registry / @kunlv/mvp-serve / 1.0.1

@kunlv/mvp-serve@1.0.1

Share any directory as a beautiful web page — render MD/HTML/YAML with built-in auth

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 51.0 KB of source, external domains: 0.0.0.0

Source & flagged code

3 flagged

src/cli.tsView file

Lines 1-23typescript

1#!/usr/bin/env node

2import * as net from 'node:net';

3import * as path from 'node:path';

4import { spawn } from 'node:child_process';

High

Child Process

Package source references child process execution.

src/cli.tsView on unpkg · L3

6const SOCKET = path.join(process.env.HOME!, '.mvp-serve', 'daemon.sock');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/cli.tsView on unpkg · L1

8function ipc(method: string, params: Record<string, unknown> = {}): Promise<any> {

9 return new Promise((resolve, reject) => {

10 const sock = net.createConnection(SOCKET, () => {

11 sock.write(JSON.stringify({ method, params }));

12 sock.end();

13 });

14 let data = '';

15 sock.on('data', (chunk) => { data += chunk.toString(); });

16 sock.on('end', () => {

17 try {

18 const resp = JSON.parse(data);

19 if (resp.error) reject(new Error(resp.error.message));

20 else resolve(resp.result);

21 } catch { reject(new Error('Invalid response')); }

22 });

23 sock.on('error', () => reject(new Error('Daemon not running. Start with: mvp-serve start')));

Lines 75-112typescript

75 break;

76 }

77 case 'url': {

78 if (!args[1]) { console.error('Usage: mvp-serve url <file>'); process.exit(1); }

79 console.log((await ipc(

Source & flagged code

3 flagged · loading source

src/cli.tsView file

3import * as path from 'node:path'; L4: import { spawn } from 'node:child_process'; L5:

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code