registry / @teamvelix/velix / 5.2.9

@teamvelix/velix@5.2.9

Velix v5 — A modern full-stack React framework

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 371 KB of source, external domains: schema.org, www.sitemaps.org

Source & flagged code

5 flagged

dist/chunk-HMCBOHTD.jsView file

Lines 1-32javascript

1import { definePlugin, PluginHooks, logger_default, loadPlugins, pluginManager, buildRouteTree, matchRoute, VERSION } from './chunk-RU23OKU5.js';

2import { loadConfig, resolvePaths } from './chunk-F24Q2MX3.js';

3import { getRegisteredIslands, generateAdvancedHydrationScript } from './chunk-JI2HJFUT.js';

4import { __dirname as __dirname$1, __require } from './chunk-BQ4HFLRL.js';

5import http from 'http';

6import fs3 from 'fs';

7import path3 from 'path';

8import { pathToFileURL, fileURLToPath } from 'url';

9import { createRequire } from 'module';

10import React, { useActionState } from 'react';

11export { useActionState, useOptimistic } from 'react';

12import { renderToString } from 'react-dom/server';

13import { spawnSync, spawn } from 'child_process';

14export { useFormStatus } from 'react-dom';

High

Child Process

Package source references child process execution.

dist/chunk-HMCBOHTD.jsView on unpkg · L12

15import { NotFoundError } from '@teamvelix/velix-core';

16export { NotFoundError, VelixHttpError, buildApiManifest, defineLoader, defineRoute, handleApiRequest, serverAction as serverAction2 } from '@teamvelix/velix-core';

17import esbuild from 'esbuild';

19var middlewares = {

20 cors(options = {}) {

21 const {

22 origin = "*",

23 methods = ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"],

24 headers: allowHeaders = ["Content-Type", "Authorization"],

25 credentials = false,

26 maxAge = 86400

27 } = options;

28 return async (req, res, next) => {

29 const originHeader = typeof origin === "string" ? origin : origin.includes(req.headers.origin) ? req.headers.origin : "";

30 res.header("Access-Control-Allow-Origin", originHeader);

31 res.header("Access-Control-Allow-Methods", methods.join(", "));

32 res.header("Access-Control-Allow-Headers", allowHeaders.join(", "));

Lines 162-205javascript

162 res.setHeader(key, value);

163 }

164 }

165 result.continue = !ended;

166 return result;

167}

168function composeMiddleware(...fns) {

169 return async (req, res, next

dist/chunk-RU23OKU5.jsView file

Lines 350-390javascript

350 * Check if a plugin is registered

351 */

352 hasPlugin(name) {

353 return this.plugins.some((p) => p.name === name);

354 }

355};

356var pluginManager

Source & flagged code

5 flagged · loading source

dist/chunk-HMCBOHTD.jsView file

12import { renderToString } from 'react-dom/server'; L13: import { spawnSync, spawn } from 'child_process'; L14: export { useFormStatus } from 'react-dom';

High

Child Process

Package source references child process execution.

dist/chunk-HMCBOHTD.jsView on unpkg · L12

185timeout: 15e3, L186: shell: true L187: });

High

Shell

Package source references shell execution.

dist/chunk-HMCBOHTD.jsView on unpkg · L185

182function detectTailwindCli() { L183: const v4 = spawnSync("npx @tailwindcss/cli --help", { L184: stdio: "pipe",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/chunk-HMCBOHTD.jsView on unpkg · L182

dist/chunk-RU23OKU5.jsView file

370const url = pathToFileURL(pluginPath).href; L371: const mod = await import(`${url}?t=${Date.now()}`); L372: const plugin = mod.default || mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-RU23OKU5.jsView on unpkg · L370

471console.log(""); L472: console.log(` ${c.bold}Local:${c.reset} ${c.cyan}http://${host}:${port}${c.reset}`); L473: console.log(` ${c.bold}Mode:${c.reset} ${mode === "development" ? c.yellow : c.green}${mode}${c.reset}`);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-RU23OKU5.jsView on unpkg · L471

Findings

3 High4 Medium5 Low

HighChild Processdist/chunk-HMCBOHTD.js

HighShelldist/chunk-HMCBOHTD.js

HighRuntime Package Installdist/chunk-HMCBOHTD.js

MediumDynamic Requiredist/chunk-RU23OKU5.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/chunk-RU23OKU5.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/chunk-HMCBOHTD.jsView file

Lines 1-32javascript

1import { definePlugin, PluginHooks, logger_default, loadPlugins, pluginManager, buildRouteTree, matchRoute, VERSION } from './chunk-RU23OKU5.js';

