registry / @sverka/ui / 0.2.33
@sverka/ui@0.2.33
⚠ Under reviewSverka UI — local web dashboard for viewing SARIF findings and run results
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package source shows a SARIF dashboard and no confirmed attack behavior. Its report path relies on two runtime dependencies whose source could not be reviewed, so manual review is warranted.
Static reason
No blocking static signals were detected.
Trigger
A consumer imports the package and invokes the exported dashboard functionality to render a report.
Impact
The dependencies' behavior cannot be assessed from the inspected source, so a clean verdict is not established.
Mechanism
The report handler sends parsed SARIF through dependency-provided normalization and HTML-rendering functions; their source is unavailable in this package snapshot.
AI rationale
The package source shows a SARIF dashboard and no confirmed attack behavior. Its report path relies on two runtime dependencies whose source could not be reviewed, so manual review is warranted.
Evidence
package.jsondist/index.mjs
Decision evidence
public snapshotAI called this Manual Review at 68.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares two runtime dependencies.
- The shipped module imports a SARIF normalizer and HTML renderer from those dependencies.
- The report handler passes parsed SARIF data through both imported functions.
Evidence against
- No concrete attack behavior was identified in the inspected package source.
Behavioral surface
CryptoFilesystemNetwork
UrlStrings
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
36"dependencies": {
"@sverka/verification": "^0.2.33",
"@sverka/sarif-viewer-web": "^0.2.33"
},
"devDependencies"
Low
Suspicious Dependency Evidence
The manifest declares two runtime dependencies.
package.jsonView on unpkg · L36dist/index.mjsView file
1import { createServer } from "node:http";
import { createHash } from "node:crypto";
import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
import { dirname, join, relative, resolve, sep } from "node:path";
import { normalizeSarif } from "@sverka/verification";
import { generateSarifHtml } from "@sverka/sarif-viewer
Low
Suspicious Dependency Evidence
The shipped module imports a SARIF normalizer and HTML renderer from those dependencies.
dist/index.mjsView on unpkg · L1266const findings = normalizeSarif(sarif, {
root: artifactsDir,
checkIdPrefix,
defaultConfidence: .5
});
const html = generateSarifHtml(findings);
res.writeHead(200, reportHeaders(html));
res.end(html);
} catch (e) {
res.write
Findings
1 Medium6 Low
MediumNetwork
LowScripts Present
LowFilesystem
LowUrl Strings
LowSuspicious Dependency Evidencepackage.json
LowSuspicious Dependency Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
Affected versions and remediation
This report applies to @sverka/ui@0.2.33.
See all versions of @sverka/ui for other recorded verdicts.
- Review the evidence and your use of @sverka/ui@0.2.33 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.