Loading npm security reports…

jsda-kit@1.6.1: Suspicious npm security report (Warn) | LPM Firewall

registry / jsda-kit / 1.6.1

jsda-kit@1.6.1

JSDA Toolkit for modern Web

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 37 file(s), 61.1 KB of source, external domains: cdn.jsdelivr.net, github.com, www.sitemaps.org

Source & flagged code

4 flagged

cli/scaffold.jsView file

Lines 1-28javascript

1import fs from 'fs';

2import path from 'path';

3import { Log } from '../node/Log.js';

4import { execSync } from 'child_process';

High

Child Process

Package source references child process execution.

cli/scaffold.jsView on unpkg · L3

6export function scaffold() {

7 try {

8 Log.info('JSDA CLI:', 'Fetching template from https://github.com/rnd-pro/jsda-template...');

9 execSync('npx -y degit rnd-pro/jsda-template .', { stdio: 'inherit' });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/scaffold.jsView on unpkg · L8

11 if (fs.existsSync('./package.json')) {

12 let folderName = path.basename(process.cwd());

13 let pkgStr = fs.readFileSync('./package.json', 'utf8');

14 let pkg = JSON.parse(pkgStr);

15 pkg.name = folderName;

16 pkg.version = '0.0.1';

17 fs.writeFileSync('./package.json', JSON.stringify(pkg, null, 2) + '\n', 'utf8');

18 Log.success('JSDA CLI:', `Updated package.json project name to "${folderName}"`);

19 }

21 if (fs.existsSync('./package-lock.json')) {

22 fs.unlinkSync('./package-lock.json');

23 }

25 let secretsDir = path.join(process.cwd(), 'secrets');

26 if (!fs.existsSync(secretsDir)) {

27 fs.mkdirSync(secretsDir, { recursive: true });

28 }

node/watch.jsView file

Lines 1-41javascript

1import fs from 'fs';

2import { spawn } from 'child_process';

3import CFG from '../cfg/CFG.js';

4import { Log } from './Log.js';

server/JSDAServer.jsView file

Lines 139-179javascript

139 // Handle JS bundles:

140 try {

141 respond('text/javascript', await jsBuild(filePath));

142 } catch (err) {

143 Log.err('JS build error:', err);

Source & flagged code

4 flagged · loading source

cli/scaffold.jsView file

3import { Log } from '../node/Log.js'; L4: import { execSync } from 'child_process'; L5:

High

Child Process

Package source references child process execution.

cli/scaffold.jsView on unpkg · L3

8Log.info('JSDA CLI:', 'Fetching template from https://github.com/rnd-pro/jsda-template...'); L9: execSync('npx -y degit rnd-pro/jsda-template .', { stdio: 'inherit' }); L10:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/scaffold.jsView on unpkg · L8

node/watch.jsView file

21serveStarted = true; L22: let serve = spawn('npx', ['-y', 'serve', out, '-l', String(port)], { stdio: 'pipe', shell: true }); L23: serve.stdout.on('data', (data) => {

High

Shell

Package source references shell execution.

node/watch.jsView on unpkg · L21

Findings

3 High4 Medium3 Low

HighChild Processcli/scaffold.js

HighShellnode/watch.js

HighRuntime Package Installcli/scaffold.js

MediumDynamic Requireserver/JSDAServer.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings