registry / spark-ssr / 1.3.0

spark-ssr@1.3.0

Zero-config SSR for spark-html on Bun. The HTML template infers everything: filesystem routing, layouts, <spark-ssr> declarative data (SQL, URLs, globs, modules), auto CRUD with validation, guards, no-JS forms, schema + seeds, live updates, SEO. Precompil

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed malicious package attack surface was established. Runtime network, filesystem, and dynamic-code features implement the documented SSR framework for the user’s project.

Static reason

One or more suspicious static signals were detected.

Trigger

Explicit CLI use or runtime serving of a user project.

Impact

No package-originated exfiltration, persistence, or unconsented install-time mutation found.

Mechanism

Project-defined routes, URL sources, modules, and build output.

Rationale

The flagged primitives are explicit SSR framework capabilities activated by user project content or CLI commands. Source inspection found no lifecycle execution or concrete malicious chain.

Evidence

package.jsonbin/cli.jssrc/server.jssrc/sources.jssrc/routes.jssrc/static.jssrc/jobs.jssrc/config.jssrc/db.jssrc/request.js

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall lifecycle hook.
bin/cli.js performs build and filesystem writes only after explicit CLI commands.
src/sources.js fetches URLs and imports modules supplied by the hosted app configuration.
src/routes.js compiles server scripts from the hosted app's api/middleware files, not package payloads.
No fixed external endpoint, credential harvesting, AI-agent mutation, or stealth persistence found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 248 KB of source

Source & flagged code

3 flagged

src/crud.jsView file

Lines 108-148javascript

108 if (isAuthTable && 'auth' in req.query) return login(req);

109 const { names, scoped } = await tableInfo(table);

110 if (scoped && !req.session) return json({ error: 'unauthorized' }, 401);

111 const { fields } = await req.body();

112 // The markup's constraint attributes are the validation spec (§6).

113 const rules = validators.get(table);

114 if (rules) {

115 const errors = validateFields(rules, fields);

116 if (errors) return json({ errors }, 422);

117 }

118 // The auth table is an identity store, not ordinary CRUD. Its built-in

119 // /signup screen is synthesized (never scanned by extractForms), so its

120 // `required` fields are re-checked here — a row with a null password

121 // could never log in (timingSafeEqual against nothing). And the

122 // identity must be unique: login matches the first row, so a duplicate

123 // would be a dead account with no error explaining why.

124 if (isAuthTable) {

125 const identity = config.auth.identity || 'email';

126 const errors = {};

127 if (!String(fields[identity] ?? '').trim()) errors[identity] = `${identity} is required`;

128 if (!String(fields.password ?? '')) errors.password = 'password is required';

Medium

Secret Pattern

Package contains a possible secret pattern.

src/crud.jsView on unpkg · L128

129 if (Object.keys(errors).length) return json({ errors }, 422);

130 const dup = await db.query(`SELECT id FROM ${table} WHERE ${identity} = ?`, [fields[identity]]);

131 if (dup.length) {

132 return json({ errors: { [identity]: `that ${identity} is already registered — log in instead` } }, 409);

133 }

134 }

135 const data = {};

136 for (const [k, v] of Object.entries(fields)) {

137 if (names.includes(k) && k !== 'id' && k !== 'user_id') data[k] = v;

138 }

139 // Passwords never land in the auth table as plaintext.

140 if (isAuthTable && typeof data.password === 'string') {

141 data.password = await Bun.password.hash(data.password);

142 }

143 if (scoped) data.user_id = req.session.id;

144 const keys = Object.keys(data);

145 if (!keys.length) return json({ error: 'empty body' }, 400);

146 const rows = await db.query(

147 `INSERT INTO ${table} (${keys.join(', ')}) VALUES (${keys.map(() => '?').join(', ')}) RETURNING *`,

148 keys.map((k) => data[k]),

src/render.jsView file

Lines 3-43javascript

3 * <template each/if/else-if/else/await>, :attr dynamics, and <div import>

4 * component composition — rendered to static HTML. Event handlers and bind:

5 * attributes are stripped (the hydration component re-attaches them

6 * client-side; static pages don't need them).

