registry / @sigx/lynx-cli / 0.13.0

@sigx/lynx-cli@0.13.0

Lynx CLI plugin for sigx — config, prebuild, auto-linking

AI Security Review

scanned 20h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Process execution, project-file generation, package installation, and local HTTP/WebSocket serving are explicit CLI development actions.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `sigx` Lynx build, prebuild, device, package, or web-server commands.

Impact

No unconsented install-time execution, credential exfiltration, remote payload loading, persistence, or destructive behavior was found.

Mechanism

Explicit mobile-project scaffolding, builds, and local development serving.

Rationale

Static hints identify normal CLI primitives, but source inspection shows they are command-scoped development functionality. No concrete malicious chain or lifecycle-triggered behavior is present.

Evidence

package.jsondist/index.jsdist/plugin.jsdist/prebuild.jsdist/packages.jsdist/web-server.jsdist/dev-server.jstemplates/android/gradle/wrapper/gradle-wrapper.properties

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/plugin.js` invokes build/device commands only through explicit CLI subcommands.
`dist/prebuild.js` imports and executes the project's `signalx.config.*` during explicit prebuild.

Evidence against

`package.json` has no preinstall, install, postinstall, or prepare hook.
`dist/index.js` is an export entrypoint; no install-time execution path was found.
`dist/web-server.js` serves local project assets and binds loopback unless `--host` is explicitly requested.
`dist/packages.js` limits its package-manager add flow to user-requested `@sigx/lynx-*` modules.
`dist/device-detect.js` reads Android/JDK environment paths for local tooling, not credentials.
The bundled Gradle JAR is paired with standard wrapper metadata in `templates/android/gradle/wrapper/gradle-wrapper.properties`.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 46 file(s), 531 KB of source, external domains: github.com, schemas.android.com, www.apple.com

Source & flagged code

9 flagged

dist/web-server.jsView file

Lines 1-40javascript

1/**

2 * `sigx run:web` — build a SignalX app for web and run it in the browser.

3 *

4 * The web peer of `run:android` / `run:ios`. Builds the web bundle

5 * (`rspeedy build --environment web`), then serves three things over one HTTP

6 * server with cross-origin-isolation headers:

7 * 1. a generated `<lynx-view>` host page (`/`),

8 * 2. the upstream `@lynx-js/web-core` browser engine — its prebuilt

9 * `client.prod.js` + wasm, served straight from `node_modules` (`/engine/static/*`),

10 * 3. the app's own `dist/` bundle (`/app/*`).

11 * web-core needs COOP/COEP cross-origin isolation (SharedArrayBuffer) and

12 * `application/wasm` MIME — both set here. localhost is a secure context so

13 * isolation works; a plain-http LAN address (`--host`) is not, so SAB-dependent

14 * features may degrade there.

15 *

16 * Live reload: bundler HMR/live-reload are gated off for web (see

17 * `lynx-plugin/entry.ts`, matching upstream), so this runs its own loop —

18 * `rspeedy build --watch` rewrites the bundle, an fs.watch picks it up, and a

19 * WebSocket tells the page to `location.reload()`. (Full reload, not hot-swap.)

20 */

21import { spawn } from 'node:child_process';

22import { createServer as createNetServer } from 'node:net';

High

Child Process

Package source references child process execution.

dist/web-server.jsView on unpkg · L20

23import { createServer } from 'node:http';

24import { readFile } from 'node:fs/promises';

25import { existsSync, readdirSync, statSync, watch } from 'node:fs';

26import { basename, dirname, extname, isAbsolute, join, normalize, relative } from 'node:path';

27import { createRequire } from 'node:module';

28import { WebSocketServer } from 'ws';

29import { getAllLanIPs } from './network.js';

30const RELOAD_PATH = '/__sigx_reload';

31const DEFAULT_PORT = 8900;

