@sverka/ui@0.2.43

⚠ Under review

Sverka UI — local web dashboard for viewing SARIF findings and run results

AI Security Review

scanned 14h ago · by lpm-firewall-ai

The inspected source shows report rendering and local dashboard behavior, with no confirmed attack. The required @sverka/verification dependency is unresolved and used by the entrypoint, so its behavior cannot be cleared from this snapshot.

Static reason

No blocking static signals were detected.

Trigger

Importing the package entrypoint and rendering a SARIF report.

Impact

The unresolved dependency prevents confirming that all selected runtime code is benign.

Mechanism

The entrypoint imports and calls @sverka/verification, whose source was unavailable in the supplied snapshot.

AI rationale

Evidence

package.jsondist/index.mjs

Decision evidence

public snapshot

AI called this Manual Review at 91.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest declares @sverka/verification as a runtime dependency, and the entrypoint imports it.
The entrypoint calls the unresolved dependency while rendering SARIF reports.
The prepared @sverka/sarif-viewer-web source renders HTML and writes it to the caller-provided output path.

Evidence against

Behavioral surface

Source

CryptoFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 17.2 KB of source, external domains: sverka.dev

Source & flagged code

4 flagged

package.jsonView file

37"@sverka/verification": "^0.2.43", "@sverka/sarif-viewer-web": "^0.2.43" }, "devDependencies": { "tsdown": "^0.23.1", "typescript": "^5.8.0", "vitest": "^5.0.5"

Low

Suspicious Dependency Evidence

The manifest declares @sverka/verification as a runtime dependency, and the entrypoint imports it.

package.jsonView on unpkg · L37

dist/index.mjsView file

Lines 1-21javascript

1import { createServer } from "node:http";

2import { createHash } from "node:crypto";

3import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";

4import { dirname, join, relative, resolve, sep } from "node:path";

5import { normalizeSarif } from "@sverka/verification";

Low

Suspicious Dependency Evidence

The manifest declares @sverka/verification as a runtime dependency, and the entrypoint imports it.

dist/index.mjsView on unpkg · L1

6import { generateSarifHtml } from "@sverka/sarif-viewer-web";

7//#region src/escape.ts

8function escapeHtml(text) {

9 return text.replaceAll("&", "&").replaceAll("<", "<").replaceAll(">", ">").replaceAll("\"", """).replaceAll("'", "'");

10}

11/** Shared dark theme — same palette as the SARIF dashboard. */

12const PAGE_CSS = String.raw`

13:root { color-scheme: dark; }

14* { box-sizing: border-box; }

15body {

16 margin: 0;

17 padding: 0;

18 background: #0d1117;

19 color: #c9d1d9;

20 font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif;

21 line-height: 1.6;

Lines 245-285javascript

245 }

246 const filePath = join(artifactsDir, filename);

247 try {

248 const realArtifacts = realpathSync(artifactsDir);

249 const realFile

.lpm-dependency-evidence-4fbfe66d-c8c7-426d-8999-1571be0fcc49/1/npm-linux/dist/index.mjsView file

14const findings = resolveFindings(options); const html = generateSarifHtml(findings); mkdirSync(dirname(options.outputPath), { recursive: true }); writeFileSync(options.outputPath, html, "utf-8"); } //#endregion export { DEFAULT_NORMALIZE_CONTEXT, generateSarifHtml, renderSarifWeb, resolveFinding

Low

Ai Review Evidence

The prepared @sverka/sarif-viewer-web source renders HTML and writes it to the caller-provided output path.

.lpm-dependency-evidence-4fbfe66d-c8c7-426d-8999-1571be0fcc49/1/npm-linux/dist/index.mjsView on unpkg · L14

Source & flagged code

4 flagged · loading source

package.jsonView file

37"@sverka/verification": "^0.2.43", "@sverka/sarif-viewer-web": "^0.2.43" }, "devDependencies": { "tsdown": "^0.23.1", "typescript": "^5.8.0", "vitest": "^5.0.5"

Low

Suspicious Dependency Evidence

The manifest declares @sverka/verification as a runtime dependency, and the entrypoint imports it.

package.jsonView on unpkg · L37

dist/index.mjsView file

1import { createServer } from "node:http"; import { createHash } from "node:crypto"; import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs"; import { dirname, join, relative, resolve, sep } from "node:path"; import { normalizeSarif } from "@sverka/verification";

Low

Suspicious Dependency Evidence

The manifest declares @sverka/verification as a runtime dependency, and the entrypoint imports it.

dist/index.mjsView on unpkg · L1

265egments[0]) ? dirSegments.slice(1).join("/") : dir; const findings = normalizeSarif(sarif, { root: artifactsDir, checkIdPrefix, defaultConfidence: .5 }); const html = generateSarifHtml(findings); res.wri

Low

Suspicious Dependency Evidence

The entrypoint calls the unresolved dependency while rendering SARIF reports.

dist/index.mjsView on unpkg · L265

.lpm-dependency-evidence-4fbfe66d-c8c7-426d-8999-1571be0fcc49/1/npm-linux/dist/index.mjsView file

Low

Ai Review Evidence

The prepared @sverka/sarif-viewer-web source renders HTML and writes it to the caller-provided output path.

.lpm-dependency-evidence-4fbfe66d-c8c7-426d-8999-1571be0fcc49/1/npm-linux/dist/index.mjsView on unpkg · L14

Findings

1 Medium7 Low

MediumNetwork

LowScripts Present

LowFilesystem

LowUrl Strings

LowSuspicious Dependency Evidencepackage.json

LowSuspicious Dependency Evidencedist/index.mjs

LowAi Review Evidence.lpm-dependency-evidence-4fbfe66d-c8c7-426d-8999-1571be0fcc49/1/npm-linux/dist/index.mjs

Affected versions and remediation

This report applies to @sverka/ui@0.2.43.

See all versions of @sverka/ui for other recorded verdicts.

Review the evidence and your use of @sverka/ui@0.2.43 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 12:33:05.067Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.