7 *

8 * Precompiled (§1 of ssr-improvements.md): linkedom parses each template

9 * ONCE, at compile time — the parsed DOM is walked into a flat program of

src/server.jsView file

Lines 473-513javascript

473 const routes = makeRoutes(app);

474 const { refreshApi, matchApi, refreshMiddleware, mwState } = routes;

475

476 // ── the Spark family, wired in ──

477 // Companion packages the app depends on get an importmap entry and are

478 // served at /@modules/<name>, so client scripts import them bare — the same

Source & flagged code

3 flagged · loading source

src/crud.jsView file

128patternName = generic_password severity = medium line = 128 matchedText = if (!Str...ed';

Medium

Secret Pattern

Package contains a possible secret pattern.

src/crud.jsView on unpkg · L128

src/render.jsView file

23if (!fn) { L24: try { fn = new Function('__scope__', 'with (__scope__) { return (' + expr + '); }'); } L25: catch { fn = () => undefined; }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/render.jsView on unpkg · L23

src/server.jsView file

493// Resolve from the APP's root, not this module's own location — a bare L494: // `import('spark-html-theme/init')` would resolve relative to L495: // server.js, which only works when the installer hoists the app's deps

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/server.jsView on unpkg · L493

Findings

4 Medium4 Low

MediumSecret Patternsrc/crud.js

MediumDynamic Requiresrc/server.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvalsrc/render.js

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

src/crud.jsView file

Lines 108-148javascript

108 if (isAuthTable && 'auth' in req.query) return login(req);

109 const { names, scoped } = await tableInfo(table);

110 if (scoped && !req.session) return json({ error: 'unauthorized' }, 401);

111 const { fields } = await req.body();

112 // The markup's constraint attributes are the validation spec (§6).

113 const rules = validators.get(table);

114 if (rules) {

115 const errors = validateFields(rules, fields);

116 if (errors) return json({ errors }, 422);

117 }

118 // The auth table is an identity store, not ordinary CRUD. Its built-in

119 // /signup screen is synthesized (never scanned by extractForms), so its

120 // `required` fields are re-checked here — a row with a null password

121 // could never log in (timingSafeEqual against nothing). And the

122 // identity must be unique: login matches the first row, so a duplicate

123 // would be a dead account with no error explaining why.

124 if (isAuthTable) {

125 const identity = config.auth.identity || 'email';

126 const errors = {};

127 if (!String(fields[identity] ?? '').trim()) errors[identity] = `${identity} is required`;

128 if (!String(fields.password ?? '')) errors.password = 'password is required';

Medium

Secret Pattern

Package contains a possible secret pattern.

src/crud.jsView on unpkg · L128

129 if (Object.keys(errors).length) return json({ errors }, 422);

130 const dup = await db.query(`SELECT id FROM ${table} WHERE ${identity} = ?`, [fields[identity]]);

131 if (dup.length) {

132 return json({ errors: { [identity]: `that ${identity} is already registered — log in instead` } }, 409);

133 }

134 }

135 const data = {};

136 for (const [k, v] of Object.entries(fields)) {

137 if (names.includes(k) && k !== 'id' && k !== 'user_id') data[k] = v;

138 }

139 // Passwords never land in the auth table as plaintext.

140 if (isAuthTable && typeof data.password === 'string') {

141 data.password = await Bun.password.hash(data.password);

142 }

143 if (scoped) data.user_id = req.session.id;

144 const keys = Object.keys(data);

145 if (!keys.length) return json({ error: 'empty body' }, 400);

146 const rows = await db.query(

147 `INSERT INTO ${table} (${keys.join(', ')}) VALUES (${keys.map(() => '?').join(', ')}) RETURNING *`,

148 keys.map((k) => data[k]),

src/render.jsView file

Lines 3-43javascript

3 * <template each/if/else-if/else/await>, :attr dynamics, and <div import>

4 * component composition — rendered to static HTML. Event handlers and bind:

5 * attributes are stripped (the hydration component re-attaches them

6 * client-side; static pages don't need them).

7 *

8 * Precompiled (§1 of ssr-improvements.md): linkedom parses each template

9 * ONCE, at compile time — the parsed DOM is walked into a flat program of

src/server.jsView file

Lines 473-513javascript

473 const routes = makeRoutes(app);

474 const { refreshApi, matchApi, refreshMiddleware, mwState } = routes;

475

476 // ── the Spark family, wired in ──

477 // Companion packages the app depends on get an importmap entry and are

478 // served at /@modules/<name>, so client scripts import them bare — the same