registry / @jxsuite/server / 0.33.0

@jxsuite/server@0.33.0

Jx development server with live reload, server-side proxy, and studio integration

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 138 KB of source, external domains: api.openai.com, registry.npmjs.org

Source & flagged code

2 flagged

src/resolve.tsView file

Lines 259-299typescript

259 const methods = classDef.$defs?.methods ?? {};

260

261 // oxlint-disable-next-line typescript/no-extraneous-class -- methods are attached to the prototype dynamically below

262 class DynClass {

263 constructor(config = {}) {

264 const self = this as Record<string, unknown>;

265 const cfg = config as Record<string, unknown>;

266 for (const [key, field] of Object.entries(fields)) {

267 const id = field.identifier ?? key;

268 if (cfg[id] !== undefined) {

269 self[id] = cfg[id];

270 } else if (field.initializer !== undefined) {

271 self[id] = field.initializer;

272 } else if (field.default !== undefined) {

273 self[id] = structuredClone(field.default);

274 } else {

275 self[id] = null;

276 }

277 }

278 if (ctor?.body) {

279 const bodyStr = Array.isArray(ctor.body) ? ctor.body.join("\n") : ctor.body;

280 new Function("config", bodyStr).call(this, config);

281 }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/resolve.tsView on unpkg · L279

282 }

283 }

284

285 for (const [key, method] of Object.entries(methods)) {

286 const name = method.identifier ?? key;

287 const params = (method.parameters ?? []).map((p) => {

288 if (p.$ref) {

289 return p.$ref.split("/").pop() ?? "arg";

290 }

291 const n = p.identifier ?? p.name;

292 return typeof n === "string" ? n : "arg";

293 });

294 const bodyStr = Array.isArray(method.body) ? method.body.join("\n") : (method.body ?? "");

295

296 if (method.role === "accessor") {

297 const descriptor: PropertyDescriptor = {};

298 if (method.getter) {

299 descriptor.get = new Function(method.getter.body ?? "") as () => unknown;

src/studio-api.tsView file

Lines 414-454typescript

414 return Response.json({ error: errorMessage(error) }, { status: 500 });

415 }

416 }

417

418 // Create a new project

419 if (path === "/__studio/create-project" && req.method === "POST") {

420

Source & flagged code

2 flagged · loading source

src/resolve.tsView file

279const bodyStr = Array.isArray(ctor.body) ? ctor.body.join("\n") : ctor.body; L280: new Function("config", bodyStr).call(this, config); L281: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/resolve.tsView on unpkg · L279

src/studio-api.tsView file

434L435: const { generateProject } = await import("@jxsuite/create/generate"); L436: await generateProject(destPath, {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/studio-api.tsView on unpkg · L434

Findings

3 Medium5 Low

MediumDynamic Requiresrc/studio-api.ts

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvalsrc/resolve.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

src/resolve.tsView file

Lines 259-299typescript

259 const methods = classDef.$defs?.methods ?? {};

260

261 // oxlint-disable-next-line typescript/no-extraneous-class -- methods are attached to the prototype dynamically below

262 class DynClass {

263 constructor(config = {}) {

264 const self = this as Record<string, unknown>;

265 const cfg = config as Record<string, unknown>;

266 for (const [key, field] of Object.entries(fields)) {

267 const id = field.identifier ?? key;

268 if (cfg[id] !== undefined) {

269 self[id] = cfg[id];

270 } else if (field.initializer !== undefined) {

271 self[id] = field.initializer;

272 } else if (field.default !== undefined) {

273 self[id] = structuredClone(field.default);

274 } else {

275 self[id] = null;

276 }

277 }

278 if (ctor?.body) {

279 const bodyStr = Array.isArray(ctor.body) ? ctor.body.join("\n") : ctor.body;

280 new Function("config", bodyStr).call(this, config);

281 }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/resolve.tsView on unpkg · L279

282 }

283 }

284

285 for (const [key, method] of Object.entries(methods)) {

286 const name = method.identifier ?? key;

287 const params = (method.parameters ?? []).map((p) => {

288 if (p.$ref) {

289 return p.$ref.split("/").pop() ?? "arg";

290 }

291 const n = p.identifier ?? p.name;

292 return typeof n === "string" ? n : "arg";

293 });

294 const bodyStr = Array.isArray(method.body) ? method.body.join("\n") : (method.body ?? "");

295

296 if (method.role === "accessor") {

297 const descriptor: PropertyDescriptor = {};

298 if (method.getter) {

299 descriptor.get = new Function(method.getter.body ?? "") as () => unknown;

src/studio-api.tsView file

Lines 414-454typescript

414 return Response.json({ error: errorMessage(error) }, { status: 500 });

415 }

416 }

417

418 // Create a new project

419 if (path === "/__studio/create-project" && req.method === "POST") {

420