registry / @kunlv/mvp-serve / 1.0.4

@kunlv/mvp-serve@1.0.4

Share any directory as a beautiful web page — render MD/HTML/YAML with built-in auth

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 51.5 KB of source, external domains: 0.0.0.0

Source & flagged code

3 flagged

bin/mvp-serve.jsView file

Lines 1-15javascript

1#!/usr/bin/env node

2import { spawn } from 'node:child_process';

3import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

bin/mvp-serve.jsView on unpkg · L1

4import { dirname, join } from 'node:path';

6const __dirname = dirname(fileURLToPath(import.meta.url));

7const cliPath = join(__dirname, '..', 'src', 'cli.ts');

9const child = spawn('npx', ['tsx', cliPath, ...process.argv.slice(2)], {

10 stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mvp-serve.jsView on unpkg · L8

11 env: process.env

12});

14child.on('exit', (code) => process.exit(code || 0));

src/cli.tsView file

Lines 1-21typescript

1#!/usr/bin/env node

2import * as net from 'node:net';

3import * as path from 'node:path';

4import { spawn } from

Source & flagged code

3 flagged · loading source

bin/mvp-serve.jsView file

1#!/usr/bin/env node L2: import { spawn } from 'node:child_process'; L3: import { fileURLToPath } from 'node:url';

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code