32const MIME = {

33 '.html': 'text/html; charset=utf-8',

34 '.js': 'text/javascript; charset=utf-8',

35 '.mjs': 'text/javascript; charset=utf-8',

36 '.css': 'text/css; charset=utf-8',

37 '.json': 'application/json; charset=utf-8',

38 '.bundle': 'application/json; charset=utf-8',

39 '.wasm': 'application/wasm',

40 '.map': 'application/json; charset=utf-8',

Lines 148-188javascript

148 const { cwd, logger } = ctx;

149 const watchMode = ctx.args.watch !== false;

150 const openBrowserFlag = ctx.args.open !== false;

151 const exposeHost = ctx.args.host ===

dist/prebuild.jsView file

Lines 175-215javascript

175 foundPath = p;

176 break;

177 }

178 }

179 if (!foundPath) {

180 // Hard-cut migration: detect the legacy filename and tell the user exactly

181 // what to do. Without this, the generic "no config found" message would

182 // send them to docs instead of revealing that their file just needs renaming.

183

dist/dev-server.jsView file

Lines 710-750javascript

710 devicectlAvailable: false,

711 };

712 if (!selectedTargets) {

713 try {

714 deviceStatus = getDeviceStatus(launchAppId, launchBundleId);

715 }

716 catch {

717

templates/android/gradlew.batView file

•path = templates/android/gradlew.bat kind = build_helper sizeBytes = 2986 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/android/gradlew.batView on unpkg

templates/android/gradle/wrapper/gradle-wrapper.jarView file

•path = [redacted]-wrapper.jar kind = high_entropy_blob sizeBytes = 43583 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

templates/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = [redacted]-wrapper.jar kind = compressed_blob sizeBytes = 43583 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

templates/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = [redacted]-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 43583 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

templates/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

Source & flagged code

9 flagged · loading source

dist/web-server.jsView file

20*/ L21: import { spawn } from 'node:child_process'; L22: import { createServer as createNetServer } from 'node:net';

High

Child Process

Package source references child process execution.

dist/web-server.jsView on unpkg · L20

168logger.log(`Building the web bundle${watchMode ? ' (watching for changes)' : ''}…`); L169: const buildChild = spawn('npx', buildArgs, { cwd, stdio: 'inherit', shell: true }); L170: let buildExit = null;

High

Shell

Package source references shell execution.

dist/web-server.jsView on unpkg · L168

dist/prebuild.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @sigx/lynx-cli@0.12.2 matchedIdentity = npm:QHNpZ3gvbHlueC1jbGk:0.12.2 similarity = 0.911 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/prebuild.jsView on unpkg

195if (foundPath.endsWith('.ts')) { L196: const esbuild = await import('esbuild'); L197: const source = readFileSync(foundPath, 'utf-8');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/prebuild.jsView on unpkg · L195

dist/dev-server.jsView file

730// Start rspeedy in its own process group so we can kill the whole tree L731: // on shutdown (npx spawns npm spawns node, and SIGTERM to the top doesn't L732: // propagate reliably otherwise). L733: // L734: // `shell: true` is avoided because the extra /bin/sh hop plus piped stdin L735: // causes Rspack's file watcher to stop firing (it works when rspeedy is

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/dev-server.jsView on unpkg · L730

templates/android/gradlew.batView file

•path = templates/android/gradlew.bat kind = build_helper sizeBytes = 2986 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/android/gradlew.batView on unpkg

templates/android/gradle/wrapper/gradle-wrapper.jarView file

•path = [redacted]-wrapper.jar kind = high_entropy_blob sizeBytes = 43583 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

templates/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = [redacted]-wrapper.jar kind = compressed_blob sizeBytes = 43583 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

templates/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = [redacted]-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 43583 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

templates/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

Findings

1 Critical4 High6 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/prebuild.js

HighChild Processdist/web-server.js

HighShelldist/web-server.js

HighRuntime Package Installdist/dev-server.js

HighShips High Entropy Blobtemplates/android/gradle/wrapper/gradle-wrapper.jar

MediumDynamic Requiredist/prebuild.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/android/gradlew.bat

MediumShips Compressed Blobtemplates/android/gradle/wrapper/gradle-wrapper.jar

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiontemplates/android/gradle/wrapper/gradle-wrapper.jar

Source & flagged code

9 flagged

dist/web-server.jsView file

Lines 1-40javascript

1/**

2 * `sigx run:web` — build a SignalX app for web and run it in the browser.

