registry / @jxsuite/server / 0.35.0

@jxsuite/server@0.35.0

Jx development server with live reload, server-side proxy, and studio integration

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 164 KB of source, external domains: api.openai.com, registry.npmjs.org

Source & flagged code

4 flagged

src/resolve.tsView file

Lines 259-299typescript

259 const methods = classDef.$defs?.methods ?? {};

260

261 // oxlint-disable-next-line typescript/no-extraneous-class -- methods are attached to the prototype dynamically below

262 class DynClass {

263 constructor(config = {}) {

264 const self = this as Record<string, unknown>;

265 const cfg = config as Record<string, unknown>;

266 for (const [key, field] of Object.entries(fields)) {

267 const id = field.identifier ?? key;

268 if (cfg[id] !== undefined) {

269 self[id] = cfg[id];

270 } else if (field.initializer !== undefined) {

271 self[id] = field.initializer;

272 } else if (field.default !== undefined) {

273 self[id] = structuredClone(field.default);

274 } else {

275 self[id] = null;

276 }

277 }

278 if (ctor?.body) {

279 const bodyStr = Array.isArray(ctor.body) ? ctor.body.join("\n") : ctor.body;

280 new Function("config", bodyStr).call(this, config);

281 }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/resolve.tsView on unpkg · L279

282 }

283 }

284

285 for (const [key, method] of Object.entries(methods)) {

286 const name = method.identifier ?? key;

287 const params = (method.parameters ?? []).map((p) => {

288 if (p.$ref) {

289 return p.$ref.split("/").pop() ?? "arg";

290 }

291 const n = p.identifier ?? p.name;

292 return typeof n === "string" ? n : "arg";

293 });

294 const bodyStr = Array.isArray(method.body) ? method.body.join("\n") : (method.body ?? "");

295

296 if (method.role === "accessor") {

297 const descriptor: PropertyDescriptor = {};

298 if (method.getter) {

299 descriptor.get = new Function(method.getter.body ?? "") as () => unknown;

src/studio-api.tsView file

Lines 436-507typescript

436 description?: string;

437 url?: string;

438 adapter?: "static" | "cloudflare-pages" | "cloudflare-workers" | "node" | "bun";

439 directory?: string;

440 starter

Source & flagged code

4 flagged · loading source

src/resolve.tsView file

279const bodyStr = Array.isArray(ctor.body) ? ctor.body.join("\n") : ctor.body; L280: new Function("config", bodyStr).call(this, config); L281: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/resolve.tsView on unpkg · L279

src/studio-api.tsView file

487package = @jxsuite/server; repositoryIdentity = jx; dependency = @jxsuite/starters L487: try { L488: const { listStarters } = await import("@jxsuite/starters"); L489: return Response.json(listStarters());

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/studio-api.tsView on unpkg · L487

•matchType = previous_version_dangerous_delta matchedPackage = @jxsuite/server@0.34.0 matchedIdentity = npm:QGp4c3VpdGUvc2VydmVy:0.34.0 similarity = 0.813 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/studio-api.tsView on unpkg

456} L457: const { isTemplateId } = await import("@jxsuite/create/templates"); L458: if (template !== undefined && !isTemplateId(template)) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/studio-api.tsView on unpkg · L456

Findings

2 High4 Medium5 Low

HighCopied Package Dependency Bridgesrc/studio-api.ts

HighPrevious Version Dangerous Deltasrc/studio-api.ts

MediumDynamic Requiresrc/studio-api.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalsrc/resolve.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

src/resolve.tsView file

Lines 259-299typescript

259 const methods = classDef.$defs?.methods ?? {};

260

261 // oxlint-disable-next-line typescript/no-extraneous-class -- methods are attached to the prototype dynamically below

262 class DynClass {

263 constructor(config = {}) {

264 const self = this as Record<string, unknown>;

265 const cfg = config as Record<string, unknown>;

266 for (const [key, field] of Object.entries(fields)) {

267 const id = field.identifier ?? key;

268 if (cfg[id] !== undefined) {

269 self[id] = cfg[id];

270 } else if (field.initializer !== undefined) {

271 self[id] = field.initializer;

272 } else if (field.default !== undefined) {

273 self[id] = structuredClone(field.default);

274 } else {

275 self[id] = null;

276 }

277 }

278 if (ctor?.body) {

279 const bodyStr = Array.isArray(ctor.body) ? ctor.body.join("\n") : ctor.body;

280 new Function("config", bodyStr).call(this, config);

281 }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/resolve.tsView on unpkg · L279

282 }

283 }

284

285 for (const [key, method] of Object.entries(methods)) {

286 const name = method.identifier ?? key;

287 const params = (method.parameters ?? []).map((p) => {

288 if (p.$ref) {

289 return p.$ref.split("/").pop() ?? "arg";

290 }

291 const n = p.identifier ?? p.name;

292 return typeof n === "string" ? n : "arg";

293 });

294 const bodyStr = Array.isArray(method.body) ? method.body.join("\n") : (method.body ?? "");

295

296 if (method.role === "accessor") {

297 const descriptor: PropertyDescriptor = {};

298 if (method.getter) {

299 descriptor.get = new Function(method.getter.body ?? "") as () => unknown;

src/studio-api.tsView file

Lines 436-507typescript

436 description?: string;

437 url?: string;

438 adapter?: "static" | "cloudflare-pages" | "cloudflare-workers" | "node" | "bun";

439 directory?: string;

440 starter