registry / srvx-nightly / 0.11.23-20260714-092010-f2edab1

srvx-nightly@0.11.23-20260714-092010-f2edab1

Universal Server.

AI Security Review

scanned 48m ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. Runtime network access is limited to the explicit user-invoked fetch/curl mode or application server behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the srvx CLI or imports its server adapters.

Impact

No install-time execution, persistence, credential collection, or unsolicited network destination was found.

Mechanism

Local server-entry loading, HTTP serving, and explicit fetch client operation.

Rationale

Scanner signals map to normal server-framework capabilities: an explicit HTTP client command, local entry-module loading, and a self-fork for development runtime flags. Source inspection found no concrete malicious chain.

Evidence

package.jsonbin/srvx.mjsdist/cli.mjsdist/loader.mjsdist/static.mjs

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall lifecycle hook.
bin/srvx.mjs only invokes the packaged CLI entrypoint.
dist/cli.mjs forks its own bin only for CLI watch/import execution.
dist/loader.mjs dynamically imports an explicit or discovered local server entry.
Remote fetch is an explicit srvx fetch/curl user command; no fixed endpoint exists.
No package writes, credential harvesting, exfiltration, or AI-agent config access found.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 21 file(s), 92.1 KB of source, external domains: github.com, srvx.h3.dev

Source & flagged code

4 flagged

dist/cli.mjsView file

Lines 1-24javascript

1import { bold, cyan, gray, green, magenta, red, url, yellow } from "./_chunks/_utils.mjs";

2import { loadServerEntry } from "./loader.mjs";

3import { parseArgs } from "node:util";

4import { fileURLToPath } from "node:url";

5import { fork } from "node:child_process";

6import { createReadStream, existsSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L4

7import { dirname, relative, resolve } from "node:path";

8import { Readable } from "node:stream";

9const NO_ENTRY_ERROR = "No server entry or public directory found";

10async function cliServe(cliOpts) {

11 try {

12 if (!process.env.NODE_ENV) process.env.NODE_ENV = cliOpts.prod ? "production" : "development";

13 let server;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L4

14 const loaded = await loadServerEntry({

15 entry: cliOpts.entry,

16 dir: cliOpts.dir,

17 get srvxServer() {

18 return server;

19 }

20 });

21 const { serve: srvxServe } = loaded.nodeCompat ? await import("srvx-nightly/node") : await import("srvx-nightly");

22 const { serveStatic } = await import("srvx-nightly/static");

23 const { log } = await import("srvx-nightly/log");

24 const staticDir = resolve(cliOpts.dir || (loaded.url ? dirname(fileURLToPath(loaded.url)) : "."), cliOpts.static || "public");

Lines 352-392javascript

352 data: {

353 type: "string",

354 short: "d"

355 }

356 }

357 });

358 if (positionals[0] === "fetch" || positionals[0] === "curl") positionals.shift

dist/loader.mjsView file

Lines 21-61javascript

21 entry = resolve(opts.dir || ".", entry);

22 if (!existsSync(entry)) return { notFound: true };

23 } else {

24 for (const defEntry of defaultEntries) {

Source & flagged code

4 flagged · loading source

dist/cli.mjsView file

4import { fileURLToPath } from "node:url"; L5: import { fork } from "node:child_process"; L6: import { createReadStream, existsSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L4

372async function forkCLI(args, runtimeArgs) { L373: const child = fork(fileURLToPath(globalThis.__SRVX_BIN__ || new URL("../bin/srvx.mjs", import.meta.url)), [...args], { execArgv: [...process.execArgv, ...runtimeArgs].filter(Boolea... L374: child.on("error", (error) => {

High

Shell

Package source references shell execution.

dist/cli.mjsView on unpkg · L372

4Cross-file remote execution chain: dist/cli.mjs spawns dist/loader.mjs; helper contains network access plus dynamic code execution. L4: import { fileURLToPath } from "node:url"; L5: import { fork } from "node:child_process"; L6: import { createReadStream, existsSync, statSync } from "node:fs"; ... L11: try { L12: if (!process.env.NODE_ENV) process.env.NODE_ENV = cliOpts.prod ? "production" : "development"; L13: let server; ... L90: } L91: async function cliFetch(cliOpts) { L92: const stdin = cliOpts.stdin || process.stdin; L93: const stdout = cliOpts.stdout || process.stdout; L94: const stderr = cliOpts.stderr || process.stderr; ... L103: if (cliOpts.verbose && loaded.url) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L4

dist/loader.mjsView file

41if (opts.interceptHttpListen !== false) { L42: const loaded = await interceptListen(() => import(url), opts); L43: mod = loaded.res;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/loader.mjsView on unpkg · L41

Findings

3 High3 Medium4 Low

HighChild Processdist/cli.mjs

HighShelldist/cli.mjs

HighCross File Remote Execution Contextdist/cli.mjs

MediumDynamic Requiredist/loader.mjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/cli.mjsView file

Lines 1-24javascript

1import { bold, cyan, gray, green, magenta, red, url, yellow } from "./_chunks/_utils.mjs";

2import { loadServerEntry } from "./loader.mjs";

3import { parseArgs } from "node:util";

4import { fileURLToPath } from "node:url";

5import { fork } from "node:child_process";

6import { createReadStream, existsSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L4

7import { dirname, relative, resolve } from "node:path";

8import { Readable } from "node:stream";

9const NO_ENTRY_ERROR = "No server entry or public directory found";

10async function cliServe(cliOpts) {

11 try {

12 if (!process.env.NODE_ENV) process.env.NODE_ENV = cliOpts.prod ? "production" : "development";

13 let server;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L4

14 const loaded = await loadServerEntry({

15 entry: cliOpts.entry,

16 dir: cliOpts.dir,

17 get srvxServer() {

18 return server;

19 }

20 });

21 const { serve: srvxServe } = loaded.nodeCompat ? await import("srvx-nightly/node") : await import("srvx-nightly");

22 const { serveStatic } = await import("srvx-nightly/static");

23 const { log } = await import("srvx-nightly/log");

24 const staticDir = resolve(cliOpts.dir || (loaded.url ? dirname(fileURLToPath(loaded.url)) : "."), cliOpts.static || "public");

Lines 352-392javascript

352 data: {

353 type: "string",

354 short: "d"

355 }

356 }

357 });

358 if (positionals[0] === "fetch" || positionals[0] === "curl") positionals.shift

dist/loader.mjsView file

Lines 21-61javascript

21 entry = resolve(opts.dir || ".", entry);

22 if (!existsSync(entry)) return { notFound: true };

23 } else {

24 for (const defEntry of defaultEntries) {