registry / spark-ssr / 0.1.0

spark-ssr@0.1.0

Zero-config SSR for spark-html on Bun. The HTML template infers everything: filesystem routing, <spark-ssr> declarative queries, auto CRUD APIs, sessions, uploads, middleware. No build step.

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 59.8 KB of source

Source & flagged code

2 flagged

src/render.jsView file

Lines 1-33javascript

1/**

2 * Server-side renderer for Spark templates: {expr} interpolation,

3 * <template each/if/else-if/else/await>, :attr dynamics, and <div import>

4 * component composition — rendered to static HTML in one pass. Event

5 * handlers and bind: attributes are stripped (the hydration component

6 * re-attaches them client-side; static pages don't need them).

7 */

8import { parseHTML } from 'linkedom';

10const FN_CACHE = new Map();

11function compile(expr) {

12 let fn = FN_CACHE.get(expr);

13 if (!fn) {

14 try { fn = new Function('__scope__', 'with (__scope__) { return (' + expr + '); }'); }

15 catch { fn = () => undefined; }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/render.jsView on unpkg · L13

16 FN_CACHE.set(expr, fn);

17 }

18 return fn;

19}

21// Every identifier resolves through the scope proxy (undefined when absent),

22// with the handful of globals expressions legitimately reach for.

23const GLOBALS = {

24 JSON, Math, Date, Object, Array, String, Number, Boolean,

25 encodeURIComponent, decodeURIComponent, parseInt, parseFloat, isNaN,

26};

27function scopeProxy(scope) {

28 return new Proxy(scope, {

29 has: (t, k) => k !== Symbol.unscopables,

30 get: (t, k) => (k === Symbol.unscopables ? undefined : k in t ? t[k] : GLOBALS[k]),

31 });

32}

33export function evalExpr(expr, scope) {

src/server.jsView file

Lines 286-326javascript

286 // ── auth ──

287 async function login(req) {

288 const { auth } = config;

289 const identity = auth.identity || 'email';

290 const { fields

Source & flagged code

2 flagged · loading source

src/render.jsView file

13if (!fn) { L14: try { fn = new Function('__scope__', 'with (__scope__) { return (' + expr + '); }'); } L15: catch { fn = () => undefined; }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/render.jsView on unpkg · L13

src/server.jsView file

306if (config.auth && config.auth.plugin) { L307: authPlugin = (await import(resolve(root, config.auth.plugin))).default; L308: on('POST', 'api/auth', async (req) => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/server.jsView on unpkg · L306

Findings

3 Medium4 Low

MediumDynamic Requiresrc/server.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvalsrc/render.js

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

src/render.jsView file

Lines 1-33javascript

1/**

2 * Server-side renderer for Spark templates: {expr} interpolation,

3 * <template each/if/else-if/else/await>, :attr dynamics, and <div import>

4 * component composition — rendered to static HTML in one pass. Event

5 * handlers and bind: attributes are stripped (the hydration component

6 * re-attaches them client-side; static pages don't need them).

7 */

8import { parseHTML } from 'linkedom';

10const FN_CACHE = new Map();

11function compile(expr) {

12 let fn = FN_CACHE.get(expr);

13 if (!fn) {

14 try { fn = new Function('__scope__', 'with (__scope__) { return (' + expr + '); }'); }

15 catch { fn = () => undefined; }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/render.jsView on unpkg · L13

16 FN_CACHE.set(expr, fn);

17 }

18 return fn;

19}

21// Every identifier resolves through the scope proxy (undefined when absent),

22// with the handful of globals expressions legitimately reach for.

23const GLOBALS = {

24 JSON, Math, Date, Object, Array, String, Number, Boolean,

25 encodeURIComponent, decodeURIComponent, parseInt, parseFloat, isNaN,

26};

27function scopeProxy(scope) {

28 return new Proxy(scope, {

29 has: (t, k) => k !== Symbol.unscopables,

30 get: (t, k) => (k === Symbol.unscopables ? undefined : k in t ? t[k] : GLOBALS[k]),

31 });

32}

33export function evalExpr(expr, scope) {

src/server.jsView file

Lines 286-326javascript

286 // ── auth ──

287 async function login(req) {

288 const { auth } = config;

289 const identity = auth.identity || 'email';

290 const { fields