@sverka/ui@0.2.48

Sverka UI — local web dashboard for viewing SARIF findings and run results

AI Security Review

scanned 4h ago · by lpm-firewall-ai

The manifest has no install hook, and the inspected entrypoint serves a local dashboard only when called. Its report path checks and inspected dependency behavior support normal SARIF viewing; no malicious behavior was established.

Static reason

No blocking static signals were detected.

Trigger

A caller invokes the exported startUiServer function.

Impact

No confirmed attack impact; the inspected behavior serves local reports.

Mechanism

The server defaults to localhost, reads reports from the configured artifacts directory, and rejects report paths that escape that directory.

AI rationale

Network endpoints1

localhost (default bind host)

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest points to the built entrypoint, has no install lifecycle hook, and lists two first-party dependencies.
The exported dashboard server defaults to localhost and starts when called.
Report requests reject traversal paths and check that resolved files remain inside the artifacts directory.
The verification dependency validates and normalizes supplied SARIF data.
The web viewer generates HTML and writes it to the caller-specified output path.

Evidence against

Behavioral surface

Source

CryptoFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 17.2 KB of source, external domains: sverka.dev

Source & flagged code

8 flagged

package.jsonView file

Lines 3-43json

3 "version": "0.2.48",

4 "description": "Sverka UI — local web dashboard for viewing SARIF findings and run results",

5 "license": "MIT",

6 "sideEffects": false,

7 "repository": {

8 "type": "git",

9 "url": "git+https://github.com/sverka-dev/sverka.git",

10 "directory": "packages/ui"

11 },

12 "homepage": "https://sverka.dev",

13 "bugs": "https://github.com/sverka-dev/sverka/issues",

14 "publishConfig": {

15 "access": "public"

16 },

17 "type": "module",

18 "main": "./dist/index.mjs",

19 "module": "./dist/index.mjs",

20 "types": "./dist/index.d.mts",

21 "exports": {

22 ".": {

23 "types": "./dist/index.d.mts",

24 "import": "./dist/index.mjs"

25 }

26 },

27 "files": [

28 "dist"

29 ],

30 "scripts": {

31 "build": "tsdown",

32 "test": "vitest run --passWithNoTests",

33 "lint": "eslint src",

34 "typecheck": "tsc --noEmit"

Low

Suspicious Lifecycle Evidence

The manifest points to the built entrypoint, has no install lifecycle hook, and lists two first-party dependencies.

package.jsonView on unpkg · L23

35 },

36 "dependencies": {

37 "@sverka/verification": "^0.2.48",

38 "@sverka/sarif-viewer-web": "^0.2.48"

39 },

40 "devDependencies": {

41 "tsdown": "^0.23.1",

42 "typescript": "^6.0.3",

43 "vitest": "^5.0.5"

.lpm-dependency-evidence-b65f5d24-edba-4006-97bb-0b6baa4ef831/0/npm-linux/package.jsonView file

30ripts": { "build": "tsdown", "test": "vitest run --passWithNoTests", "lint": "eslint src", "typecheck": "tsc --noEmit" }, "dependencies": { "@sverka/workflow": "^0.2.48" }, "devDependencies": { "tsdown": "^0.23.1", "typescri

Low

Suspicious Lifecycle Evidence

The manifest points to the built entrypoint, has no install lifecycle hook, and lists two first-party dependencies.

.lpm-dependency-evidence-b65f5d24-edba-4006-97bb-0b6baa4ef831/0/npm-linux/package.jsonView on unpkg · L30

.lpm-dependency-evidence-b65f5d24-edba-4006-97bb-0b6baa4ef831/1/npm-linux/package.jsonView file

32"sarif-viewer-web": "dist/bin.mjs" }, "files": [ "dist" ], "scripts": { "build": "tsdown", "test": "vitest run --passWithNoTests", "lint": "eslint src", "typecheck": "tsc --noEmit" }, "dependencies": { "@sverka/verificat

Low

Suspicious Lifecycle Evidence

The manifest points to the built entrypoint, has no install lifecycle hook, and lists two first-party dependencies.

