@sverka/ui@0.2.39

Sverka UI — local web dashboard for viewing SARIF findings and run results

AI Security Review

scanned 21h ago · by lpm-firewall-ai

The package has no install hooks, and its network and filesystem behavior is consistent with a caller-started local report dashboard. The inspected dependency manifests and relevant runtime code showed no concrete attack behavior.

Static reason

No blocking static signals were detected.

Trigger

A caller invokes the exported server start function to serve the dashboard.

Impact

No malicious effect was established from the inspected source.

Mechanism

The server defaults to localhost and reads report files from the caller-supplied artifacts directory; inspected dependencies normalize SARIF and render HTML.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest lists build, test, lint, and typecheck scripts, with no install lifecycle hooks.
The entrypoint exports a caller-started dashboard server that defaults to localhost and serves reports from the supplied artifacts directory.
The inspected dependency manifests have no install lifecycle hooks; their inspected runtime code normalizes SARIF and generates HTML.

Evidence against

The package uses HTTP and filesystem APIs, but the server is an exported runtime feature for viewing local SARIF artifacts.

Behavioral surface

Source

CryptoFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 17.2 KB of source, external domains: sverka.dev

Source & flagged code

8 flagged

package.jsonView file

Lines 9-46json

9 "url": "git+https://github.com/sverka-dev/sverka.git",

10 "directory": "packages/ui"

11 },

12 "homepage": "https://sverka.dev",

13 "bugs": "https://github.com/sverka-dev/sverka/issues",

14 "publishConfig": {

15 "access": "public"

16 },

17 "type": "module",

18 "main": "./dist/index.mjs",

19 "module": "./dist/index.mjs",

20 "types": "./dist/index.d.mts",

21 "exports": {

22 ".": {

23 "types": "./dist/index.d.mts",

24 "import": "./dist/index.mjs"

25 }

26 },

27 "files": [

28 "dist"

29 ],

30 "scripts": {

31 "build": "tsdown",

32 "test": "vitest run --passWithNoTests",

33 "lint": "eslint src",

34 "typecheck": "tsc --noEmit"

35 },

36 "dependencies": {

37 "@sverka/verification": "^0.2.39",

Low

Suspicious Lifecycle Evidence

The manifest lists build, test, lint, and typecheck scripts, with no install lifecycle hooks.

package.jsonView on unpkg · L29

38 "@sverka/sarif-viewer-web": "^0.2.39"

39 },

40 "devDependencies": {

41 "tsdown": "^0.23.1",

42 "typescript": "^5.8.0",

43 "vitest": "^5.0.5"

44 }

45}

dist/index.mjsView file

Lines 154-214javascript

154.empty { color: #8b949e; padding: 2rem; text-align: center; }

155code { background: #21262d; padding: 0.1rem 0.3rem; border-radius: 3px; }

156footer { padding: 1rem 2rem; border-top: 1px solid #21262d; text-align: center; }

.lpm-dependency-evidence-227dcb0f-04fa-41ac-8277-20cd751142ff/0/npm-linux/package.jsonView file

29], "scripts": { "build": "tsdown", "test": "vitest run --passWithNoTests", "lint": "eslint src", "typecheck": "tsc --noEmit" }, "dependencies": {

Low

Suspicious Lifecycle Evidence

The inspected dependency manifests have no install lifecycle hooks; their inspected runtime code normalizes SARIF and generates HTML.

.lpm-dependency-evidence-227dcb0f-04fa-41ac-8277-20cd751142ff/0/npm-linux/package.jsonView on unpkg · L29

.lpm-dependency-evidence-227dcb0f-04fa-41ac-8277-20cd751142ff/0/npm-linux/dist/index.mjsView file

1import { createHash } from "node:crypto"; import { existsSync, readFileSync } from "node:fs"; import process from "node:process"; import { readFile, writeFile } from "node:fs/promi

Low

Suspicious Lifecycle Evidence

The inspected dependency manifests have no install lifecycle hooks; their inspected runtime code normalizes SARIF and generates HTML.

.lpm-dependency-evidence-227dcb0f-04fa-41ac-8277-20cd751142ff/0/npm-linux/dist/index.mjsView on unpkg · L1

.lpm-dependency-evidence-227dcb0f-04fa-41ac-8277-20cd751142ff/1/npm-linux/package.jsonView file

38"build": "tsdown", "test": "vitest run --passWithNoTests", "lint": "eslint src", "typecheck": "tsc --noEmit" }, "dependencies": { "@sverka/verification": "^0.2.3

Low

Suspicious Lifecycle Evidence

The inspected dependency manifests have no install lifecycle hooks; their inspected runtime code normalizes SARIF and generates HTML.

.lpm-dependency-evidence-227dcb0f-04fa-41ac-8277-20cd751142ff/1/npm-linux/package.jsonView on unpkg · L38

Source & flagged code

8 flagged · loading source

package.jsonView file

29], "scripts": { "build": "tsdown", "test": "vitest run --passWithNoTests", "lint": "eslint src", "typecheck": "tsc --noEmit" }, "dependencies": { "@sverka/verific

Low

Suspicious Lifecycle Evidence

The manifest lists build, test, lint, and typecheck scripts, with no install lifecycle hooks.

package.jsonView on unpkg · L29

dist/index.mjsView file

174tUiServer(options) { const port = options.port ?? 3e3; const host = options.host ?? "localhost"; const artifactsDir = resolve(options.artifactsDir); const server = createServer((req, res

Low

Ai Review Evidence

The entrypoint exports a caller-started dashboard server that defaults to localhost and serves reports from the supplied artifacts directory.

dist/index.mjsView on unpkg · L174

471export { renderDashboard, renderHubFlaky, renderHubIndex, renderHubRunDetail, renderHubRunList, startUiServer }; //# sourceMappingURL=index.mjs.map

Low

Findings

1 Medium11 Low

MediumNetwork

LowScripts Present

LowFilesystem

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.mjs

LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-227dcb0f-04fa-41ac-8277-20cd751142ff/0/npm-linux/package.json

LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-227dcb0f-04fa-41ac-8277-20cd751142ff/0/npm-linux/dist/index.mjs

LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-227dcb0f-04fa-41ac-8277-20cd751142ff/1/npm-linux/package.json

Affected versions and remediation

This report applies to @sverka/ui@0.2.39.

See all versions of @sverka/ui for other recorded verdicts.

Review the evidence and your use of @sverka/ui@0.2.39 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 04:15:53.792Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.