registry  /  srvx-nightly  /  0.11.22-20260711-160250-06460a3

srvx-nightly@0.11.22-20260711-160250-06460a3

Universal Server.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The CLI loads a local server entry and can issue a remote request only when the user explicitly runs fetch/curl with a URL.

Static reason
One or more suspicious static signals were detected.
Trigger
Explicit srvx serve/fetch/curl command
Impact
No unconsented installation-time execution, persistence, or data exfiltration established.
Mechanism
User-directed server loading and HTTP request handling
Rationale
Static signals map to normal web-server CLI behavior: self-forking for watch mode, local entry-module loading, environment-file loading, and explicitly requested HTTP fetches. Direct inspection found no concrete malicious chain.
Evidence
package.jsonbin/srvx.mjsdist/cli.mjsdist/loader.mjsdist/static.mjsdist/_chunks/_utils2.mjsREADME.md

Decision evidence

public snapshot
AI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for block
    Evidence against
    • package.json has no preinstall, install, or postinstall lifecycle hook.
    • bin/srvx.mjs only invokes the packaged CLI.
    • dist/cli.mjs forks the same CLI for watch/import runtime flags.
    • dist/cli.mjs performs remote fetches only for explicit fetch/curl URL arguments.
    • dist/loader.mjs dynamically imports the user-selected/local server entry.
    • No package file-write, credential harvesting, exfiltration, eval/vm, or agent-config mutation found.
    Behavioral surface
    Source
    ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
    Supply chain
    HighEntropyStringsUrlStrings
    Manifest
    WildcardDependency
    scanned 20 file(s), 87.9 KB of source, external domains: github.com, srvx.h3.dev

    Source & flagged code

    4 flagged · loading source
    dist/cli.mjsView file
    4import { fileURLToPath } from "node:url"; L5: import { fork } from "node:child_process"; L6: import { createReadStream, existsSync, statSync } from "node:fs";
    High
    Child Process

    Package source references child process execution.

    dist/cli.mjsView on unpkg · L4
    372async function forkCLI(args, runtimeArgs) { L373: const child = fork(fileURLToPath(globalThis.__SRVX_BIN__ || new URL("../bin/srvx.mjs", import.meta.url)), [...args], { execArgv: [...process.execArgv, ...runtimeArgs].filter(Boolea... L374: child.on("error", (error) => {
    High
    Shell

    Package source references shell execution.

    dist/cli.mjsView on unpkg · L372
    4Cross-file remote execution chain: dist/cli.mjs spawns dist/loader.mjs; helper contains network access plus dynamic code execution. L4: import { fileURLToPath } from "node:url"; L5: import { fork } from "node:child_process"; L6: import { createReadStream, existsSync, statSync } from "node:fs"; ... L11: try { L12: if (!process.env.NODE_ENV) process.env.NODE_ENV = cliOpts.prod ? "production" : "development"; L13: let server; ... L90: } L91: async function cliFetch(cliOpts) { L92: const stdin = cliOpts.stdin || process.stdin; L93: const stdout = cliOpts.stdout || process.stdout; L94: const stderr = cliOpts.stderr || process.stderr; ... L103: if (cliOpts.verbose && loaded.url) {
    High
    Cross File Remote Execution Context

    Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

    dist/cli.mjsView on unpkg · L4
    dist/loader.mjsView file
    41if (opts.interceptHttpListen !== false) { L42: const loaded = await interceptListen(() => import(url), opts); L43: mod = loaded.res;
    Medium
    Dynamic Require

    Package source references dynamic require/import behavior.

    dist/loader.mjsView on unpkg · L41

    Findings

    3 High4 Medium4 Low
    HighChild Processdist/cli.mjs
    HighShelldist/cli.mjs
    HighCross File Remote Execution Contextdist/cli.mjs
    MediumDynamic Requiredist/loader.mjs
    MediumNetwork
    MediumEnvironment Vars
    MediumWildcard Dependency
    LowScripts Present
    LowFilesystem
    LowHigh Entropy Strings
    LowUrl Strings