Loading npm security reports…

@jxsuite/server@1.1.0: Suspicious npm security report (Warn) | LPM Firewall

registry / @jxsuite/server / 1.1.0

@jxsuite/server@1.1.0

Jx development server with live reload, server-side proxy, and studio integration

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 22 file(s), 222 KB of source, external domains: api.cloudflare.com, api.openai.com, registry.npmjs.org

Source & flagged code

4 flagged

src/resolve.tsView file

Lines 267-307typescript

267 const methods = classDef.$defs?.methods ?? {};

268

269 // oxlint-disable-next-line typescript/no-extraneous-class -- methods are attached to the prototype dynamically below

270 class DynClass {

271 constructor(config = {}) {

272 const self = this as Record<string, unknown>;

273 const cfg = config as Record<string, unknown>;

274 for (const [key, field] of Object.entries(fields)) {

275 const id = field.identifier ?? key;

276 if (cfg[id] !== undefined) {

277 self[id] = cfg[id];

278 } else if (field.initializer !== undefined) {

279 self[id] = field.initializer;

280 } else if (field.default !== undefined) {

281 self[id] = structuredClone(field.default);

282 } else {

283 self[id] = null;

284 }

285 }

286 if (ctor?.body) {

287 const bodyStr = Array.isArray(ctor.body) ? ctor.body.join("\n") : ctor.body;

288 new Function("config", bodyStr).call(this, config);

289 }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/resolve.tsView on unpkg · L287

290 }

291 }

292

293 for (const [key, method] of Object.entries(methods)) {

294 const name = method.identifier ?? key;

295 const params = (method.parameters ?? []).map((p) => {

296 if (p.$ref) {

297 return p.$ref.split("/").pop() ?? "arg";

298 }

299 const n = p.identifier ?? p.name;

300 return typeof n === "string" ? n : "arg";

301 });

302 const bodyStr = Array.isArray(method.body) ? method.body.join("\n") : (method.body ?? "");

303

304 if (method.role === "accessor") {

305 const descriptor: PropertyDescriptor = {};

306 if (method.getter) {

307 descriptor.get = new Function(method.getter.body ?? "") as () => unknown;

src/studio-api.tsView file

Lines 454-525typescript

454 description?: string;

455 url?: string;

456 adapter?: "static" | "cloudflare-pages" | "cloudflare-workers" | "node" |

Source & flagged code

4 flagged · loading source

src/resolve.tsView file

Source & flagged code

4 flagged

src/resolve.tsView file

Lines 267-307typescript

267 const methods = classDef.$defs?.methods ?? {};

268

269 // oxlint-disable-next-line typescript/no-extraneous-class -- methods are attached to the prototype dynamically below

270 class DynClass {

271 constructor(config = {}) {

272 const self = this as Record<string, unknown>;

273 const cfg = config as Record<string, unknown>;

274 for (const [key, field] of Object.entries(fields)) {

275 const id = field.identifier ?? key;

276 if (cfg[id] !== undefined) {

277 self[id] = cfg[id];

278 } else if (field.initializer !== undefined) {

279 self[id] = field.initializer;

280 } else if (field.default !== undefined) {

281 self[id] = structuredClone(field.default);

282 } else {

283 self[id] = null;

284 }

285 }

286 if (ctor?.body) {

287 const bodyStr = Array.isArray(ctor.body) ? ctor.body.join("\n") : ctor.body;

288 new Function("config", bodyStr).call(this, config);

289 }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/resolve.tsView on unpkg · L287

290 }

291 }

292

293 for (const [key, method] of Object.entries(methods)) {

294 const name = method.identifier ?? key;

295 const params = (method.parameters ?? []).map((p) => {

296 if (p.$ref) {

297 return p.$ref.split("/").pop() ?? "arg";

298 }

299 const n = p.identifier ?? p.name;

300 return typeof n === "string" ? n : "arg";

301 });

302 const bodyStr = Array.isArray(method.body) ? method.body.join("\n") : (method.body ?? "");

303

304 if (method.role === "accessor") {

305 const descriptor: PropertyDescriptor = {};

306 if (method.getter) {

307 descriptor.get = new Function(method.getter.body ?? "") as () => unknown;

src/studio-api.tsView file

Lines 454-525typescript

454 description?: string;

455 url?: string;

456 adapter?: "static" | "cloudflare-pages" | "cloudflare-workers" | "node" |

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code