registry / @sigx/lynx-cli / 0.14.0

@sigx/lynx-cli@0.14.0

Lynx CLI plugin for sigx — config, prebuild, auto-linking

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 46 file(s), 531 KB of source, external domains: github.com, schemas.android.com, www.apple.com

Source & flagged code

8 flagged

dist/web-server.jsView file

Lines 1-40javascript

1/**

2 * `sigx run:web` — build a SignalX app for web and run it in the browser.

3 *

4 * The web peer of `run:android` / `run:ios`. Builds the web bundle

5 * (`rspeedy build --environment web`), then serves three things over one HTTP

6 * server with cross-origin-isolation headers:

7 * 1. a generated `<lynx-view>` host page (`/`),

8 * 2. the upstream `@lynx-js/web-core` browser engine — its prebuilt

9 * `client.prod.js` + wasm, served straight from `node_modules` (`/engine/static/*`),

10 * 3. the app's own `dist/` bundle (`/app/*`).

11 * web-core needs COOP/COEP cross-origin isolation (SharedArrayBuffer) and

12 * `application/wasm` MIME — both set here. localhost is a secure context so

13 * isolation works; a plain-http LAN address (`--host`) is not, so SAB-dependent

14 * features may degrade there.

15 *

16 * Live reload: bundler HMR/live-reload are gated off for web (see

17 * `lynx-plugin/entry.ts`, matching upstream), so this runs its own loop —

18 * `rspeedy build --watch` rewrites the bundle, an fs.watch picks it up, and a

19 * WebSocket tells the page to `location.reload()`. (Full reload, not hot-swap.)

20 */

21import { spawn } from 'node:child_process';

22import { createServer as createNetServer } from 'node:net';

High

Child Process

Package source references child process execution.

dist/web-server.jsView on unpkg · L20

23import { createServer } from 'node:http';

24import { readFile } from 'node:fs/promises';

25import { existsSync, readdirSync, statSync, watch } from 'node:fs';

26import { basename, dirname, extname, isAbsolute, join, normalize, relative } from 'node:path';

27import { createRequire } from 'node:module';

28import { WebSocketServer } from 'ws';

29import { getAllLanIPs } from './network.js';

30const RELOAD_PATH = '/__sigx_reload';

31const DEFAULT_PORT = 8900;

32const MIME = {

33 '.html': 'text/html; charset=utf-8',

34 '.js': 'text/javascript; charset=utf-8',

35 '.mjs': 'text/javascript; charset=utf-8',

36 '.css': 'text/css; charset=utf-8',

37 '.json': 'application/json; charset=utf-8',

38 '.bundle': 'application/json; charset=utf-8',

39 '.wasm': 'application/wasm',

40 '.map': 'application/json; charset=utf-8',

Lines 148-188javascript

148 const { cwd, logger } = ctx;

149 const watchMode = ctx.args.watch !== false;

150 const openBrowserFlag = ctx.args.open !== false;

151 const exposeHost = ctx.args.host ===

dist/prebuild.jsView file

Lines 175-215javascript

175 foundPath = p;

176 break;

177 }

178 }

179 if (!foundPath) {

180 // Hard-cut migration: detect the legacy filename and tell the user exactly

181 // what to do. Without this, the generic "no config found" message would

182 // send them to docs instead of revealing that their file just needs renaming.

183

dist/dev-server.jsView file

Lines 710-750javascript

710 devicectlAvailable: false,

711 };

712 if (!selectedTargets) {

713 try {

714 deviceStatus = getDeviceStatus(launchAppId, launchBundleId);

715 }

716 catch {

717

templates/android/gradlew.batView file

•path = templates/android/gradlew.bat kind = build_helper sizeBytes = 2986 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/android/gradlew.batView on unpkg

templates/android/gradle/wrapper/gradle-wrapper.jarView file

•path = [redacted]-wrapper.jar kind = high_entropy_blob sizeBytes = 43583 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

templates/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = [redacted]-wrapper.jar kind = compressed_blob sizeBytes = 43583 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

templates/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = [redacted]-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 43583 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

templates/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

Source & flagged code

8 flagged · loading source

dist/web-server.jsView file

20*/ L21: import { spawn } from 'node:child_process'; L22: import { createServer as createNetServer } from 'node:net';

High

Child Process

Package source references child process execution.

dist/web-server.jsView on unpkg · L20

168logger.log(`Building the web bundle${watchMode ? ' (watching for changes)' : ''}…`); L169: const buildChild = spawn('npx', buildArgs, { cwd, stdio: 'inherit', shell: true }); L170: let buildExit = null;

High

Shell

Package source references shell execution.

dist/web-server.jsView on unpkg · L168

dist/prebuild.jsView file

195if (foundPath.endsWith('.ts')) { L196: const esbuild = await import('esbuild'); L197: const source = readFileSync(foundPath, 'utf-8');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/prebuild.jsView on unpkg · L195

dist/dev-server.jsView file

730// Start rspeedy in its own process group so we can kill the whole tree L731: // on shutdown (npx spawns npm spawns node, and SIGTERM to the top doesn't L732: // propagate reliably otherwise). L733: // L734: // `shell: true` is avoided because the extra /bin/sh hop plus piped stdin L735: // causes Rspack's file watcher to stop firing (it works when rspeedy is

