registry / @sigx/lynx-cli / 0.14.0

@sigx/lynx-cli@0.14.0

Lynx CLI plugin for sigx — config, prebuild, auto-linking

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 46 file(s), 531 KB of source, external domains: github.com, schemas.android.com, www.apple.com

Source & flagged code

8 flagged

dist/web-server.jsView file

Lines 1-40javascript

1/**

2 * `sigx run:web` — build a SignalX app for web and run it in the browser.

3 *

4 * The web peer of `run:android` / `run:ios`. Builds the web bundle

5 * (`rspeedy build --environment web`), then serves three things over one HTTP

6 * server with cross-origin-isolation headers:

7 * 1. a generated `<lynx-view>` host page (`/`),

8 * 2. the upstream `@lynx-js/web-core` browser engine — its prebuilt

9 * `client.prod.js` + wasm, served straight from `node_modules` (`/engine/static/*`),

Source & flagged code

8 flagged · loading source

dist/web-server.jsView file

20*/ L21: import { spawn } from 'node:child_process'; L22: import { createServer as createNetServer } from 'node:net';

High

Child Process

Package source references child process execution.

dist/web-server.jsView on unpkg · L20

168logger.log(`Building the web bundle${watchMode ? ' (watching for changes)' : ''}…`); L169: const buildChild = spawn('npx', buildArgs, { cwd, stdio: 'inherit', shell: true }); L170: let buildExit = null;

High

Shell

Package source references shell execution.

dist/web-server.jsView on unpkg · L168

dist/prebuild.jsView file

195if (foundPath.endsWith('.ts')) { L196: const esbuild = await import('esbuild'); L197: const source = readFileSync(foundPath, 'utf-8');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/prebuild.jsView on unpkg · L195

dist/dev-server.jsView file

730// Start rspeedy in its own process group so we can kill the whole tree L731: // on shutdown (npx spawns npm spawns node, and SIGTERM to the top doesn't L732: // propagate reliably otherwise). L733: // L734: // `shell: true` is avoided because the extra /bin/sh hop plus piped stdin L735: // causes Rspack's file watcher to stop firing (it works when rspeedy is

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/dev-server.jsView on unpkg · L730

templates/android/gradlew.batView file

•path = templates/android/gradlew.bat kind = build_helper sizeBytes = 2986 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/android/gradlew.batView on unpkg

templates/android/gradle/wrapper/gradle-wrapper.jarView file

•path = [redacted]-wrapper.jar kind = high_entropy_blob sizeBytes = 43583 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

templates/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = [redacted]-wrapper.jar kind = compressed_blob sizeBytes = 43583 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

templates/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = [redacted]-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 43583 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

templates/android/gradle/wrapper/gradle-wrapper.jarView on unpkg

Findings

4 High6 Medium5 Low

HighChild Processdist/web-server.js

HighShelldist/web-server.js

HighRuntime Package Installdist/dev-server.js

HighShips High Entropy Blobtemplates/android/gradle/wrapper/gradle-wrapper.jar

MediumDynamic Requiredist/prebuild.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/android/gradlew.bat

MediumShips Compressed Blobtemplates/android/gradle/wrapper/gradle-wrapper.jar

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiontemplates/android/gradle/wrapper/gradle-wrapper.jar

Lines 148-188javascript

148 const { cwd, logger } = ctx;

149 const watchMode = ctx.args.watch !== false;

150 const openBrowserFlag = ctx.args.open !== false;

151 const exposeHost = ctx.args.host === true;

152 const desiredPort = Number(ctx.args.port) || DEFAULT_PORT;

153 const distDir = join(cwd, 'dist');

154 const projectName = basename(cwd);

155 // Resolve the web-core engine (a CLI dependency) — served read-only from node_modules.

156 let engineStaticDir;

157 try {

158 const clientJs = createRequire(import.meta.url).resolve('@lynx-js/web-core/client.prod.js');

159 engineStaticDir = dirname(dirname(clientJs)); // …/client_prod/static/js/client.js → …/static

160 }

161 catch {

162 logger.error('Could not resolve @lynx-js/web-core — try reinstalling dependencies.');

163 process.exitCode = 1;

164 return;

165 }

166 // Build (watch or one-shot). stdio inherited so the user sees build output.

