registry / spark-ssr / 1.3.3

spark-ssr@1.3.3

Zero-config SSR for spark-html on Bun. The HTML template infers everything: filesystem routing, layouts, <spark-ssr> declarative data (SQL, URLs, globs, modules), auto CRUD with validation, guards, no-JS forms, schema + seeds, live updates, SEO. Precompil

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No package-owned malicious attack surface is confirmed. Dynamic code, networking, imports, and filesystem writes implement declared SSR application features and are activated by developer-authored project content or explicit CLI commands.

Static reason

One or more suspicious static signals were detected.

Trigger

Developer runs the CLI/server or supplies page, job, module, URL, and mail configuration.

Impact

No unconsented install-time execution, exfiltration, persistence, or foreign control-surface mutation found.

Mechanism

Project-scoped SSR rendering, data loading, jobs, and build assembly.

Rationale

The flagged primitives are intentional framework capabilities scoped to a developer’s project configuration and runtime. Source inspection found no lifecycle execution or concrete malicious chain.

Evidence

package.jsonbin/cli.jssrc/config.jssrc/jobs.jssrc/page.jssrc/request.jssrc/render.jssrc/sources.jssrc/static.jsdist/uploads/

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for block

src/page.js compiles project page <script> content with AsyncFunction at request time.
src/sources.js fetches developer-declared URL sources and imports root-contained modules.
bin/cli.js can remove and recreate the user project’s dist/ during explicit build.

Evidence against

package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
No hard-coded external endpoint, credential harvesting, shell execution, or agent-control-surface path was found.
src/sources.js and src/jobs.js constrain module paths to the configured project root.
bin/cli.js filesystem writes and Bun.spawnSync occur only under explicit CLI build commands.
src/static.js blocks serving project config, databases, seed data, and server-side directories.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 251 KB of source

Source & flagged code

3 flagged

src/crud.jsView file

Lines 118-158javascript

118 if (isAuthTable && 'auth' in req.query) return login(req);

119 const { names, scoped } = await tableInfo(table);

120 if (scoped && !req.session) return json({ error: 'unauthorized' }, 401);

121 const { fields } = await req.body();

122 // The markup's constraint attributes are the validation spec (§6).

123 const rules = validators.get(table);

124 if (rules) {

125 const errors = validateFields(rules, fields);

126 if (errors) return json({ errors }, 422);

127 }

128 // The auth table is an identity store, not ordinary CRUD. Its built-in

129 // /signup screen is synthesized (never scanned by extractForms), so its

130 // `required` fields are re-checked here — a row with a null password

131 // could never log in (timingSafeEqual against nothing). And the

132 // identity must be unique: login matches the first row, so a duplicate

133 // would be a dead account with no error explaining why.

134 if (isAuthTable) {

135 const identity = config.auth.identity || 'email';

136 const errors = {};

137 if (!String(fields[identity] ?? '').trim()) errors[identity] = `${identity} is required`;

138 if (!String(fields.password ?? '')) errors.password = 'password is required';

Medium

Secret Pattern

Package contains a possible secret pattern.

src/crud.jsView on unpkg · L138

139 if (Object.keys(errors).length) return json({ errors }, 422);

140 const dup = await db.query(`SELECT id FROM ${table} WHERE ${identity} = ?`, [fields[identity]]);

141 if (dup.length) {

142 return json({ errors: { [identity]: `that ${identity} is already registered — log in instead` } }, 409);

143 }

144 }

145 const data = {};

146 for (const [k, v] of Object.entries(fields)) {

147 if (names.includes(k) && k !== 'id' && k !== 'user_id') data[k] = v;

148 }

149 // Passwords never land in the auth table as plaintext.

150 if (isAuthTable && typeof data.password === 'string') {

151 data.password = await Bun.password.hash(data.password);

152 }

153 if (scoped) data.user_id = req.session.id;

154 const keys = Object.keys(data);

155 if (!keys.length) return json({ error: 'empty body' }, 400);

156 const rows = await db.query(

157 `INSERT INTO ${table} (${keys.join(', ')}) VALUES (${keys.map(() => '?').join(', ')}) RETURNING *`,

158 keys.map((k) => data[k]),

src/render.jsView file

Lines 3-43javascript

3 * <template each/if/else-if/else/await>, :attr dynamics, and <div import>

4 * component composition — rendered to static HTML. Event handlers and bind:

5 * attributes are stripped (the hydration component re-attaches them

6 * client-side; static pages don't need them).

