registry / @kunlv/mvp-serve / 1.0.6

@kunlv/mvp-serve@1.0.6

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 51.6 KB of source, external domains: 0.0.0.0

Source & flagged code

3 flagged

bin/mvp-serve.jsView file

Lines 1-15javascript

1#!/usr/bin/env node

2import { spawn } from 'node:child_process';

3import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

bin/mvp-serve.jsView on unpkg · L1

4import { dirname, join } from 'node:path';

6const __dirname = dirname(fileURLToPath(import.meta.url));

7const cliPath = join(__dirname, '..', 'src', 'cli.ts');

9const child = spawn('npx', ['tsx', cliPath, ...process.argv.slice(2)], {

10 stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mvp-serve.jsView on unpkg · L8

11 env: process.env

12});

14child.on('exit', (code) => process.exit(code || 0));

src/cli.tsView file

Lines 1-21typescript

1#!/usr/bin/env node

2import * as net from 'node:net';

3import * as path from 'node:path';

4import { spawn } from

Source & flagged code

3 flagged · loading source

bin/mvp-serve.jsView file

1#!/usr/bin/env node L2: import { spawn } from 'node:child_process'; L3: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

bin/mvp-serve.jsView on unpkg · L1

8L9: const child = spawn('npx', ['tsx', cliPath, ...process.argv.slice(2)], { L10: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mvp-serve.jsView on unpkg · L8

src/cli.tsView file

1#!/usr/bin/env node L2: import * as net from 'node:net'; L3: import * as path from 'node:path'; L4: import { spawn } from 'node:child_process'; L5: L6: const SOCKET = path.join(process.env.HOME!, '.mvp-serve', 'daemon.sock'); L7:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

Findings

4 High3 Medium4 Low

HighChild Processbin/mvp-serve.js

HighShell

HighSame File Env Network Executionsrc/cli.ts

HighRuntime Package Installbin/mvp-serve.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings