registry / spark-ssr / 1.1.1

spark-ssr@1.1.1

Zero-config SSR for spark-html on Bun. The HTML template infers everything: filesystem routing, layouts, <spark-ssr> declarative data (SQL, URLs, globs, modules), auto CRUD with validation, guards, no-JS forms, schema + seeds, live updates, SEO. Precompil

AI Security Review

scanned 5d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The risky primitives are framework features for a Bun SSR server and are activated by user project templates, CLI commands, or runtime HTTP requests.

Static reason

One or more suspicious static signals were detected.

Trigger

User invokes spark-ssr CLI or imports serve() for a project.

Impact

Package-aligned server behavior; no install-time mutation, persistence, credential exfiltration, or remote payload execution found in package source.

Mechanism

SSR framework with project-file routing, user-declared fetch/module/script execution, DB CRUD, uploads, and build output generation.

Rationale

Static inspection shows a Bun SSR framework whose dynamic imports, fetches, code generation, DB access, uploads, and filesystem writes are package-aligned and user/project-driven. There are no lifecycle hooks, hidden network endpoints, credential harvesting, AI-agent control-surface writes, or unconsented install/import-time behavior indicating malware.

Evidence

package.jsonbin/cli.jssrc/server.jssrc/sources.jssrc/routes.jssrc/render.jssrc/request.jssrc/config.jssrc/crud.jssrc/schema.jssrc/jobs.jsdist/dist/__server.jsdist/Dockerfileuploads/spark.jsonproject pages/api/middleware/seed/content/lib files

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall hooks; main is src/index.js and bin is bin/cli.js.
bin/cli.js only serves/builds/db-diffs user project roots; writes dist/, Dockerfile, and runs bun build only on explicit build command.
src/sources.js fetches user-declared URLs, reads project globs, and imports project modules constrained under root.
src/routes.js/src/render.js use AsyncFunction/new Function to run project templates, API files, and middleware at user request time.
src/config.js resolves ENV.* config values locally; no credential harvesting or exfiltration path found.
src/crud.js/schema.js handle app DB CRUD, auth hashing, schema creation, and seed import for declared project tables.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 229 KB of source

Source & flagged code

3 flagged

src/crud.jsView file

Lines 108-148javascript

108 if (isAuthTable && 'auth' in req.query) return login(req);

109 const { names, scoped } = await tableInfo(table);

110 if (scoped && !req.session) return json({ error: 'unauthorized' }, 401);

111 const { fields } = await req.body();

112 // The markup's constraint attributes are the validation spec (§6).

113 const rules = validators.get(table);

114 if (rules) {

115 const errors = validateFields(rules, fields);

116 if (errors) return json({ errors }, 422);

117 }

118 // The auth table is an identity store, not ordinary CRUD. Its built-in

119 // /signup screen is synthesized (never scanned by extractForms), so its

120 // `required` fields are re-checked here — a row with a null password

121 // could never log in (timingSafeEqual against nothing). And the

122 // identity must be unique: login matches the first row, so a duplicate

123 // would be a dead account with no error explaining why.

124 if (isAuthTable) {

125 const identity = config.auth.identity || 'email';

126 const errors = {};

127 if (!String(fields[identity] ?? '').trim()) errors[identity] = `${identity} is required`;

128 if (!String(fields.password ?? '')) errors.password = 'password is required';

Medium

Secret Pattern

Package contains a possible secret pattern.

src/crud.jsView on unpkg · L128

129 if (Object.keys(errors).length) return json({ errors }, 422);

130 const dup = await db.query(`SELECT id FROM ${table} WHERE ${identity} = ?`, [fields[identity]]);

131 if (dup.length) {

132 return json({ errors: { [identity]: `that ${identity} is already registered — log in instead` } }, 409);

133 }

134 }

135 const data = {};

136 for (const [k, v] of Object.entries(fields)) {

137 if (names.includes(k) && k !== 'id' && k !== 'user_id') data[k] = v;

138 }

139 // Passwords never land in the auth table as plaintext.

140 if (isAuthTable && typeof data.password === 'string') {

141 data.password = await Bun.password.hash(data.password);

142 }

143 if (scoped) data.user_id = req.session.id;

144 const keys = Object.keys(data);

145 if (!keys.length) return json({ error: 'empty body' }, 400);

146 const rows = await db.query(

147 `INSERT INTO ${table} (${keys.join(', ')}) VALUES (${keys.map(() => '?').join(', ')}) RETURNING *`,

148 keys.map((k) => data[k]),

src/render.jsView file

Lines 3-43javascript

3 * <template each/if/else-if/else/await>, :attr dynamics, and <div import>

4 * component composition — rendered to static HTML. Event handlers and bind:

5 * attributes are stripped (the hydration component re-attaches them

6 * client-side; static pages don't need them).

