registry / @rangojs/router / 0.4.2

@rangojs/router@0.4.2

Django-inspired RSC router with composable URL patterns

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 565 file(s), 4.81 MB of source, external domains: api.cloudflare.com, build.invalid, github.com, rsc-cache.internal.com, rsc-dummy-host-1.com, www.w3.org

Source & flagged code

3 flagged

dist/bin/rango.jsView file

Lines 513-553javascript

513 }

514 const { resolved: includes, unresolvable } = extractIncludesWithDiagnostics(

515 block,

516 blockSourceFile

517 );

518 if (diagnosticsOut) {

519

Source & flagged code

3 flagged · loading source

dist/bin/rango.jsView file

1739package = @rangojs/router; repositoryIdentity = vite-rsc; dependency = @vitejs/plugin-rsc L1739: try { L1740: const rscMod = await import("@vitejs/plugin-rsc"); L1741: rsc = rscMod.default;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/bin/rango.jsView on unpkg · L1739

533sourceFile: filePath, L534: detail: `import("${inc.moduleSpecifier}") resolved to no file` L535: });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/rango.jsView on unpkg · L533

src/server/request-context.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @rangojs/router@0.4.1 matchedIdentity = npm:QHJhbmdvanMvcm91dGVy:0.4.1 similarity = 0.425 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/server/request-context.tsView on unpkg

Findings

2 High4 Medium6 Low

HighCopied Package Dependency Bridgedist/bin/rango.js

HighPrevious Version Dangerous Deltasrc/server/request-context.ts

MediumDynamic Requiredist/bin/rango.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Lines 1719-1759javascript

1719// src/build/runtime-discovery.ts

1720var runtime_discovery_exports = {};

1721__export(runtime_discovery_exports, {

1722 discoverAndWriteRouteTypes: () => discoverAndWriteRouteTypes

1723});

1724import { resolve as resolve3 } from "node:path";

1725import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";

1726async function discoverAndWriteRouteTypes(opts) {

1727 let createViteServer;

1728 let loadConfigFromFile;

1729 let rsc;

1730 try {

1731 const vite = await import("vite");

1732 createViteServer = vite.createServer;

1733 loadConfigFromFile = vite.loadConfigFromFile;

1734 } catch {

1735 throw new Error(

1736 "Runtime discovery requires 'vite'. Install it with: pnpm add -D vite"

1737 );

1738 }

1739 try {

1740 const rscMod = await import("@vitejs/plugin-rsc");

1741 rsc = rscMod.default;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/bin/rango.jsView on unpkg · L1739

1742 } catch {

1743 throw new Error(

1744 "Runtime discovery requires '@vitejs/plugin-rsc'. Install it with: pnpm add -D @vitejs/plugin-rsc"

1745 );

1746 }

1747 const { createVersionPlugin: createVersionPlugin2 } = await Promise.resolve().then(() => (init_version_plugin(), version_plugin_exports));

1748 const { createVirtualStubPlugin: createVirtualStubPlugin2 } = await Promise.resolve().then(() => (init_virtual_stub_plugin(), virtual_stub_plugin_exports));

1749 let userResolveAlias = opts.resolveAlias;

1750 if (!userResolveAlias) {

1751 const configPath = opts.configFile;

1752 try {

1753 const loaded = await loadConfigFromFile(

1754 { command: "serve", mode: "development" },

1755 configPath,

1756 opts.root

1757 );

1758 if (loaded?.config?.resolve?.alias) {

1759 userResolveAlias = loaded.config.resolve.alias;