.lpm-dependency-evidence-b65f5d24-edba-4006-97bb-0b6baa4ef831/1/npm-linux/package.jsonView on unpkg · L32

dist/index.mjsView file

170and * renders individual findings reports. Returns when the server is * listening. */ function startUiServer(options) { const port = options.port ?? 3e3; const host = options.host ?? "localhost"; const artifactsDir = resolve(options.artifactsDir); const s

Low

Ai Review Evidence

The exported dashboard server defaults to localhost and starts when called.

dist/index.mjsView on unpkg · L170

465ef="/?project=${encodeURIComponent(p)}"><code>${escapeHtml(p)}</code></a></td></tr>`).join("\n ")} </tbody> </table>`}` }); } //#endregion export { renderDashboard, renderHubFlaky, renderHubIndex, renderHubRunDetail, renderHubRunList, startUiSe

Low

Ai Review Evidence

The exported dashboard server defaults to localhost and starts when called.

dist/index.mjsView on unpkg · L465

2384}-[0-9a-f]{12}$/i; /** Read a SARIF file, normalize findings, and render the HTML report. */ function serveReport(res, artifactsDir, filename) { if (filename === "" || filename.includes("..") || filename.includes("\\") || filename.startsWith("/")) { res.writeHead(400, { "content-type": "text/plain" }); res.end("Invalid filename"); return; } const filePath = join(artifactsDir, filename); try { const realArtifacts = realpathSync(artifactsDir); const realFile = realpathSync(filePath)

Low

Ai Review Evidence

Report requests reject traversal paths and check that resolved files remain inside the artifacts directory.

dist/index.mjsView on unpkg · L238

.lpm-dependency-evidence-b65f5d24-edba-4006-97bb-0b6baa4ef831/0/npm-linux/dist/index.mjsView file

75normalizeSarif(sarif, context) { validateSarifLog(sarif); const findings = []; for (const run of sarif.runs) findings.push(...normalizeRun(run, context)); return findings; } /** * Validate the top-level SARIF log structure. * Accepts `unknown` and narrows

Low

Suspicious Dependency Evidence

The verification dependency validates and normalizes supplied SARIF data.

.lpm-dependency-evidence-b65f5d24-edba-4006-97bb-0b6baa4ef831/0/npm-linux/dist/index.mjsView on unpkg · L75

.lpm-dependency-evidence-b65f5d24-edba-4006-97bb-0b6baa4ef831/1/npm-linux/dist/index.mjsView file

13rifWeb(options) { const findings = resolveFindings(options); const html = generateSarifHtml(findings); mkdirSync(dirname(options.outputPath), { recursive: true }); writeFileSync(options.outputPath, html, "utf-8"); } //#endregion export { DEFAULT_NORMALIZE_CONTEXT, g

Low

Ai Review Evidence

The web viewer generates HTML and writes it to the caller-specified output path.

.lpm-dependency-evidence-b65f5d24-edba-4006-97bb-0b6baa4ef831/1/npm-linux/dist/index.mjsView on unpkg · L13

Source & flagged code

8 flagged · loading source

package.jsonView file

23st/index.d.mts", "import": "./dist/index.mjs" } }, "files": [ "dist" ], "scripts": { "build": "tsdown", "test": "vitest run --passWithNoTests", "lint": "eslint src", "typecheck": "tsc --noEmit" }, "dependenci

Low

Suspicious Lifecycle Evidence

The manifest points to the built entrypoint, has no install lifecycle hook, and lists two first-party dependencies.

package.jsonView on unpkg · L23

.lpm-dependency-evidence-b65f5d24-edba-4006-97bb-0b6baa4ef831/0/npm-linux/package.jsonView file

Low

Suspicious Lifecycle Evidence

The manifest points to the built entrypoint, has no install lifecycle hook, and lists two first-party dependencies.

.lpm-dependency-evidence-b65f5d24-edba-4006-97bb-0b6baa4ef831/0/npm-linux/package.jsonView on unpkg · L30

Findings

1 Medium11 Low

MediumNetwork

LowScripts Present

LowFilesystem

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-b65f5d24-edba-4006-97bb-0b6baa4ef831/0/npm-linux/package.json

LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-b65f5d24-edba-4006-97bb-0b6baa4ef831/1/npm-linux/package.json

LowAi Review Evidencedist/index.mjs

LowSuspicious Dependency Evidence.lpm-dependency-evidence-b65f5d24-edba-4006-97bb-0b6baa4ef831/0/npm-linux/dist/index.mjs

LowAi Review Evidence.lpm-dependency-evidence-b65f5d24-edba-4006-97bb-0b6baa4ef831/1/npm-linux/dist/index.mjs

Affected versions and remediation

This report applies to @sverka/ui@0.2.48.

See all versions of @sverka/ui for other recorded verdicts.

Review the evidence and your use of @sverka/ui@0.2.48 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 23:25:45.965Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.