteEntry = requireFromApp.resolve("vite");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/app/server/index.jsView on unpkg · L973

976 const viteModule = await import(pathToFileURL(viteEntry).href);

977 const vite = await viteModule.createServer({

978 root: appRoot,

979 server: {

980 port: frontendPort,

981 strictPort: false,

982 host: true,

983 proxy: {

984 "/api": apiTarget,

985 "/health": apiTarget,

986 "/dev-login": apiTarget,

987 "/auth": {

988 target: apiTarget,

989 changeOrigin: true,

990 bypass(req) {

991 const accept = req.headers.accept ?? "";

992 if (req.method === "GET" && accept.includes("text/html")) {

993 return req.url;