7 *

8 * Precompiled (§1 of ssr-improvements.md): linkedom parses each template

9 * ONCE, at compile time — the parsed DOM is walked into a flat program of

src/server.jsView file

Lines 474-514javascript

474 const routes = makeRoutes(app);

475 const { refreshApi, matchApi, refreshMiddleware, mwState } = routes;

476

477 // ── the Spark family, wired in ──

478 // Companion packages the app depends on get an importmap entry and are

479 // served at /@modules/<name>, so client scripts import them bare — the same

Source & flagged code

3 flagged · loading source

src/crud.jsView file

138patternName = generic_password severity = medium line = 138 matchedText = if (!Str...ed';

Medium

Secret Pattern

Package contains a possible secret pattern.

src/crud.jsView on unpkg · L138

src/render.jsView file

23if (!fn) { L24: try { fn = new Function('__scope__', 'with (__scope__) { return (' + expr + '); }'); } L25: catch { fn = () => undefined; }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/render.jsView on unpkg · L23

src/server.jsView file

494// Resolve from the APP's root, not this module's own location — a bare L495: // `import('spark-html-theme/init')` would resolve relative to L496: // server.js, which only works when the installer hoists the app's deps

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/server.jsView on unpkg · L494

Findings

4 Medium4 Low

MediumSecret Patternsrc/crud.js

MediumDynamic Requiresrc/server.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvalsrc/render.js

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

src/crud.jsView file

Lines 118-158javascript

118 if (isAuthTable && 'auth' in req.query) return login(req);

119 const { names, scoped } = await tableInfo(table);

120 if (scoped && !req.session) return json({ error: 'unauthorized' }, 401);

121 const { fields } = await req.body();

122 // The markup's constraint attributes are the validation spec (§6).

123 const rules = validators.get(table);

124 if (rules) {

125 const errors = validateFields(rules, fields);

126 if (errors) return json({ errors }, 422);

127 }

128 // The auth table is an identity store, not ordinary CRUD. Its built-in

129 // /signup screen is synthesized (never scanned by extractForms), so its

130 // `required` fields are re-checked here — a row with a null password

131 // could never log in (timingSafeEqual against nothing). And the

132 // identity must be unique: login matches the first row, so a duplicate

133 // would be a dead account with no error explaining why.

134 if (isAuthTable) {

135 const identity = config.auth.identity || 'email';

136 const errors = {};

137 if (!String(fields[identity] ?? '').trim()) errors[identity] = `${identity} is required`;

138 if (!String(fields.password ?? '')) errors.password = 'password is required';

Medium

Secret Pattern

Package contains a possible secret pattern.

src/crud.jsView on unpkg · L138

139 if (Object.keys(errors).length) return json({ errors }, 422);

140 const dup = await db.query(`SELECT id FROM ${table} WHERE ${identity} = ?`, [fields[identity]]);

141 if (dup.length) {

142 return json({ errors: { [identity]: `that ${identity} is already registered — log in instead` } }, 409);

143 }

144 }

145 const data = {};

146 for (const [k, v] of Object.entries(fields)) {

147 if (names.includes(k) && k !== 'id' && k !== 'user_id') data[k] = v;

148 }

149 // Passwords never land in the auth table as plaintext.

150 if (isAuthTable && typeof data.password === 'string') {

151 data.password = await Bun.password.hash(data.password);

152 }

153 if (scoped) data.user_id = req.session.id;

154 const keys = Object.keys(data);

155 if (!keys.length) return json({ error: 'empty body' }, 400);

156 const rows = await db.query(

157 `INSERT INTO ${table} (${keys.join(', ')}) VALUES (${keys.map(() => '?').join(', ')}) RETURNING *`,

158 keys.map((k) => data[k]),

src/render.jsView file

Lines 3-43javascript

3 * <template each/if/else-if/else/await>, :attr dynamics, and <div import>

4 * component composition — rendered to static HTML. Event handlers and bind:

5 * attributes are stripped (the hydration component re-attaches them

6 * client-side; static pages don't need them).

7 *

8 * Precompiled (§1 of ssr-improvements.md): linkedom parses each template

9 * ONCE, at compile time — the parsed DOM is walked into a flat program of

src/server.jsView file

Lines 474-514javascript

474 const routes = makeRoutes(app);

475 const { refreshApi, matchApi, refreshMiddleware, mwState } = routes;

476

477 // ── the Spark family, wired in ──

478 // Companion packages the app depends on get an importmap entry and are

479 // served at /@modules/<name>, so client scripts import them bare — the same