@sverka/ui@0.2.42

Sverka UI — local web dashboard for viewing SARIF findings and run results

AI Security Review

scanned 14h ago · by lpm-firewall-ai

The manifest has no lifecycle hooks, and the entrypoint’s network behavior is an explicitly invoked local dashboard. Inspected dependencies provide SARIF normalization and HTML rendering; no attack behavior was found.

Static reason

No blocking static signals were detected.

Trigger

A consumer calls the exported startUiServer function.

Impact

No confirmed harmful effect or data transfer was identified.

Mechanism

The server defaults to localhost, lists SARIF artifacts, and serves reports after rejecting traversal-style filenames.

AI rationale

Network endpoints1

localhost

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package manifest points to a dashboard entrypoint and declares no lifecycle scripts.
The inspected dependencies have no install hooks; their runtime code normalizes SARIF findings and renders HTML.
The server starts only when its exported API is called, defaults to localhost, and rejects report paths containing traversal markers.

Evidence against

Behavioral surface

Source

CryptoFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 17.2 KB of source, external domains: sverka.dev

Source & flagged code

8 flagged

package.jsonView file

Lines 1-38json

2 "name": "@sverka/ui",

3 "version": "0.2.42",

4 "description": "Sverka UI — local web dashboard for viewing SARIF findings and run results",

5 "license": "MIT",

6 "sideEffects": false,

7 "repository": {

8 "type": "git",

9 "url": "git+https://github.com/sverka-dev/sverka.git",

10 "directory": "packages/ui"

11 },

12 "homepage": "https://sverka.dev",

13 "bugs": "https://github.com/sverka-dev/sverka/issues",

14 "publishConfig": {

15 "access": "public"

16 },

17 "type": "module",

18 "main": "./dist/index.mjs",

19 "module": "./dist/index.mjs",

20 "types": "./dist/index.d.mts",

21 "exports": {

22 ".": {

23 "types": "./dist/index.d.mts",

24 "import": "./dist/index.mjs"

Low

Suspicious Lifecycle Evidence

The package manifest points to a dashboard entrypoint and declares no lifecycle scripts.

package.jsonView on unpkg · L18

25 }

26 },

27 "files": [

28 "dist"

29 ],

30 "scripts": {

31 "build": "tsdown",

32 "test": "vitest run --passWithNoTests",

33 "lint": "eslint src",

34 "typecheck": "tsc --noEmit"

35 },

36 "dependencies": {

37 "@sverka/verification": "^0.2.42",

38 "@sverka/sarif-viewer-web": "^0.2.42"

.lpm-dependency-evidence-0a324f9f-2be1-413a-bbbe-bedb3ddb96a8/0/npm-linux/package.jsonView file

30"scripts": { "build": "tsdown", "test": "vitest run --passWithNoTests", "lint": "eslint src", "typecheck": "tsc --noEmit" }, "dependencies": { "@sverka/work

Low

Suspicious Lifecycle Evidence

The inspected dependencies have no install hooks; their runtime code normalizes SARIF findings and renders HTML.

.lpm-dependency-evidence-0a324f9f-2be1-413a-bbbe-bedb3ddb96a8/0/npm-linux/package.jsonView on unpkg · L30

.lpm-dependency-evidence-0a324f9f-2be1-413a-bbbe-bedb3ddb96a8/0/npm-linux/dist/index.mjsView file

75function normalizeSarif(sarif, context) { validateSarifLog(sarif); const findings = []; for (const run of sarif.runs) findings.push(...normalizeRun(run, context)); return findi

Low

Suspicious Lifecycle Evidence

The inspected dependencies have no install hooks; their runtime code normalizes SARIF findings and renders HTML.

.lpm-dependency-evidence-0a324f9f-2be1-413a-bbbe-bedb3ddb96a8/0/npm-linux/dist/index.mjsView on unpkg · L75

.lpm-dependency-evidence-0a324f9f-2be1-413a-bbbe-bedb3ddb96a8/1/npm-linux/package.jsonView file

37"scripts": { "build": "tsdown", "test": "vitest run --passWithNoTests", "lint": "eslint src", "typecheck": "tsc --noEmit" }, "dependencies": { "@sverka/veri

Low

Suspicious Lifecycle Evidence

The inspected dependencies have no install hooks; their runtime code normalizes SARIF findings and renders HTML.

.lpm-dependency-evidence-0a324f9f-2be1-413a-bbbe-bedb3ddb96a8/1/npm-linux/package.jsonView on unpkg · L37

.lpm-dependency-evidence-0a324f9f-2be1-413a-bbbe-bedb3ddb96a8/1/npm-linux/dist/index.mjsView file

13function renderSarifWeb(options) { const findings = resolveFindings(options); const html = generateSarifHtml(findings); mkdirSync(dirname(options.outputPath), { recursive: true

Low

Suspicious Lifecycle Evidence

The inspected dependencies have no install hooks; their runtime code normalizes SARIF findings and renders HTML.

