registry / srvx-nightly / 0.11.19-20260702-114953-57001b6

srvx-nightly@0.11.19-20260702-114953-57001b6

Universal Server.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The suspicious primitives are aligned with a universal server CLI that serves local entrypoints, static files, and explicit fetch requests.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the srvx CLI or imports package adapters.

Impact

No unauthorized impact identified by static inspection.

Mechanism

User-invoked server framework and CLI utilities

Rationale

Static inspection found potentially dangerous primitives only in package-aligned, user-invoked paths: running a dev server, loading the user's server entry, serving static files, or fetching explicit URLs. There is no install-time execution, hidden endpoint, credential collection, persistence, destructive behavior, or unconsented agent-control mutation.

Evidence

package.jsonbin/srvx.mjsdist/cli.mjsdist/loader.mjsdist/static.mjsdist/adapters/node.mjsdist/_chunks/_plugins.mjs

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/cli.mjs forks its own CLI process for dev/watch mode and supports user-specified --import.
dist/loader.mjs dynamically imports a user-selected server entry file.
dist/cli.mjs fetch mode can request user-provided remote URLs.

Evidence against

package.json has no install/postinstall lifecycle hooks; only prepack is publish-time.
bin/srvx.mjs only delegates to dist/cli.mjs main().
Child process, dynamic import, env loading, and fetch are CLI/server-framework features activated by user commands.
No credential harvesting, hardcoded exfiltration endpoint, persistence, destructive file writes, or AI-agent control-surface mutation found.
dist/static.mjs only reads requested files under a configured static directory with path containment.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 19 file(s), 84.4 KB of source, external domains: github.com, srvx.h3.dev

Source & flagged code

4 flagged

dist/cli.mjsView file

Lines 1-24javascript

1import { bold, cyan, gray, green, magenta, red, url, yellow } from "./_chunks/_utils.mjs";

2import { loadServerEntry } from "./loader.mjs";

3import { parseArgs } from "node:util";

4import { fileURLToPath } from "node:url";

5import { fork } from "node:child_process";

6import { createReadStream, existsSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L4

7import { dirname, relative, resolve } from "node:path";

8import { Readable } from "node:stream";

9const NO_ENTRY_ERROR = "No server entry or public directory found";

10async function cliServe(cliOpts) {

11 try {

12 if (!process.env.NODE_ENV) process.env.NODE_ENV = cliOpts.prod ? "production" : "development";

13 let server;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L4

14 const loaded = await loadServerEntry({

15 entry: cliOpts.entry,

16 dir: cliOpts.dir,

17 get srvxServer() {

18 return server;

19 }

20 });

21 const { serve: srvxServe } = loaded.nodeCompat ? await import("srvx-nightly/node") : await import("srvx-nightly");

22 const { serveStatic } = await import("srvx-nightly/static");

23 const { log } = await import("srvx-nightly/log");

24 const staticDir = resolve(cliOpts.dir || (loaded.url ? dirname(fileURLToPath(loaded.url)) : "."), cliOpts.static || "public");

Lines 352-392javascript

352 data: {

353 type: "string",

354 short: "d"

355 }

356 }

357 });

358 if (positionals[0] === "fetch" || positionals[0] === "curl") positionals.shift

dist/loader.mjsView file

Lines 21-61javascript

21 entry = resolve(opts.dir || ".", entry);

22 if (!existsSync(entry)) return { notFound: true };

23 } else {

24 for (const defEntry of defaultEntries) {

Source & flagged code

4 flagged · loading source

dist/cli.mjsView file

4import { fileURLToPath } from "node:url"; L5: import { fork } from "node:child_process"; L6: import { createReadStream, existsSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L4

372async function forkCLI(args, runtimeArgs) { L373: const child = fork(fileURLToPath(globalThis.__SRVX_BIN__ || new URL("../bin/srvx.mjs", import.meta.url)), [...args], { execArgv: [...process.execArgv, ...runtimeArgs].filter(Boolea... L374: child.on("error", (error) => {

High

Shell

Package source references shell execution.

dist/cli.mjsView on unpkg · L372

4Cross-file remote execution chain: dist/cli.mjs spawns dist/loader.mjs; helper contains network access plus dynamic code execution. L4: import { fileURLToPath } from "node:url"; L5: import { fork } from "node:child_process"; L6: import { createReadStream, existsSync, statSync } from "node:fs"; ... L11: try { L12: if (!process.env.NODE_ENV) process.env.NODE_ENV = cliOpts.prod ? "production" : "development"; L13: let server; ... L90: } L91: async function cliFetch(cliOpts) { L92: const stdin = cliOpts.stdin || process.stdin; L93: const stdout = cliOpts.stdout || process.stdout; L94: const stderr = cliOpts.stderr || process.stderr; ... L103: if (cliOpts.verbose && loaded.url) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L4

dist/loader.mjsView file

41if (opts.interceptHttpListen !== false) { L42: const loaded = await interceptListen(() => import(url), opts); L43: mod = loaded.res;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/loader.mjsView on unpkg · L41

Findings

3 High4 Medium4 Low

HighChild Processdist/cli.mjs

HighShelldist/cli.mjs

HighCross File Remote Execution Contextdist/cli.mjs

MediumDynamic Requiredist/loader.mjs

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/cli.mjsView file

Lines 1-24javascript

1import { bold, cyan, gray, green, magenta, red, url, yellow } from "./_chunks/_utils.mjs";

2import { loadServerEntry } from "./loader.mjs";

3import { parseArgs } from "node:util";

4import { fileURLToPath } from "node:url";

5import { fork } from "node:child_process";

6import { createReadStream, existsSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L4

7import { dirname, relative, resolve } from "node:path";

8import { Readable } from "node:stream";

9const NO_ENTRY_ERROR = "No server entry or public directory found";

10async function cliServe(cliOpts) {

11 try {

12 if (!process.env.NODE_ENV) process.env.NODE_ENV = cliOpts.prod ? "production" : "development";

13 let server;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L4

14 const loaded = await loadServerEntry({

15 entry: cliOpts.entry,

16 dir: cliOpts.dir,

17 get srvxServer() {

18 return server;

19 }

20 });

21 const { serve: srvxServe } = loaded.nodeCompat ? await import("srvx-nightly/node") : await import("srvx-nightly");

22 const { serveStatic } = await import("srvx-nightly/static");

23 const { log } = await import("srvx-nightly/log");

24 const staticDir = resolve(cliOpts.dir || (loaded.url ? dirname(fileURLToPath(loaded.url)) : "."), cliOpts.static || "public");

Lines 352-392javascript

352 data: {

353 type: "string",

354 short: "d"

355 }

356 }

357 });

358 if (positionals[0] === "fetch" || positionals[0] === "curl") positionals.shift

dist/loader.mjsView file

Lines 21-61javascript

21 entry = resolve(opts.dir || ".", entry);

22 if (!existsSync(entry)) return { notFound: true };

23 } else {

24 for (const defEntry of defaultEntries) {