registry / clovejs / 0.2.1

clovejs@0.2.1

The backend framework where MCP is a first-class citizen, along with REST and WebSockets. CloveJS brings Next.js/Nuxt-inspired file-based routing to Node.js — your folder structure defines your routes, services, middlewares and injectables, fully typed, w

Static Scan Results

scanned 9h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 276 KB of source

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2import {

3 CloveBootError,

4 createApp,

5 createLogger,

6 deriveContextKey,

7 resolveSourceDir,

8 walkDir

9} from "./chunk-W3VV3AY2.js";

11// src/cli/index.ts

12import { execFileSync } from "child_process";

13import { existsSync } from "fs";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L11

14import { join as join5 } from "path";

16// src/codegen/index.ts

17import { mkdir, writeFile, readFile } from "fs/promises";

18import { join, relative, dirname } from "path";

19var OUTPUT_DIR = ".clove";

20var OUTPUT_FILE = "types.d.ts";

21async function generateTypes(options) {

22 const { rootDir, sourceDir } = options;

23 const servicesDir = join(sourceDir, options.servicesDir ?? "services");

24 const diDir = join(sourceDir, options.diDir ?? "di");

25 const outDir = join(rootDir, OUTPUT_DIR);

26 const outFile = join(outDir, OUTPUT_FILE);

27 const entries = [];

28 const seen = /* @__PURE__ */ new Map();

29 for (const [dir, kind] of [

30 [servicesDir, "service"],

31 [diDir, "di"]

Lines 954-994javascript

954 return;

955 }

956 case "types": {

957 const out = await generateTypes({ rootDir, sourceDir });

958 await ensureGitignore(rootDir);

959 console.log(`Generated ${out}`

dist/mcp.cjsView file

Lines 102-142javascript

102 this.status = status;

103 this.body = body === void 0 ? { message } : body;

104 }

105};

106function

Source & flagged code

3 flagged · loading source

dist/cli.jsView file

11// src/cli/index.ts L12: import { execFileSync } from "child_process"; L13: import { existsSync } from "fs";

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code