.lpm-dependency-evidence-0a324f9f-2be1-413a-bbbe-bedb3ddb96a8/1/npm-linux/dist/index.mjsView on unpkg · L13

dist/index.mjsView file

Lines 156-198javascript

156footer { padding: 1rem 2rem; border-top: 1px solid #21262d; text-align: center; }

157footer a { color: #58a6ff; text-decoration: none; }

158`;

159//#endregion

160//#region src/server.ts

161/** Security headers for all HTML responses — defense-in-depth against XSS.

Source & flagged code

8 flagged · loading source

package.jsonView file

18"main": "./dist/index.mjs", "module": "./dist/index.mjs", "types": "./dist/index.d.mts", "exports": { ".": { "types": "./dist/index.d.mts", "import": "./dist/

Low

Suspicious Lifecycle Evidence

The package manifest points to a dashboard entrypoint and declares no lifecycle scripts.

package.jsonView on unpkg · L18

.lpm-dependency-evidence-0a324f9f-2be1-413a-bbbe-bedb3ddb96a8/0/npm-linux/package.jsonView file

30"scripts": { "build": "tsdown", "test": "vitest run --passWithNoTests", "lint": "eslint src", "typecheck": "tsc --noEmit" }, "dependencies": { "@sverka/work

Low

Suspicious Lifecycle Evidence

The inspected dependencies have no install hooks; their runtime code normalizes SARIF findings and renders HTML.

.lpm-dependency-evidence-0a324f9f-2be1-413a-bbbe-bedb3ddb96a8/0/npm-linux/package.jsonView on unpkg · L30

.lpm-dependency-evidence-0a324f9f-2be1-413a-bbbe-bedb3ddb96a8/0/npm-linux/dist/index.mjsView file

75function normalizeSarif(sarif, context) { validateSarifLog(sarif); const findings = []; for (const run of sarif.runs) findings.push(...normalizeRun(run, context)); return findi

Low

Suspicious Lifecycle Evidence

The inspected dependencies have no install hooks; their runtime code normalizes SARIF findings and renders HTML.

.lpm-dependency-evidence-0a324f9f-2be1-413a-bbbe-bedb3ddb96a8/0/npm-linux/dist/index.mjsView on unpkg · L75

.lpm-dependency-evidence-0a324f9f-2be1-413a-bbbe-bedb3ddb96a8/1/npm-linux/package.jsonView file

37"scripts": { "build": "tsdown", "test": "vitest run --passWithNoTests", "lint": "eslint src", "typecheck": "tsc --noEmit" }, "dependencies": { "@sverka/veri

Low

Suspicious Lifecycle Evidence

The inspected dependencies have no install hooks; their runtime code normalizes SARIF findings and renders HTML.

.lpm-dependency-evidence-0a324f9f-2be1-413a-bbbe-bedb3ddb96a8/1/npm-linux/package.jsonView on unpkg · L37

.lpm-dependency-evidence-0a324f9f-2be1-413a-bbbe-bedb3ddb96a8/1/npm-linux/dist/index.mjsView file

13function renderSarifWeb(options) { const findings = resolveFindings(options); const html = generateSarifHtml(findings); mkdirSync(dirname(options.outputPath), { recursive: true

Low

Suspicious Lifecycle Evidence

The inspected dependencies have no install hooks; their runtime code normalizes SARIF findings and renders HTML.

.lpm-dependency-evidence-0a324f9f-2be1-413a-bbbe-bedb3ddb96a8/1/npm-linux/dist/index.mjsView on unpkg · L13

dist/index.mjsView file

176const host = options.host ?? "localhost"; const artifactsDir = resolve(options.artifactsDir); const server = createServer((req, res) => { handleRequest(req, res, artifactsDir);

Low

Ai Review Evidence

The server starts only when its exported API is called, defaults to localhost, and rejects report paths containing traversal markers.

dist/index.mjsView on unpkg · L176

241if (filename === "" || filename.includes("..") || filename.includes("\\") || filename.startsWith("/")) { res.writeHead(400, { "content-type": "text/plain" }); res.end("Invalid

Low

Ai Review Evidence

The server starts only when its exported API is called, defaults to localhost, and rejects report paths containing traversal markers.

dist/index.mjsView on unpkg · L241

178const server = createServer((req, res) => { handleRequest(req, res, artifactsDir); }); return new Promise((resolve, reject) => { const onError = (err) => reject(err); serve

Low

Ai Review Evidence

The server starts only when its exported API is called, defaults to localhost, and rejects report paths containing traversal markers.

dist/index.mjsView on unpkg · L178

Findings

1 Medium11 Low

MediumNetwork

LowScripts Present

LowFilesystem

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-0a324f9f-2be1-413a-bbbe-bedb3ddb96a8/0/npm-linux/package.json

LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-0a324f9f-2be1-413a-bbbe-bedb3ddb96a8/0/npm-linux/dist/index.mjs

LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-0a324f9f-2be1-413a-bbbe-bedb3ddb96a8/1/npm-linux/package.json

LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-0a324f9f-2be1-413a-bbbe-bedb3ddb96a8/1/npm-linux/dist/index.mjs

LowAi Review Evidencedist/index.mjs

Affected versions and remediation

This report applies to @sverka/ui@0.2.42.

See all versions of @sverka/ui for other recorded verdicts.

Review the evidence and your use of @sverka/ui@0.2.42 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 11:54:50.918Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.