registry / @nebula.js/cli-serve / 7.5.2

@nebula.js/cli-serve@7.5.2

⚠ Under review

Basic web development server for nebula.js visualizations.

Static Scan Results

scanned 21d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 17 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 112 file(s), 3.72 MB of source, external domains: bugzilla.mozilla.org, cdn.jsdelivr.net, cdn.qlikcloud.com, code.google.com, developer.mozilla.org, developers.google.com, drafts.csswg.org, en.wikipedia.org, github.com, googlechrome.github.io, hacks.mozilla.org, help.yahoo.com, html.spec.whatwg.org, json-schema.org, mui.com, r12a.github.io, react.dev, sass-lang.com, schema.org, stackoverflow.com, support.google.com, tools.ietf.org, webaim.org, wiki.whatwg.org, www.apache.org, www.bing.com, www.dmoz.org, www.iana.org, www.ietf.org, www.w3.org, www.whatwg.org

Oversized source lightweight scan

dist/5790.js6.41 MB file, sampled 256 KB

FilesystemNetworkHighEntropyStringsMinifiedUrlStringsdeveloper.mozilla.orgwww.apache.org

Source & flagged code

8 flagged

dist/eRender.jsView file

1/*! For license information please see eRender.js.LICENSE.txt */ L2: (()=>{var e={62234(e){e.exports=function(){"use strict";var e={};function t(){t.init.call(this)}e.isObject=function(e){return"object"==typeof e&&null!==e},e.isNumber=function(e){re... L3: 0% {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/eRender.jsView on unpkg · L1

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/eRender.jsView on unpkg · L1

dist/6156.jsView file

1"use strict";(self.webpackChunk_nebula_js_cli_serve=self.webpackChunk_nebula_js_cli_serve||[]).push([[6156],{16156(e,t,n){n.d(t,{n:()=>Xs});const r=new class{constructor(){this.lis... L2: //# sourceMappingURL=6156.js.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/6156.jsView on unpkg · L1

lib/webpack.build.jsView file

17L18: const { version } = require('../package.json'); L19: ... L43: '@nebula.js/locale': path.resolve(moduleDir, '../../../apis/locale/src'), L44: fixtures: path.resolve(process.cwd(), serveConfig.fixturePath || ''), L45: }, ... L96: __NEBULA_DEV__: true, L97: 'process.env.NEBULA_VERSION': JSON.stringify(version), L98: 'process.env.NEBULA_VERSION_HASH': JSON.stringify(versionHash),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/webpack.build.jsView on unpkg · L17

dist/5790.jsView file

•path = dist/5790.js kind = oversized_source_file sizeBytes = 6718119 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/5790.jsView on unpkg

dist/6567.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/6567.js#virtual:normalized:round1View on unpkg

lib/init-config.jsView file

•matchType = normalized_sha256 matchedPackage = @nebula.js/cli-serve@7.1.2 matchedPath = lib/init-config.js matchedIdentity = npm:QG5lYnVsYS5qcy9jbGktc2VydmU:7.1.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/init-config.jsView on unpkg

lib/serve.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @nebula.js/cli-serve@7.2.0 matchedIdentity = npm:QG5lYnVsYS5qcy9jbGktc2VydmU:7.2.0 similarity = 0.430 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/serve.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/eRender.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/eRender.jsView on unpkg · L1

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/eRender.jsView on unpkg · L1

dist/6156.jsView file

Findings

4 High5 Medium8 Low

HighSame File Env Network Executiondist/eRender.js

HighSemantic Analysis Limiteddist/6567.js#virtual:normalized:round1

HighKnown Malware Source Similaritylib/init-config.js

HighPrevious Version Dangerous Deltalib/serve.js

MediumDynamic Requiredist/6156.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/5790.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/eRender.js

LowWeak Cryptolib/webpack.build.js

LowFilesystem

Affected versions and remediation

This report applies to @nebula.js/cli-serve@7.5.2.

See all versions of @nebula.js/cli-serve for other recorded verdicts.

Review the evidence and your use of @nebula.js/cli-serve@7.5.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-02 11:59:51.910Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @nebula.js

Behavioral surface

Related packages

More from @nebula.js

Source & flagged code