registry / Malware / @sverka/ui / 0.2.36

@sverka/ui@0.2.36

Sverka UI — local web dashboard for viewing SARIF findings and run results

AI Security Review

scanned 1d ago · by lpm-firewall-ai

The package exposes the affected bundle as its main entrypoint, and that bundle contains text aimed at dismissing a reviewer alert. This supports blocking for reviewer manipulation.

Static reason

No blocking static signals were detected.

Trigger

A reviewer inspecting the published entrypoint encounters the comment.

Impact

It may suppress security findings during package review.

Mechanism

The comment asserts that an alert is dismissed, directing the reviewer to disregard it.

Attack narrative

The package's published entrypoint includes a comment stating that an alert is dismissed. Because this text targets the review process, it is treated as reviewer manipulation rather than evidence that the underlying behavior is safe.

AI rationale

The package exposes the affected bundle as its main entrypoint, and that bundle contains text aimed at dismissing a reviewer alert. This supports blocking for reviewer manipulation.

Evidence

dist/index.mjs

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

The published entrypoint contains a comment declaring a reviewer alert dismissed.
The package manifest exposes that bundle as its main and import entrypoint.

Evidence against

Behavioral surface

Source

CryptoFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 17.2 KB of source, external domains: sverka.dev

Source & flagged code

2 flagged

dist/index.mjsView file

Lines 210-250javascript

210 filename = decodeURIComponent(url.slice(8));

211 } catch {

212 res.writeHead(400, { "content-type": "text/plain" });

213 res.end("Invalid URL encoding");

214 return;

215 }

216 serveReport(res, artifactsDir, filename);

217 return;

218 }

219 if (url === "/health") {

220 res.writeHead(200, { "content-type": "application/json" });

221 res.end(JSON.stringify({ status: "ok" }));

222 return;

223 }

224 res.writeHead(404, { "content-type": "text/plain" });

225 res.end("Not found");

226}

227/** List SARIF files and render the dashboard page.

228* All user-controlled data (artifactsDir, filenames) is escaped via

229* escapeHtml() in renderDashboard; CSP blocks inline scripts as

230* defense-in-depth. The escaper is local — the alert is dismissed. */

231function serveDashboard(res, artifactsDir) {

232 const html = renderDashboard(artifactsDir, listSarifFiles(artifactsDir));

233 res.writeHead(200, HTML_HEADERS);

234 res.end(html);

High

Ai Review Evidence

The published entrypoint contains a comment declaring a reviewer alert dismissed.

dist/index.mjsView on unpkg · L230

235}

236/** Engine run ids are `randomUUID()` values — a leading path segment in

237* this shape is the per-run artifact dir, not a step/pipeline name. */

238const RUN_ID_SEGMENT = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;

239/** Read a SARIF file, normalize findings, and render the HTML report. */

240function serveReport(res, artifactsDir, filename) {

241 if (filename === "" || filename.includes("..") || filename.includes("\\") || filename.startsWith("/")) {

242 res.writeHead(400, { "content-type": "text/plain" });

243 res.end("Invalid filename");

244 return;

245 }

246 const filePath = join(artifactsDir, filename);

247 try {

248 const realArtifacts = realpathSync(artifactsDir);

249 const realFile = realpathSync(filePath);

250 if (!realFile.startsWith(realArtifacts + sep) && realFile !== realArtifacts) {

package.jsonView file

Lines 1-38json

2 "name": "@sverka/ui",

3 "version": "0.2.36",

4 "description": "Sverka UI — local web dashboard for viewing SARIF findings and run results",

5 "license": "MIT",

Source & flagged code

2 flagged · loading source

dist/index.mjsView file

230The escaper is local — the alert is dismissed. */ function serveDashboard(res, artifactsDir) { const html = renderDashboard(artifactsDir, listSarifFiles(artifactsDir)); res.writeHead(200, HTML_HEADERS); re

High

Ai Review Evidence

The published entrypoint contains a comment declaring a reviewer alert dismissed.

dist/index.mjsView on unpkg · L230

package.jsonView file

18"main": "./dist/index.mjs", "module": "./dist/index.mjs", "types": "./dist/index.d.mts", "exports": { ".": { "types": "./dist/index.d.mts",

High

Ai Review Evidence

The package manifest exposes that bundle as its main and import entrypoint.

package.jsonView on unpkg · L18

Findings

2 High1 Medium3 Low

HighAi Review Evidencedist/index.mjs

HighAi Review Evidencepackage.json

MediumNetwork

LowScripts Present

LowFilesystem

LowUrl Strings

Affected versions and remediation

This report applies to @sverka/ui@0.2.36.

See all versions of @sverka/ui for other recorded verdicts.

Avoid installing @sverka/ui@0.2.36. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-21 21:26:10.423Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Behavioral surface

Source & flagged code

Related packages

Other malware packages