@sverka/ui@0.2.35

⚠ Under review

Sverka UI — local web dashboard for viewing SARIF findings and run results

AI Security Review

scanned 1d ago · by lpm-firewall-ai

The inspected entrypoint shows a user-invoked local dashboard and no package install hook. Because it imports an unresolved runtime dependency, its behavior cannot be fully assessed; manual review is warranted.

Static reason

No blocking static signals were detected.

Trigger

A consumer invokes the exported startUiServer API.

Impact

No confirmed harmful behavior was established, but the unresolved dependency prevents clearing the package for publication.

Mechanism

The API starts an HTTP server, defaulting to localhost, and renders SARIF files from the supplied artifacts directory; report normalization uses the unresolved runtime dependency.

AI rationale

Evidence

package.jsondist/index.mjs

Network endpoints1

localhost

Decision evidence

public snapshot

AI called this Manual Review at 91.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest declares no install lifecycle hook; its scripts are limited to build, test, lint, and typecheck.
The manifest declares @sverka/verification as a runtime dependency, and the entrypoint imports normalizeSarif from it. That dependency’s implementation was unavailable in this snapshot, leaving its behavior unresolved.
The dashboard server is an exported API that defaults to localhost and serves reports from the caller-provided artifacts directory.

Evidence against

Behavioral surface

Source

CryptoFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 17.2 KB of source, external domains: sverka.dev

Source & flagged code

6 flagged

package.jsonView file

Lines 10-46json

10 "directory": "packages/ui"

11 },

12 "homepage": "https://sverka.dev",

13 "bugs": "https://github.com/sverka-dev/sverka/issues",

14 "publishConfig": {

15 "access": "public"

16 },

17 "type": "module",

18 "main": "./dist/index.mjs",

19 "module": "./dist/index.mjs",

20 "types": "./dist/index.d.mts",

21 "exports": {

22 ".": {

23 "types": "./dist/index.d.mts",

24 "import": "./dist/index.mjs"

25 }

26 },

27 "files": [

28 "dist"

29 ],

30 "scripts": {

31 "build": "tsdown",

32 "test": "vitest run --passWithNoTests",

33 "lint": "eslint src",

34 "typecheck": "tsc --noEmit"

35 },

36 "dependencies": {

Low

Suspicious Lifecycle Evidence

The manifest declares no install lifecycle hook; its scripts are limited to build, test, lint, and typecheck.

package.jsonView on unpkg · L30

37 "@sverka/verification": "^0.2.35",

38 "@sverka/sarif-viewer-web": "^0.2.35"

39 },

40 "devDependencies": {

41 "tsdown": "^0.23.1",

42 "typescript": "^5.8.0",

Low

Suspicious Dependency Evidence

The manifest declares @sverka/verification as a runtime dependency, and the entrypoint imports normalizeSarif from it. That dependency’s implementation was unavailable in this snapshot, leaving its behavior unresolved.

package.jsonView on unpkg · L36

43 "vitest": "^5.0.5"

44 }

45}

dist/index.mjsView file

Lines 1-21javascript

1import { createServer } from "node:http";

2import { createHash } from "node:crypto";

3import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";

4import { dirname, join, relative, resolve, sep } from "node:path";

Source & flagged code

6 flagged · loading source

package.jsonView file

30"scripts": { "build": "tsdown", "test": "vitest run --passWithNoTests", "lint": "eslint src", "typecheck": "tsc --noEmit" }, "dependencies":

Low

Suspicious Lifecycle Evidence

The manifest declares no install lifecycle hook; its scripts are limited to build, test, lint, and typecheck.

package.jsonView on unpkg · L30

36"dependencies": { "@sverka/verification": "^0.2.35", "@sverka/sarif-viewer-web": "^0.2.35" }, "devDependencies": { "tsdown": "^0.23.1", "typescript": "^5.8.0",

Low

Suspicious Dependency Evidence

package.jsonView on unpkg · L36

dist/index.mjsView file

1import { createServer } from "node:http"; import { createHash } from "node:crypto"; import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs"; import

Findings

1 Medium9 Low

MediumNetwork

LowScripts Present

LowFilesystem

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Dependency Evidencepackage.json

LowSuspicious Dependency Evidencedist/index.mjs

LowAi Review Evidencedist/index.mjs

Affected versions and remediation

This report applies to @sverka/ui@0.2.35.

See all versions of @sverka/ui for other recorded verdicts.

Review the evidence and your use of @sverka/ui@0.2.35 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 20:30:09.541Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.