registry / srvx-nightly / 0.11.22-20260711-161058-137abc7

srvx-nightly@0.11.22-20260711-161058-137abc7

Universal Server.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The flagged primitives implement a user-invoked development/server CLI and local application loader.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `srvx` or imports the package to serve/load their own server entry.

Impact

No unconsented persistence, exfiltration, remote payload execution, or install-time behavior was identified.

Mechanism

Loads local server modules, serves HTTP requests, and optionally fetches a user-supplied URL.

Rationale

The static signals are package-aligned: this is a universal server CLI that loads a local application entry, serves requests, and supports explicit fetch operations. Source inspection found no lifecycle hook or concrete malicious behavior.

Evidence

package.jsonbin/srvx.mjsdist/cli.mjsdist/loader.mjsREADME.md

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall, install, or postinstall hook.
bin/srvx.mjs only invokes the documented CLI entrypoint.
dist/loader.mjs dynamically imports a user-selected/local server entry.
dist/cli.mjs forks its own bin for runtime flags, not a shell command.
Network fetch is an explicit `srvx fetch` user command or server runtime behavior.
No package code writes files, harvests credentials, or targets AI-agent config.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 21 file(s), 92.1 KB of source, external domains: github.com, srvx.h3.dev

Source & flagged code

4 flagged

dist/cli.mjsView file

Lines 1-24javascript

1import { bold, cyan, gray, green, magenta, red, url, yellow } from "./_chunks/_utils.mjs";

2import { loadServerEntry } from "./loader.mjs";

3import { parseArgs } from "node:util";

4import { fileURLToPath } from "node:url";

5import { fork } from "node:child_process";

6import { createReadStream, existsSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L4

7import { dirname, relative, resolve } from "node:path";

8import { Readable } from "node:stream";

9const NO_ENTRY_ERROR = "No server entry or public directory found";

10async function cliServe(cliOpts) {

11 try {

12 if (!process.env.NODE_ENV) process.env.NODE_ENV = cliOpts.prod ? "production" : "development";

13 let server;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L4

14 const loaded = await loadServerEntry({

15 entry: cliOpts.entry,

16 dir: cliOpts.dir,

17 get srvxServer() {

18 return server;

19 }

20 });

21 const { serve: srvxServe } = loaded.nodeCompat ? await import("srvx-nightly/node") : await import("srvx-nightly");

22 const { serveStatic } = await import("srvx-nightly/static");

23 const { log } = await import("srvx-nightly/log");

24 const staticDir = resolve(cliOpts.dir || (loaded.url ? dirname(fileURLToPath(loaded.url)) : "."), cliOpts.static || "public");

Lines 352-392javascript

352 data: {

353 type: "string",

354 short: "d"

355 }

356 }

357 });

358 if (positionals[0] === "fetch" || positionals[0] === "curl") positionals.shift

dist/loader.mjsView file

Lines 21-61javascript

21 entry = resolve(opts.dir || ".", entry);

22 if (!existsSync(entry)) return { notFound: true };

23 } else {

24 for (const defEntry of defaultEntries) {

Source & flagged code

4 flagged · loading source

dist/cli.mjsView file

4import { fileURLToPath } from "node:url"; L5: import { fork } from "node:child_process"; L6: import { createReadStream, existsSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L4

372async function forkCLI(args, runtimeArgs) { L373: const child = fork(fileURLToPath(globalThis.__SRVX_BIN__ || new URL("../bin/srvx.mjs", import.meta.url)), [...args], { execArgv: [...process.execArgv, ...runtimeArgs].filter(Boolea... L374: child.on("error", (error) => {

High

Shell

Package source references shell execution.

dist/cli.mjsView on unpkg · L372

4Cross-file remote execution chain: dist/cli.mjs spawns dist/loader.mjs; helper contains network access plus dynamic code execution. L4: import { fileURLToPath } from "node:url"; L5: import { fork } from "node:child_process"; L6: import { createReadStream, existsSync, statSync } from "node:fs"; ... L11: try { L12: if (!process.env.NODE_ENV) process.env.NODE_ENV = cliOpts.prod ? "production" : "development"; L13: let server; ... L90: } L91: async function cliFetch(cliOpts) { L92: const stdin = cliOpts.stdin || process.stdin; L93: const stdout = cliOpts.stdout || process.stdout; L94: const stderr = cliOpts.stderr || process.stderr; ... L103: if (cliOpts.verbose && loaded.url) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L4

dist/loader.mjsView file

41if (opts.interceptHttpListen !== false) { L42: const loaded = await interceptListen(() => import(url), opts); L43: mod = loaded.res;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/loader.mjsView on unpkg · L41

Findings

3 High4 Medium4 Low

HighChild Processdist/cli.mjs

HighShelldist/cli.mjs

HighCross File Remote Execution Contextdist/cli.mjs

MediumDynamic Requiredist/loader.mjs

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/cli.mjsView file

Lines 1-24javascript

1import { bold, cyan, gray, green, magenta, red, url, yellow } from "./_chunks/_utils.mjs";

2import { loadServerEntry } from "./loader.mjs";

3import { parseArgs } from "node:util";

4import { fileURLToPath } from "node:url";

5import { fork } from "node:child_process";

6import { createReadStream, existsSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L4

7import { dirname, relative, resolve } from "node:path";

8import { Readable } from "node:stream";

9const NO_ENTRY_ERROR = "No server entry or public directory found";

10async function cliServe(cliOpts) {

11 try {

12 if (!process.env.NODE_ENV) process.env.NODE_ENV = cliOpts.prod ? "production" : "development";

13 let server;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L4

14 const loaded = await loadServerEntry({

15 entry: cliOpts.entry,

16 dir: cliOpts.dir,

17 get srvxServer() {

18 return server;

19 }

20 });

21 const { serve: srvxServe } = loaded.nodeCompat ? await import("srvx-nightly/node") : await import("srvx-nightly");

22 const { serveStatic } = await import("srvx-nightly/static");

23 const { log } = await import("srvx-nightly/log");

24 const staticDir = resolve(cliOpts.dir || (loaded.url ? dirname(fileURLToPath(loaded.url)) : "."), cliOpts.static || "public");

Lines 352-392javascript

352 data: {

353 type: "string",

354 short: "d"

355 }

356 }

357 });

358 if (positionals[0] === "fetch" || positionals[0] === "curl") positionals.shift

dist/loader.mjsView file

Lines 21-61javascript

21 entry = resolve(opts.dir || ".", entry);

22 if (!existsSync(entry)) return { notFound: true };

23 } else {

24 for (const defEntry of defaultEntries) {