3 *

4 * The web peer of `run:android` / `run:ios`. Builds the web bundle

5 * (`rspeedy build --environment web`), then serves three things over one HTTP

6 * server with cross-origin-isolation headers:

7 * 1. a generated `<lynx-view>` host page (`/`),

8 * 2. the upstream `@lynx-js/web-core` browser engine — its prebuilt

9 * `client.prod.js` + wasm, served straight from `node_modules` (`/engine/static/*`),

10 * 3. the app's own `dist/` bundle (`/app/*`).

11 * web-core needs COOP/COEP cross-origin isolation (SharedArrayBuffer) and

12 * `application/wasm` MIME — both set here. localhost is a secure context so

13 * isolation works; a plain-http LAN address (`--host`) is not, so SAB-dependent

14 * features may degrade there.

15 *

16 * Live reload: bundler HMR/live-reload are gated off for web (see

17 * `lynx-plugin/entry.ts`, matching upstream), so this runs its own loop —

18 * `rspeedy build --watch` rewrites the bundle, an fs.watch picks it up, and a

19 * WebSocket tells the page to `location.reload()`. (Full reload, not hot-swap.)

20 */

21import { spawn } from 'node:child_process';

22import { createServer as createNetServer } from 'node:net';

High

Child Process

Package source references child process execution.

dist/web-server.jsView on unpkg · L20

23import { createServer } from 'node:http';

24import { readFile } from 'node:fs/promises';

25import { existsSync, readdirSync, statSync, watch } from 'node:fs';

26import { basename, dirname, extname, isAbsolute, join, normalize, relative } from 'node:path';

27import { createRequire } from 'node:module';

28import { WebSocketServer } from 'ws';

29import { getAllLanIPs } from './network.js';

30const RELOAD_PATH = '/__sigx_reload';

31const DEFAULT_PORT = 8900;

32const MIME = {

33 '.html': 'text/html; charset=utf-8',

34 '.js': 'text/javascript; charset=utf-8',

35 '.mjs': 'text/javascript; charset=utf-8',

36 '.css': 'text/css; charset=utf-8',

37 '.json': 'application/json; charset=utf-8',

38 '.bundle': 'application/json; charset=utf-8',

39 '.wasm': 'application/wasm',

40 '.map': 'application/json; charset=utf-8',

Lines 148-188javascript

148 const { cwd, logger } = ctx;

149 const watchMode = ctx.args.watch !== false;

150 const openBrowserFlag = ctx.args.open !== false;

151 const exposeHost = ctx.args.host ===

dist/prebuild.jsView file

Lines 175-215javascript

175 foundPath = p;

176 break;

177 }

178 }

179 if (!foundPath) {

180 // Hard-cut migration: detect the legacy filename and tell the user exactly

181 // what to do. Without this, the generic "no config found" message would

182 // send them to docs instead of revealing that their file just needs renaming.

183

dist/dev-server.jsView file

Lines 710-750javascript

710 devicectlAvailable: false,

711 };

712 if (!selectedTargets) {

713 try {

714 deviceStatus = getDeviceStatus(launchAppId, launchBundleId);

715 }

716 catch {

717

templates/android/gradlew.batView file

•path = templates/android/gradlew.bat kind = build_helper sizeBytes = 2986 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/android/gradlew.batView on unpkg

templates/android/gradle/wrapper/gradle-wrapper.jarView file

•path = [redacted]-wrapper.jar kind = high_entropy_blob sizeBytes = 43583 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

templates/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = [redacted]-wrapper.jar kind = compressed_blob sizeBytes = 43583 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

templates/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = [redacted]-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 43583 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

templates/android/gradle/wrapper/gradle-wrapper.jarView on unpkg