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/dev-server.jsView on unpkg · L730

templates/android/gradlew.batView file

•path = templates/android/gradlew.bat kind = build_helper sizeBytes = 2986 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/android/gradlew.batView on unpkg

templates/android/gradle/wrapper/gradle-wrapper.jarView file

•path = [redacted]-wrapper.jar kind = high_entropy_blob sizeBytes = 43583 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

templates/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = [redacted]-wrapper.jar kind = compressed_blob sizeBytes = 43583 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

templates/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = [redacted]-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 43583 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

templates/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

Findings

4 High6 Medium5 Low

HighChild Processdist/web-server.js

HighShelldist/web-server.js

HighRuntime Package Installdist/dev-server.js

HighShips High Entropy Blobtemplates/android/gradle/wrapper/gradle-wrapper.jar

MediumDynamic Requiredist/prebuild.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/android/gradlew.bat

MediumShips Compressed Blobtemplates/android/gradle/wrapper/gradle-wrapper.jar

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiontemplates/android/gradle/wrapper/gradle-wrapper.jar

Source & flagged code

8 flagged

dist/web-server.jsView file

Lines 1-40javascript

1/**

2 * `sigx run:web` — build a SignalX app for web and run it in the browser.

3 *

4 * The web peer of `run:android` / `run:ios`. Builds the web bundle

5 * (`rspeedy build --environment web`), then serves three things over one HTTP

6 * server with cross-origin-isolation headers:

7 * 1. a generated `<lynx-view>` host page (`/`),

8 * 2. the upstream `@lynx-js/web-core` browser engine — its prebuilt

9 * `client.prod.js` + wasm, served straight from `node_modules` (`/engine/static/*`),

10 * 3. the app's own `dist/` bundle (`/app/*`).

11 * web-core needs COOP/COEP cross-origin isolation (SharedArrayBuffer) and

12 * `application/wasm` MIME — both set here. localhost is a secure context so

13 * isolation works; a plain-http LAN address (`--host`) is not, so SAB-dependent

14 * features may degrade there.

15 *

16 * Live reload: bundler HMR/live-reload are gated off for web (see

17 * `lynx-plugin/entry.ts`, matching upstream), so this runs its own loop —

18 * `rspeedy build --watch` rewrites the bundle, an fs.watch picks it up, and a

19 * WebSocket tells the page to `location.reload()`. (Full reload, not hot-swap.)

20 */

21import { spawn } from 'node:child_process';

22import { createServer as createNetServer } from 'node:net';

High

Child Process

Package source references child process execution.

dist/web-server.jsView on unpkg · L20

23import { createServer } from 'node:http';

24import { readFile } from 'node:fs/promises';

25import { existsSync, readdirSync, statSync, watch } from 'node:fs';

26import { basename, dirname, extname, isAbsolute, join, normalize, relative } from 'node:path';

27import { createRequire } from 'node:module';

28import { WebSocketServer } from 'ws';

29import { getAllLanIPs } from './network.js';

30const RELOAD_PATH = '/__sigx_reload';

31const DEFAULT_PORT = 8900;

32const MIME = {

33 '.html': 'text/html; charset=utf-8',

34 '.js': 'text/javascript; charset=utf-8',

35 '.mjs': 'text/javascript; charset=utf-8',

36 '.css': 'text/css; charset=utf-8',

37 '.json': 'application/json; charset=utf-8',

38 '.bundle': 'application/json; charset=utf-8',

39 '.wasm': 'application/wasm',

40 '.map': 'application/json; charset=utf-8',

Lines 148-188javascript

148 const { cwd, logger } = ctx;

149 const watchMode = ctx.args.watch !== false;

150 const openBrowserFlag = ctx.args.open !== false;

151 const exposeHost = ctx.args.host ===

dist/prebuild.jsView file

Lines 175-215javascript

175 foundPath = p;

176 break;

177 }

178 }

179 if (!foundPath) {

180 // Hard-cut migration: detect the legacy filename and tell the user exactly

181 // what to do. Without this, the generic "no config found" message would

182 // send them to docs instead of revealing that their file just needs renaming.

183

dist/dev-server.jsView file

Lines 710-750javascript

710 devicectlAvailable: false,

711 };

712 if (!selectedTargets) {

713 try {

714 deviceStatus = getDeviceStatus(launchAppId, launchBundleId);

715 }

716 catch {

717

templates/android/gradlew.batView file

•path = templates/android/gradlew.bat kind = build_helper sizeBytes = 2986 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/android/gradlew.batView on unpkg

templates/android/gradle/wrapper/gradle-wrapper.jarView file

•path = [redacted]-wrapper.jar kind = high_entropy_blob sizeBytes = 43583 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

templates/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = [redacted]-wrapper.jar kind = compressed_blob sizeBytes = 43583 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

templates/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = [redacted]-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 43583 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

templates/android/gradle/wrapper/gradle-wrapper.jarView on unpkg