registry / bosia / 0.8.6

bosia@0.8.6

A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS. File-based routing No Node.js, no Vite, no adapters.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 93 file(s), 445 KB of source, external domains: fonts.googleapis.com, github.com, raw.githubusercontent.com

Source & flagged code

3 flagged

src/core/dev.tsView file

Lines 106-146typescript

106</head>

107<body>

108 <div class="wrap"><h1><span class="dot"></span>App server is starting…</h1></div>

109 <script>

110 !function r(){

111 try{

112 var e=new EventSource("/__bosia/sse");

113 e.addEventListener("reload",function(){location.reload()});

114 e.onerror=function(){e.close();setTimeout(r,2000)};

115 }catch(_){setTimeout(r,2000)}

116 }();

117 </script>

118</body>

119</html>`;

120

121// ─── Build ────────────────────────────────────────────────

122

123const BUILD_SCRIPT = join(import.meta.dir, "build.ts");

124

125async function runBuild(): Promise<boolean> {

126 console.log("🏗️ Building...");

127 const proc = spawn(["bun", "run", BUILD_SCRIPT], {

128 stdout: "inherit",

High

Child Process

Package source references child process execution.

src/core/dev.tsView on unpkg · L126

129 stderr: "inherit",

130 cwd: process.cwd(),

131 env: { ...process.env, BOSIA_OUT_DIR: DEV_OUT_DIR },

132 });

133 return (await proc.exited) === 0;

134}

135

136// ─── Ports ────────────────────────────────────────────────

137

138const DEV_PORT = Number(process.env.PORT) || 9000;

139const APP_PORT = DEV_PORT + 1; // internal, hidden from user

140

141// A previous dev session's app-server child can outlive its parent: an unclean

142// stop (SIGKILL, IDE stop button, crash) skips graceful cleanup, or a shutdown

143// slower than the SIGTERM grace window orphans it. The orphan keeps APP_PORT

144// bound and answers the new proxy with bundle hashes that no longer exist on

145// disk → "ENOENT reading +page-<hash>.js" 500s. Reap whatever is listening on

146// APP_PORT before we spawn, so a stale child can never shadow the fresh build.

src/core/plugin.tsView file

Lines 1-33typescript

1import { join, dirname } from "path";

3import { resolveImportPath } from "./resolveImport.ts";

5// ─── Bun Build Plugin ─────────────────────────────────────

6// Resolves:

7// bosia:routes → .bosia/routes.ts (generated route map)

8// $env → .bosia/env.server.ts (bun) or .bosia/env.client.ts (browser)

9// $* → resolved dynamically via tsconfig.json compilerOptions.paths

src/cli/registry.tsView file

Lines 164-204typescript

164 }

165 }

166

167 if (changes.scripts && Object.keys(changes.scripts).length > 0) {

168 pkg.scripts = pkg.scripts ?? {};

169 for (const [key, val] of

Source & flagged code

3 flagged · loading source

src/core/dev.tsView file

126console.log("🏗️ Building..."); L127: const proc = spawn(["bun", "run", BUILD_SCRIPT], { L128: stdout: "inherit",

High

Child Process

Package source references child process execution.

src/core/dev.tsView on unpkg · L126

src/core/plugin.tsView file

13name: "bosia-resolver", L14: setup(build: import("bun").PluginBuilder) { L15: // bosia:routes → .bosia/routes.client.ts (browser) or .bosia/routes.ts (server)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/core/plugin.tsView on unpkg · L13

src/cli/registry.tsView file

184L185: /** Run `bun add` for deps and optionally `bun add --dev` for devDeps. */ L186: export async function bunAdd( ... L193: console.log(`\n📥 npm: ${packages.join(", ")}`); L194: const proc = spawn(["bun", "add", ...packages], { L195: stdout: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/cli/registry.tsView on unpkg · L184

Findings

3 High5 Medium4 Low

HighChild Processsrc/core/dev.ts

HighShell

HighRuntime Package Installsrc/cli/registry.ts

MediumDynamic Requiresrc/core/plugin.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

src/core/dev.tsView file

Lines 106-146typescript

106</head>

107<body>

108 <div class="wrap"><h1><span class="dot"></span>App server is starting…</h1></div>

109 <script>

110 !function r(){

111 try{

112 var e=new EventSource("/__bosia/sse");

113 e.addEventListener("reload",function(){location.reload()});

114 e.onerror=function(){e.close();setTimeout(r,2000)};

115 }catch(_){setTimeout(r,2000)}

116 }();

117 </script>

118</body>

119</html>`;

120

121// ─── Build ────────────────────────────────────────────────

122

123const BUILD_SCRIPT = join(import.meta.dir, "build.ts");

124

125async function runBuild(): Promise<boolean> {

126 console.log("🏗️ Building...");

127 const proc = spawn(["bun", "run", BUILD_SCRIPT], {

128 stdout: "inherit",

High

Child Process

Package source references child process execution.

src/core/dev.tsView on unpkg · L126

129 stderr: "inherit",

130 cwd: process.cwd(),

131 env: { ...process.env, BOSIA_OUT_DIR: DEV_OUT_DIR },

132 });

133 return (await proc.exited) === 0;

134}

135

136// ─── Ports ────────────────────────────────────────────────

137

138const DEV_PORT = Number(process.env.PORT) || 9000;

139const APP_PORT = DEV_PORT + 1; // internal, hidden from user

140

141// A previous dev session's app-server child can outlive its parent: an unclean

142// stop (SIGKILL, IDE stop button, crash) skips graceful cleanup, or a shutdown

143// slower than the SIGTERM grace window orphans it. The orphan keeps APP_PORT

144// bound and answers the new proxy with bundle hashes that no longer exist on

145// disk → "ENOENT reading +page-<hash>.js" 500s. Reap whatever is listening on

146// APP_PORT before we spawn, so a stale child can never shadow the fresh build.

src/core/plugin.tsView file

Lines 1-33typescript

1import { join, dirname } from "path";

3import { resolveImportPath } from "./resolveImport.ts";

5// ─── Bun Build Plugin ─────────────────────────────────────

6// Resolves:

7// bosia:routes → .bosia/routes.ts (generated route map)

8// $env → .bosia/env.server.ts (bun) or .bosia/env.client.ts (browser)

9// $* → resolved dynamically via tsconfig.json compilerOptions.paths

src/cli/registry.tsView file

Lines 164-204typescript

164 }

165 }

166

167 if (changes.scripts && Object.keys(changes.scripts).length > 0) {

168 pkg.scripts = pkg.scripts ?? {};

169 for (const [key, val] of