2import { loadConfig, resolvePaths } from './chunk-F24Q2MX3.js';

3import { getRegisteredIslands, generateAdvancedHydrationScript } from './chunk-JI2HJFUT.js';

4import { __dirname as __dirname$1, __require } from './chunk-BQ4HFLRL.js';

5import http from 'http';

6import fs3 from 'fs';

7import path3 from 'path';

8import { pathToFileURL, fileURLToPath } from 'url';

9import { createRequire } from 'module';

10import React, { useActionState } from 'react';

11export { useActionState, useOptimistic } from 'react';

12import { renderToString } from 'react-dom/server';

13import { spawnSync, spawn } from 'child_process';

14export { useFormStatus } from 'react-dom';

High

Child Process

Package source references child process execution.

dist/chunk-HMCBOHTD.jsView on unpkg · L12

15import { NotFoundError } from '@teamvelix/velix-core';

16export { NotFoundError, VelixHttpError, buildApiManifest, defineLoader, defineRoute, handleApiRequest, serverAction as serverAction2 } from '@teamvelix/velix-core';

17import esbuild from 'esbuild';

19var middlewares = {

20 cors(options = {}) {

21 const {

22 origin = "*",

23 methods = ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"],

24 headers: allowHeaders = ["Content-Type", "Authorization"],

25 credentials = false,

26 maxAge = 86400

27 } = options;

28 return async (req, res, next) => {

29 const originHeader = typeof origin === "string" ? origin : origin.includes(req.headers.origin) ? req.headers.origin : "";

30 res.header("Access-Control-Allow-Origin", originHeader);

31 res.header("Access-Control-Allow-Methods", methods.join(", "));

32 res.header("Access-Control-Allow-Headers", allowHeaders.join(", "));

Lines 162-205javascript

162 res.setHeader(key, value);

163 }

164 }

165 result.continue = !ended;

166 return result;

167}

168function composeMiddleware(...fns) {

169 return async (req, res, next

dist/chunk-RU23OKU5.jsView file

Lines 350-390javascript

350 * Check if a plugin is registered

351 */

352 hasPlugin(name) {

353 return this.plugins.some((p) => p.name === name);

354 }

355};

356var pluginManager

Lines 451-491javascript

451function fmtTime(ms) {

452 if (ms < 1) return `${c.gray}<1ms${c.reset}`;

453 if (ms < 100) return `${c.green}${ms}ms${c.reset}`;

454 if (ms < 500) return `${c.yellow}${ms}ms${c.reset}`;

455 return `${c.red}${ms}ms${c.reset}`;

456}

457var LOGO = `

458 ${c.cyan}\u25B2${c.reset} ${c.bold}Velix${c.reset} ${c.dim}v${VERSION}${c.reset}

459`;

460var logger = {

461 logo() {

462 console.log(LOGO);

463 console.log(`${c.dim} \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500${c.reset}`);

464 console.log("");

465 },

466 serverStart(config, startTime = Date.now()) {

467 const { port, host, mode, pagesDir } = config;

468 const elapsed = Date.now() - startTime;

469 console.log(LOGO);

470 console.log(` ${c.green}\u2714${c.reset} ${c.bold}Ready${c.reset} in ${elapsed}ms`);

471 console.log("");

472 console.log(` ${c.bold}Local:${c.reset} ${c.cyan}http://${host}:${port}${c.reset}`);

473 console.log(` ${c.bold}Mode:${c.reset} ${mode === "development" ? c.yellow : c.green}${mode}${c.reset}`);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-RU23OKU5.jsView on unpkg · L471

474 if (pagesDir) console.log(` ${c.bold}App:${c.reset} ${c.dim}${pagesDir}${c.reset}`);

475 console.log("");

476 },

477 request(method, path4, status, time, extra = {}) {

478 const statusColor = getStatusColor(status);

479 const timeStr = fmtTime(time);

480 let badge = `${c.dim}\u25CB${c.reset}`;

481 if (extra.type === "dynamic" || extra.type === "ssr") badge = `${c.white}\u0192${c.reset}`;

482 else if (extra.type === "api") badge = `${c.cyan}\u03BB${c.reset}`;

483 const statusStr = `${statusColor}${status}${c.reset}`;

484 console.log(` ${badge} ${c.white}${method}${c.reset} ${path4} ${statusStr} ${c.dim}${timeStr}${c.reset}`);

485 },

486 info(msg) {

487 console.log(` ${c.cyan}\u2139${c.reset} ${msg}`);

488 },

489 success(msg) {

490 console.log(` ${c.green}\u2714${c.reset} ${msg}`);

491 },