registry / @teamvelix/velix / 5.3.0

@teamvelix/velix@5.3.0

Velix v5 — A modern full-stack React framework

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 396 KB of source, external domains: fonts.googleapis.com, schema.org, velixcloud.io, www.sitemaps.org

Source & flagged code

5 flagged

dist/chunk-OKEPYKAP.jsView file

Lines 1-32javascript

1import { definePlugin, PluginHooks, logger_default, loadPlugins, pluginManager, buildRouteTree, matchRoute, VERSION } from './chunk-IH5DV2WC.js';

2import { loadConfig, resolvePaths } from './chunk-F24Q2MX3.js';

3import { getRegisteredIslands, generateAdvancedHydrationScript } from './chunk-JI2HJFUT.js';

4import { __dirname as __dirname$1, __require } from './chunk-BQ4HFLRL.js';

5import http from 'http';

6import fs3 from 'fs';

7import path3 from 'path';

8import { pathToFileURL, fileURLToPath } from 'url';

9import { createRequire } from 'module';

10import React, { useActionState } from 'react';

11export { useActionState, useOptimistic } from 'react';

12import { renderToString } from 'react-dom/server';

13import { spawnSync, spawn } from 'child_process';

14export { useFormStatus } from 'react-dom';

High

Child Process

Package source references child process execution.

dist/chunk-OKEPYKAP.jsView on unpkg · L12

15import { NotFoundError } from '@teamvelix/velix-core';

16export { NotFoundError, VelixHttpError, buildApiManifest, defineLoader, defineRoute, handleApiRequest, serverAction as serverAction2 } from '@teamvelix/velix-core';

17import esbuild from 'esbuild';

19var middlewares = {

20 cors(options = {}) {

21 const {

22 origin = "*",

23 methods = ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"],

24 headers: allowHeaders = ["Content-Type", "Authorization"],

25 credentials = false,

26 maxAge = 86400

27 } = options;

28 return async (req, res, next) => {

29 const originHeader = typeof origin === "string" ? origin : origin.includes(req.headers.origin) ? req.headers.origin : "";

30 res.header("Access-Control-Allow-Origin", originHeader);

31 res.header("Access-Control-Allow-Methods", methods.join(", "));

32 res.header("Access-Control-Allow-Headers", allowHeaders.join(", "));

Lines 162-205javascript

162 res.setHeader(key, value);

163 }

164 }

165 result.continue = !ended;

166 return result;

167}

168function composeMiddleware(...fns) {

169 return async (req, res, next

dist/runtime/start-build.jsView file

Lines 64-104javascript

64 publicDir: z.string().default("public"),

65 // Stylesheets

66 styles: z.array(z.string()).default([]),

67 // Favicon

68 favicon: z.string().nullable().default(null

dist/chunk-IH5DV2WC.jsView file

Lines 451-491javascript

451function fmtTime(ms) {

452 if (ms < 1) return `${c.gray}<1ms${c.reset}`;

453 if (ms < 100) return `${c.

Source & flagged code

5 flagged · loading source

dist/chunk-OKEPYKAP.jsView file

12import { renderToString } from 'react-dom/server'; L13: import { spawnSync, spawn } from 'child_process'; L14: export { useFormStatus } from 'react-dom';

High

Child Process

Package source references child process execution.

dist/chunk-OKEPYKAP.jsView on unpkg · L12

185timeout: 15e3, L186: shell: true L187: });

High

Shell

Package source references shell execution.

dist/chunk-OKEPYKAP.jsView on unpkg · L185

182function detectTailwindCli() { L183: const v4 = spawnSync("npx @tailwindcss/cli --help", { L184: stdio: "pipe",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/chunk-OKEPYKAP.jsView on unpkg · L182

dist/runtime/start-build.jsView file

84const configUrl = pathToFileURL(configPath).href; L85: const module = await import(`${configUrl}?t=${Date.now()}`); L86: userConfig = module.default || module;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runtime/start-build.jsView on unpkg · L84

dist/chunk-IH5DV2WC.jsView file

471console.log(""); L472: console.log(` ${c.bold}Local:${c.reset} ${c.cyan}http://${host}:${port}${c.reset}`); L473: console.log(` ${c.bold}Mode:${c.reset} ${mode === "development" ? c.yellow : c.green}${mode}${c.reset}`);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-IH5DV2WC.jsView on unpkg · L471

Findings

3 High4 Medium5 Low

HighChild Processdist/chunk-OKEPYKAP.js

HighShelldist/chunk-OKEPYKAP.js

HighRuntime Package Installdist/chunk-OKEPYKAP.js

MediumDynamic Requiredist/runtime/start-build.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/chunk-IH5DV2WC.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/chunk-OKEPYKAP.jsView file

Lines 1-32javascript

1import { definePlugin, PluginHooks, logger_default, loadPlugins, pluginManager, buildRouteTree, matchRoute, VERSION } from './chunk-IH5DV2WC.js';

2import { loadConfig, resolvePaths } from './chunk-F24Q2MX3.js';

3import { getRegisteredIslands, generateAdvancedHydrationScript } from './chunk-JI2HJFUT.js';

4import { __dirname as __dirname$1, __require } from './chunk-BQ4HFLRL.js';

5import http from 'http';

6import fs3 from 'fs';

7import path3 from 'path';

8import { pathToFileURL, fileURLToPath } from 'url';

9import { createRequire } from 'module';

10import React, { useActionState } from 'react';

11export { useActionState, useOptimistic } from 'react';

12import { renderToString } from 'react-dom/server';

13import { spawnSync, spawn } from 'child_process';

14export { useFormStatus } from 'react-dom';

High

Child Process

Package source references child process execution.

dist/chunk-OKEPYKAP.jsView on unpkg · L12

15import { NotFoundError } from '@teamvelix/velix-core';

16export { NotFoundError, VelixHttpError, buildApiManifest, defineLoader, defineRoute, handleApiRequest, serverAction as serverAction2 } from '@teamvelix/velix-core';

17import esbuild from 'esbuild';

19var middlewares = {

20 cors(options = {}) {

21 const {

22 origin = "*",

23 methods = ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"],

24 headers: allowHeaders = ["Content-Type", "Authorization"],

25 credentials = false,

26 maxAge = 86400

27 } = options;

28 return async (req, res, next) => {

29 const originHeader = typeof origin === "string" ? origin : origin.includes(req.headers.origin) ? req.headers.origin : "";

30 res.header("Access-Control-Allow-Origin", originHeader);

31 res.header("Access-Control-Allow-Methods", methods.join(", "));

32 res.header("Access-Control-Allow-Headers", allowHeaders.join(", "));

Lines 162-205javascript

162 res.setHeader(key, value);

163 }

164 }

165 result.continue = !ended;

166 return result;

167}

168function composeMiddleware(...fns) {

169 return async (req, res, next

dist/runtime/start-build.jsView file

Lines 64-104javascript

64 publicDir: z.string().default("public"),

65 // Stylesheets

66 styles: z.array(z.string()).default([]),

67 // Favicon

68 favicon: z.string().nullable().default(null

dist/chunk-IH5DV2WC.jsView file

Lines 451-491javascript

451function fmtTime(ms) {

452 if (ms < 1) return `${c.gray}<1ms${c.reset}`;

453 if (ms < 100) return `${c.