@sverka/ui@0.2.29

Sverka UI — local web dashboard for viewing SARIF findings and run results

AI Security Review

scanned 1d ago · by lpm-firewall-ai

Inspected the manifest, UI entrypoint, and both prepared dependency manifests and entrypoints. They show no lifecycle execution or malicious behavior; the network-related code is an explicitly invoked local dashboard server.

Static reason

No blocking static signals were detected.

Trigger

A caller invokes the exported startUiServer function.

Impact

No confirmed attack impact; the inspected code serves local reports and contains no identified credential transfer or external network request.

Mechanism

The function listens on the configured host and port, serves dashboard and report routes, and reads reports from the configured artifacts directory after filename and resolved-path checks.

AI rationale

Network endpoints1

localhost

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package manifest defines build, test, lint, and typecheck scripts, with no lifecycle hook.
The UI entrypoint exports a callable local dashboard server and rendering helpers; no server starts merely by importing the module.
Report requests reject traversal-shaped filenames before reading files, and the server renders SARIF artifacts from the configured directory.
The prepared dependencies expose ordinary normalization and HTML rendering functions; their manifests show no lifecycle hooks.

Evidence against

Behavioral surface

Source

CryptoFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 17.1 KB of source, external domains: sverka.dev

Source & flagged code

8 flagged

package.jsonView file

Lines 10-46json

10 "directory": "packages/ui"

11 },

12 "homepage": "https://sverka.dev",

13 "bugs": "https://github.com/sverka-dev/sverka/issues",

14 "publishConfig": {

15 "access": "public"

16 },

17 "type": "module",

18 "main": "./dist/index.mjs",

19 "module": "./dist/index.mjs",

20 "types": "./dist/index.d.mts",

21 "exports": {

22 ".": {

23 "types": "./dist/index.d.mts",

24 "import": "./dist/index.mjs"

25 }

26 },

27 "files": [

28 "dist"

29 ],

30 "scripts": {

31 "build": "tsdown",

32 "test": "vitest run --passWithNoTests",

33 "lint": "eslint src",

34 "typecheck": "tsc --noEmit"

35 },

36 "dependencies": {

37 "@sverka/verification": "^0.2.29",

Low

Suspicious Lifecycle Evidence

The package manifest defines build, test, lint, and typecheck scripts, with no lifecycle hook.

package.jsonView on unpkg · L30

38 "@sverka/sarif-viewer-web": "^0.2.29"

39 },

40 "devDependencies": {

41 "tsdown": "^0.23.1",

42 "typescript": "^5.8.0",

43 "vitest": "^5.0.5"

44 }

45}

.lpm-dependency-evidence-29396d8e-3b39-47bd-8524-28b29a08603b/0/npm-linux/package.jsonView file

30"scripts": { "build": "tsdown", "test": "vitest run --passWithNoTests", "lint": "eslint src", "typecheck": "tsc --noEmit" }, "dependencies": { "@sverka/work

Low

Suspicious Lifecycle Evidence

The prepared dependencies expose ordinary normalization and HTML rendering functions; their manifests show no lifecycle hooks.

.lpm-dependency-evidence-29396d8e-3b39-47bd-8524-28b29a08603b/0/npm-linux/package.jsonView on unpkg · L30

.lpm-dependency-evidence-29396d8e-3b39-47bd-8524-28b29a08603b/0/npm-linux/dist/index.mjsView file

221const DEFAULT_NORMALIZE_CONTEXT = { root: process.cwd(), checkIdPrefix: "", defaultConfidence: .5 }; /** * Resolve SARIF input into a `Finding[]`. Exactly one of `sarif`, `sarif

Low

Suspicious Lifecycle Evidence

The prepared dependencies expose ordinary normalization and HTML rendering functions; their manifests show no lifecycle hooks.

.lpm-dependency-evidence-29396d8e-3b39-47bd-8524-28b29a08603b/0/npm-linux/dist/index.mjsView on unpkg · L221

.lpm-dependency-evidence-29396d8e-3b39-47bd-8524-28b29a08603b/1/npm-linux/package.jsonView file

37"scripts": { "build": "tsdown", "test": "vitest run --passWithNoTests", "lint": "eslint src", "typecheck": "tsc --noEmit" }, "dependencies": { "@sverka/veri

Low

Suspicious Lifecycle Evidence

The prepared dependencies expose ordinary normalization and HTML rendering functions; their manifests show no lifecycle hooks.

.lpm-dependency-evidence-29396d8e-3b39-47bd-8524-28b29a08603b/1/npm-linux/package.jsonView on unpkg · L37

.lpm-dependency-evidence-29396d8e-3b39-47bd-8524-28b29a08603b/1/npm-linux/dist/index.mjsView file

13function renderSarifWeb(options) { const findings = resolveFindings(options); const html = generateSarifHtml(findings); mkdirSync(dirname(options.outputPath), { recursive: true

Low

Suspicious Lifecycle Evidence

The prepared dependencies expose ordinary normalization and HTML rendering functions; their manifests show no lifecycle hooks.

.lpm-dependency-evidence-29396d8e-3b39-47bd-8524-28b29a08603b/1/npm-linux/dist/index.mjsView on unpkg · L13

dist/index.mjsView file

Lines 164-204javascript

164const HTML_HEADERS = {

165 "content-type": "text/html; charset=utf-8",

166 "content-security-policy": "default-src 'self'; script-src 'none'; style-src 'unsafe-inline'",

167 "x-content-type-options": "nosniff"

168};

Source & flagged code

8 flagged · loading source

package.jsonView file

30"scripts": { "build": "tsdown", "test": "vitest run --passWithNoTests", "lint": "eslint src", "typecheck": "tsc --noEmit" }, "dependencies": { "@sverka/veri

Low

Suspicious Lifecycle Evidence

The package manifest defines build, test, lint, and typecheck scripts, with no lifecycle hook.

package.jsonView on unpkg · L30

.lpm-dependency-evidence-29396d8e-3b39-47bd-8524-28b29a08603b/0/npm-linux/package.jsonView file

30"scripts": { "build": "tsdown", "test": "vitest run --passWithNoTests", "lint": "eslint src", "typecheck": "tsc --noEmit" }, "dependencies": { "@sverka/work

Low

Suspicious Lifecycle Evidence

The prepared dependencies expose ordinary normalization and HTML rendering functions; their manifests show no lifecycle hooks.

.lpm-dependency-evidence-29396d8e-3b39-47bd-8524-28b29a08603b/0/npm-linux/package.jsonView on unpkg · L30

Findings

1 Medium11 Low

MediumNetwork

LowScripts Present

LowFilesystem

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-29396d8e-3b39-47bd-8524-28b29a08603b/0/npm-linux/package.json

LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-29396d8e-3b39-47bd-8524-28b29a08603b/0/npm-linux/dist/index.mjs

LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-29396d8e-3b39-47bd-8524-28b29a08603b/1/npm-linux/package.json

LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-29396d8e-3b39-47bd-8524-28b29a08603b/1/npm-linux/dist/index.mjs

LowAi Review Evidencedist/index.mjs

Low

Affected versions and remediation

This report applies to @sverka/ui@0.2.29.

See all versions of @sverka/ui for other recorded verdicts.

Review the evidence and your use of @sverka/ui@0.2.29 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 15:26:41.096Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.