registry  /  @rangojs/router  /  0.4.1

@rangojs/router@0.4.1

Django-inspired RSC router with composable URL patterns

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsTelemetryUrlStrings
ManifestNo manifest risk signals triggered.
scanned 413 file(s), 3.82 MB of source, external domains: api.cloudflare.com, build.invalid, github.com, rsc-dummy-host-1.com, www.w3.org

Source & flagged code

3 flagged · loading source
dist/bin/rango.jsView file
1739package = @rangojs/router; repositoryIdentity = vite-rsc; dependency = @vitejs/plugin-rsc L1739: try { L1740: const rscMod = await import("@vitejs/plugin-rsc"); L1741: rsc = rscMod.default;
High
Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/bin/rango.jsView on unpkg · L1739
533sourceFile: filePath, L534: detail: `import("${inc.moduleSpecifier}") resolved to no file` L535: });
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/rango.jsView on unpkg · L533
src/server/request-context.tsView file
•matchType = previous_version_dangerous_delta matchedPackage = @rangojs/router@0.2.0 matchedIdentity = npm:QHJhbmdvanMvcm91dGVy:0.2.0 similarity = 0.783 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/server/request-context.tsView on unpkg

Findings

2 High4 Medium6 Low
HighCopied Package Dependency Bridgedist/bin/rango.js
HighPrevious Version Dangerous Deltasrc/server/request-context.ts
MediumDynamic Requiredist/bin/rango.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings