srvx: Clean npm security report (Allow)

Loading npm security reports…

Source & flagged code

4 flagged

dist/cli.mjsView file

Lines 1-24javascript

1import { bold, cyan, gray, green, magenta, red, url, yellow } from "./_chunks/_utils.mjs";

2import { loadServerEntry } from "./loader.mjs";

3import { parseArgs } from "node:util";

4import { fileURLToPath } from "node:url";

5import { fork } from "node:child_process";

6import { createReadStream, existsSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L4

7import { dirname, relative, resolve } from "node:path";

8import { Readable } from "node:stream";

9const NO_ENTRY_ERROR = "No server entry or public directory found";

10async function cliServe(cliOpts) {

11 try {

12 if (!process.env.NODE_ENV) process.env.NODE_ENV = cliOpts.prod ? "production" : "development";

13 let server;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L4

14 const loaded = await loadServerEntry({

15 entry: cliOpts.entry,

16 dir: cliOpts.dir,

17 get srvxServer() {

18 return server;

19 }

20 });

21 const { serve: srvxServe } = loaded.nodeCompat ? await import("srvx/node") : await import("srvx");

22 const { staticMiddleware } = await import("srvx/static");

23 const { loggerMiddleware } = await import("srvx/log");

24 const explicitStatic = !!cliOpts.static;

Lines 388-428javascript

388 url,

389 method

390 };

391 }

392 const maybeEntryOrDir = positionals[0];

393 if (maybeEntryOrDir) {

394 if (values.entry || values.dir) throw new

dist/loader.mjsView file

Lines 24-64javascript

24 if (!existsSync(entry)) return { notFound: true };

25 }

26 else {

27 for (const defEntry of defaultEntries) {

Source & flagged code

4 flagged · loading source

dist/cli.mjsView file

4import { fileURLToPath } from "node:url"; L5: import { fork } from "node:child_process"; L6: import { createReadStream, existsSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L4

408async function forkCLI(args, runtimeArgs) { L409: const child = fork(fileURLToPath(globalThis.__SRVX_BIN__ || new URL("../bin/srvx.mjs", import.meta.url)), [...args], { execArgv: [...process.execArgv, ...runtimeArgs].filter(Boolea... L410: child.on("error", (error) => {

High

Shell

Package source references shell execution.

dist/cli.mjsView on unpkg · L408

4Cross-file remote execution chain: dist/cli.mjs spawns dist/loader.mjs; helper contains network access plus dynamic code execution. L4: import { fileURLToPath } from "node:url"; L5: import { fork } from "node:child_process"; L6: import { createReadStream, existsSync, statSync } from "node:fs"; ... L11: try { L12: if (!process.env.NODE_ENV) process.env.NODE_ENV = cliOpts.prod ? "production" : "development"; L13: let server; ... L109: } L110: async function cliFetch(cliOpts) { L111: const stdin = cliOpts.stdin || process.stdin; L112: const stdout = cliOpts.stdout || process.stdout; L113: const stderr = cliOpts.stderr || process.stderr; ... L122: if (cliOpts.verbose && loaded.url) {

High

srvx: Clean npm security report (Allow) | LPM Firewall

srvx@0.12.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code