7 *

8 * Precompiled (§1 of ssr-improvements.md): linkedom parses each template

9 * ONCE, at compile time — the parsed DOM is walked into a flat program of

src/server.jsView file

Lines 406-446javascript

406 const routes = makeRoutes(app);

407 const { refreshApi, matchApi, refreshMiddleware, mwState } = routes;

408

409 // ── the Spark family, wired in ──

410 // Companion packages the app depends on get an importmap entry and are

411 // served at /@modules/<name>, so client scripts import them bare — the same

Source & flagged code

3 flagged · loading source

src/crud.jsView file

128patternName = generic_password severity = medium line = 128 matchedText = if (!Str...ed';

Medium

Secret Pattern

Package contains a possible secret pattern.

src/crud.jsView on unpkg · L128

src/render.jsView file

23if (!fn) { L24: try { fn = new Function('__scope__', 'with (__scope__) { return (' + expr + '); }'); } L25: catch { fn = () => undefined; }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/render.jsView on unpkg · L23

src/server.jsView file

426// Resolve from the APP's root, not this module's own location — a bare L427: // `import('spark-html-theme/init')` would resolve relative to L428: // server.js, which only works when the installer hoists the app's deps

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/server.jsView on unpkg · L426

Findings

4 Medium4 Low

MediumSecret Patternsrc/crud.js

MediumDynamic Requiresrc/server.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvalsrc/render.js

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

src/crud.jsView file

Lines 108-148javascript

108 if (isAuthTable && 'auth' in req.query) return login(req);

109 const { names, scoped } = await tableInfo(table);

110 if (scoped && !req.session) return json({ error: 'unauthorized' }, 401);

111 const { fields } = await req.body();

112 // The markup's constraint attributes are the validation spec (§6).

113 const rules = validators.get(table);

114 if (rules) {

115 const errors = validateFields(rules, fields);

116 if (errors) return json({ errors }, 422);

117 }

118 // The auth table is an identity store, not ordinary CRUD. Its built-in

119 // /signup screen is synthesized (never scanned by extractForms), so its

120 // `required` fields are re-checked here — a row with a null password

121 // could never log in (timingSafeEqual against nothing). And the

122 // identity must be unique: login matches the first row, so a duplicate

123 // would be a dead account with no error explaining why.

124 if (isAuthTable) {

125 const identity = config.auth.identity || 'email';

126 const errors = {};

127 if (!String(fields[identity] ?? '').trim()) errors[identity] = `${identity} is required`;

128 if (!String(fields.password ?? '')) errors.password = 'password is required';

Medium

Secret Pattern

Package contains a possible secret pattern.

src/crud.jsView on unpkg · L128

129 if (Object.keys(errors).length) return json({ errors }, 422);

130 const dup = await db.query(`SELECT id FROM ${table} WHERE ${identity} = ?`, [fields[identity]]);

131 if (dup.length) {

132 return json({ errors: { [identity]: `that ${identity} is already registered — log in instead` } }, 409);

133 }

134 }

135 const data = {};

136 for (const [k, v] of Object.entries(fields)) {

137 if (names.includes(k) && k !== 'id' && k !== 'user_id') data[k] = v;

138 }

139 // Passwords never land in the auth table as plaintext.

140 if (isAuthTable && typeof data.password === 'string') {

141 data.password = await Bun.password.hash(data.password);

142 }

143 if (scoped) data.user_id = req.session.id;

144 const keys = Object.keys(data);

145 if (!keys.length) return json({ error: 'empty body' }, 400);

146 const rows = await db.query(

147 `INSERT INTO ${table} (${keys.join(', ')}) VALUES (${keys.map(() => '?').join(', ')}) RETURNING *`,

148 keys.map((k) => data[k]),

src/render.jsView file

Lines 3-43javascript

3 * <template each/if/else-if/else/await>, :attr dynamics, and <div import>

4 * component composition — rendered to static HTML. Event handlers and bind:

5 * attributes are stripped (the hydration component re-attaches them

6 * client-side; static pages don't need them).

7 *

8 * Precompiled (§1 of ssr-improvements.md): linkedom parses each template

9 * ONCE, at compile time — the parsed DOM is walked into a flat program of

src/server.jsView file

Lines 406-446javascript

406 const routes = makeRoutes(app);

407 const { refreshApi, matchApi, refreshMiddleware, mwState } = routes;

408

409 // ── the Spark family, wired in ──

410 // Companion packages the app depends on get an importmap entry and are

411 // served at /@modules/<name>, so client scripts import them bare — the same