registry / @stencil/dev-server / 5.0.0-alpha.25

@stencil/dev-server@5.0.0-alpha.25

Development server for Stencil with DOM-based HMR

Static Scan Results

scanned 8h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 105 KB of source, external domains: dev.stenciljs.com

Source & flagged code

5 flagged

dist/index.mjsView file

Lines 1-29javascript

1import * as path from "node:path";

2import * as http from "node:http";

3import * as https from "node:https";

Source & flagged code

5 flagged · loading source

dist/index.mjsView file

9import * as zlib from "node:zlib"; L10: import { fork } from "node:child_process"; L11: //#region src/server/utils.ts

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L9

1308let serverProcess = fork(path.join(import.meta.dirname, "worker-thread.js"), [], { L1309: execArgv: process.execArgv.filter((v) => !/^--(debug|inspect)/.test(v)), L1310: env: process.env,

High

Shell

Package source references shell execution.

dist/index.mjsView on unpkg · L1308

1297* Worker process proxy for dev server. L1298: * Forks a child process to run the HTTP and WebSocket server in isolation. L1299: */ ... L1307: function initServerProcessWorkerProxy(sendToMain) { L1308: let serverProcess = fork(path.join(import.meta.dirname, "worker-thread.js"), [], { L1309: execArgv: process.execArgv.filter((v) => !/^--(debug|inspect)/.test(v)), L1310: env: process.env, L1311: cwd: process.cwd(),

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.mjsView on unpkg · L1297

400package = @stencil/dev-server; repositoryIdentity = core; dependency = launch-editor L400: try { L401: const mod = await import("launch-editor"); L402: launchEditor = mod.default || mod;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.mjsView on unpkg · L400

392async function openInBrowser(opts) { L393: const { default: open } = await import("open"); L394: await open(opts.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L392

Findings

4 High4 Medium4 Low

HighChild Processdist/index.mjs

HighShelldist/index.mjs

HighSame File Env Network Executiondist/index.mjs

HighCopied Package Dependency Bridgedist/index.mjs

MediumDynamic Requiredist/index.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 372-420javascript

372 connectorHtml: null,

373 dirTemplate: null,

374 getBuildResults,

375 getCompilerRequest,

376 isServerListening: false,

377 logRequest,

378 prerenderConfig: null,

379 serve302,

380 serve404,

381 serve500,

382 sys

383 };

384 return serverCtx;

385}

386//#endregion

387//#region src/server/editor.ts

388/**

389* Editor integration using launch-editor.

390* Consolidated from open-in-browser.ts, open-in-editor.ts, and open-in-editor-api.ts.

391*/

392async function openInBrowser(opts) {

393 const { default: open } = await import("open");

394 await open(opts.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L392

395}

396let launchEditorLoaded = false;

397let launchEditor = null;

398async function loadLaunchEditor() {

399 if (launchEditorLoaded) return;

400 try {

401 const mod = await import("launch-editor");

402 launchEditor = mod.default || mod;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.mjsView on unpkg · L400

403 } catch {

404 console.warn("launch-editor package is not available. Open in editor functionality will be disabled.");

405 launchEditor = null;

406 }

407 launchEditorLoaded = true;

408}

409async function serveOpenInEditor(serverCtx, req, res) {

410 let status = 200;

411 const data = {};

412 try {

413 await parseEditorData(serverCtx.sys, req, data);

414 await openDataInEditor(data);

415 } catch (e) {

416 data.error = String(e);

417 status = 500;

418 }

419 serverCtx.logRequest(req, status);

420 res.writeHead(status, responseHeaders({ "content-type": "application/json; charset=utf-8" }));

Lines 1277-1328javascript

1277 buildResultsResolves.forEach((r) => r.resolve(msg.buildResults));

1278 buildResultsResolves.length = 0;

1279 }

1280 if (webSocket) webSocket.sendToBrowser(msg);

1281 }

1282 }

1283 } catch (e) {

1284 let stack = null;

1285 if (e instanceof Error) stack = e.stack ?? null;

1286 sendMsg({ error: {

1287 message: String(e),

1288 stack

1289 } });

1290 }

1291 };

1292 return receiveMessageFromMain;

1293}

1294//#endregion

1295//#region src/server/worker-main.ts

1296/**

1297* Worker process proxy for dev server.

1298* Forks a child process to run the HTTP and WebSocket server in isolation.

1299*/

1300/**

1301* Initialize the dev server in a forked worker process.

1302* This provides process isolation so that server crashes don't affect the main compiler.

1303*

1304* @param sendToMain - Callback to send messages from worker to main process

1305* @returns Function to send messages from main to worker process

1306*/

1307function initServerProcessWorkerProxy(sendToMain) {

1308 let serverProcess = fork(path.join(import.meta.dirname, "worker-thread.js"), [], {

1309 execArgv: process.execArgv.filter((v) => !/^--(debug|inspect)/.test(v)),

1310 env: process.env,

High

Shell

Package source references shell execution.

dist/index.mjsView on unpkg · L1308

1311 cwd: process.cwd(),

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.mjsView on unpkg · L1297

1312 stdio: [

1313 "pipe",

1314 "pipe",

1315 "pipe",

1316 "ipc"

1317 ]

1318 });

1319 /**

1320 * Send a message from main to the worker process

1321 *

1322 * @param msg - the message to send to the worker

1323 */

1324 const receiveFromMain = (msg) => {

1325 if (serverProcess && serverProcess.connected) serverProcess.send(msg);

1326 else if (msg.closeServer) sendToMain({ serverClosed: true });

1327 };

1328 serverProcess.on("message", (msg) => {