167 const buildArgs = ['rspeedy', 'build', '--environment', 'web', ...(watchMode ? ['--watch'] : [])];

168 logger.log(`Building the web bundle${watchMode ? ' (watching for changes)' : ''}…`);

169 const buildChild = spawn('npx', buildArgs, { cwd, stdio: 'inherit', shell: true });

170 let buildExit = null;

High

Shell

Package source references shell execution.

dist/web-server.jsView on unpkg · L168

171 buildChild.on('exit', (code) => {

172 buildExit = code ?? 0;

173 });

174 let bundleName;

175 try {

176 bundleName = await waitForBundle(distDir, 180000, () => buildExit);

177 }

178 catch (e) {

179 logger.error(`No \`*.web.bundle\` was produced: ${String(e)}`);

180 logger.error("Add `environments: { lynx: {}, web: {} }` to your lynx.config.ts, then retry.");

181 try {

182 buildChild.kill();

183 }

184 catch {

185 /* already gone */

186 }

187 process.exitCode = 1;

188 return;

dist/prebuild.jsView file

Lines 175-215javascript

175 foundPath = p;

176 break;

177 }

178 }

179 if (!foundPath) {

180 // Hard-cut migration: detect the legacy filename and tell the user exactly

181 // what to do. Without this, the generic "no config found" message would

182 // send them to docs instead of revealing that their file just needs renaming.

183 for (const legacy of ['sigx.lynx.config.ts', 'sigx.lynx.config.js', 'sigx.lynx.config.mjs']) {

184 if (existsSync(join(cwd, legacy))) {

185 const next = legacy.replace('sigx.lynx.config', 'signalx.config');

186 throw new Error(`Found legacy ${legacy} — rename to ${next}. ` +

187 'The sigx-lynx config moved to a framework-agnostic name; see CHANGELOG.');

188 }

189 }

190 throw new Error('No signalx.config found.\n' +

191 'Create signalx.config.ts in your project root:\n\n' +

192 ' import { defineLynxConfig } from "@sigx/lynx-cli/config";\n\n' +

193 ' export default defineLynxConfig({ name: "MyApp" });\n');

194 }

195 if (foundPath.endsWith('.ts')) {

196 const esbuild = await import('esbuild');

197 const source = readFileSync(foundPath, 'utf-8');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/prebuild.jsView on unpkg · L195

198 const result = await esbuild.transform(source, {

199 loader: 'ts',

200 format: 'esm',

201 });

202 const configDir = dirname(foundPath);

203 const tempFile = join(configDir, `.signalx-config-temp-${Date.now()}.mjs`);

204 writeFileSync(tempFile, result.code);

205 try {

206 const configModule = await import(pathToFileURL(tempFile).href);

207 return configModule.default || configModule;

208 }

209 finally {

210 try {

211 unlinkSync(tempFile);

212 }

213 catch {

214 // Ignore cleanup errors

215 }

dist/dev-server.jsView file

Lines 710-750javascript

710 devicectlAvailable: false,

711 };

712 if (!selectedTargets) {

713 try {

714 deviceStatus = getDeviceStatus(launchAppId, launchBundleId);

715 }

716 catch {

717 // Device detection is best-effort

718 }

719 }

720 // Build rspeedy args. Rspeedy's CLI has no `--port` flag, so we pass the

721 // port through `SIGX_LYNX_DEV_PORT` (read below in the spawn env) — the

722 // `@sigx/lynx-plugin`'s `modifyRsbuildConfig` hook overrides

723 // `server.port` from that env var. This keeps lynx-cli's `serverState.port`

724 // (used for the device-launch URL) in lockstep with the port rspeedy

725 // actually binds; if rsbuild still has to fall back (port already taken)

726 // the stdout-parsing path below catches it.

727 const args = ['rspeedy', 'dev'];

728 if (opts.host)

729 args.push('--host');

730 // Start rspeedy in its own process group so we can kill the whole tree

731 // on shutdown (npx spawns npm spawns node, and SIGTERM to the top doesn't

732 // propagate reliably otherwise).

733 //

734 // `shell: true` is avoided because the extra /bin/sh hop plus piped stdin

735 // causes Rspack's file watcher to stop firing (it works when rspeedy is

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/dev-server.jsView on unpkg · L730

736 // run directly but silently drops changes under shell+pipe). `ignore` for

737 // stdin also keeps rspeedy from treating us as interactive.

738 //

739 // File watching: @sigx/lynx-plugin ships narrow `watchOptions.ignored`

740 // (ios/android/Pods/dist/.rspeedy) via modifyRspackConfig so macOS

741 // FSEvents stops drowning in native-build churn. If that still misses

742 // events on an exotic layout, set `SIGX_LYNX_WATCH_POLL=250` to fall

743 // back to polling at the plugin level.

744 const child = spawn('npx', args, {

745 cwd,

746 stdio: ['ignore', 'pipe', 'pipe'],

747 shell: process.platform === 'win32',

748 detached: process.platform !== 'win32',

749 env: {

750 ...process.env,