No confirmed malicious attack surface. The only fetch reference is a user-application request-handler wrapper, not package-controlled network egress.
Static reason
No blocking static signals were detected.
Trigger
Application import or framework build configuration.
Impact
No package-controlled persistence, exfiltration, destructive action, or install-time mutation established.
Mechanism
Framework exports, SSR handler delegation, and bundler plugin configuration.
Rationale
Static source inspection finds a normal Solid Start integration package with no lifecycle execution or concrete malicious behavior. Scanner network hints resolve to an application-level request handler and README assets rather than package-controlled exfiltration.
Evidence
package.jsonsrc/default-entry/server.tssrc/plugin/shared.tssrc/plugin/vite.tssrc/plugin/rsbuild.tsskills/solid-start/SKILL.md