registry / srvx / 0.12.0

srvx@0.12.0

Universal Server.

AI Security Review

scanned 5h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime network access and dynamic imports are explicit CLI/server features controlled by the user.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs srvx serve or srvx fetch/curl with a local entry or URL.

Impact

Normal package-aligned server and CLI behavior; no unconsented install-time activity.

Mechanism

Local server-entry loading, HTTP serving, and user-directed HTTP fetch.

Rationale

The flagged primitives implement an explicit universal-server CLI: loading a chosen local handler, serving files, and fetching a user-provided URL. Source inspection found no lifecycle execution or concrete malicious chain.

Evidence

package.jsonbin/srvx.mjsdist/cli.mjsdist/loader.mjsdist/_chunks/_utils2.mjsdist/static.mjs.env.env.local.env.production

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall, install, or postinstall hook.
bin/srvx.mjs only invokes the exported CLI after an explicit command.
dist/cli.mjs forks its own srvx CLI only for watch/development operation.
dist/cli.mjs fetches remote URLs only through explicit fetch/curl arguments.
dist/loader.mjs dynamically imports a user-selected server entry for its documented server role.
No credential harvesting, exfiltration, persistence, destructive writes, or agent-control mutation found.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 21 file(s), 114 KB of source, external domains: github.com, srvx.h3.dev

Source & flagged code

4 flagged

dist/cli.mjsView file

Lines 1-24javascript

1import { bold, cyan, gray, green, magenta, red, url, yellow } from "./_chunks/_utils.mjs";

2import { loadServerEntry } from "./loader.mjs";

3import { parseArgs } from "node:util";

4import { fileURLToPath } from "node:url";

5import { fork } from "node:child_process";

6import { createReadStream, existsSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L4

7import { dirname, relative, resolve } from "node:path";

8import { Readable } from "node:stream";

9const NO_ENTRY_ERROR = "No server entry or public directory found";

10async function cliServe(cliOpts) {

11 try {

12 if (!process.env.NODE_ENV) process.env.NODE_ENV = cliOpts.prod ? "production" : "development";

13 let server;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L4

14 const loaded = await loadServerEntry({

15 entry: cliOpts.entry,

16 dir: cliOpts.dir,

17 get srvxServer() {

18 return server;

19 }

20 });

21 const { serve: srvxServe } = loaded.nodeCompat ? await import("srvx/node") : await import("srvx");

22 const { staticMiddleware } = await import("srvx/static");

23 const { loggerMiddleware } = await import("srvx/log");

24 const explicitStatic = !!cliOpts.static;

Lines 388-428javascript

388 url,

389 method

390 };

391 }

392 const maybeEntryOrDir = positionals[0];

393 if (maybeEntryOrDir) {

394 if (values.entry || values.dir) throw new

dist/loader.mjsView file

Lines 24-64javascript

24 if (!existsSync(entry)) return { notFound: true };

25 }

26 else {

27 for (const defEntry of defaultEntries) {

Source & flagged code

4 flagged · loading source

dist/cli.mjsView file

4import { fileURLToPath } from "node:url"; L5: import { fork } from "node:child_process"; L6: import { createReadStream, existsSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L4

408async function forkCLI(args, runtimeArgs) { L409: const child = fork(fileURLToPath(globalThis.__SRVX_BIN__ || new URL("../bin/srvx.mjs", import.meta.url)), [...args], { execArgv: [...process.execArgv, ...runtimeArgs].filter(Boolea... L410: child.on("error", (error) => {

High

Shell

Package source references shell execution.

dist/cli.mjsView on unpkg · L408

4Cross-file remote execution chain: dist/cli.mjs spawns dist/loader.mjs; helper contains network access plus dynamic code execution. L4: import { fileURLToPath } from "node:url"; L5: import { fork } from "node:child_process"; L6: import { createReadStream, existsSync, statSync } from "node:fs"; ... L11: try { L12: if (!process.env.NODE_ENV) process.env.NODE_ENV = cliOpts.prod ? "production" : "development"; L13: let server; ... L109: } L110: async function cliFetch(cliOpts) { L111: const stdin = cliOpts.stdin || process.stdin; L112: const stdout = cliOpts.stdout || process.stdout; L113: const stderr = cliOpts.stderr || process.stderr; ... L122: if (cliOpts.verbose && loaded.url) {

High

Findings

3 High3 Medium4 Low

HighChild Processdist/cli.mjs

HighShelldist/cli.mjs

HighCross File Remote Execution Contextdist/cli.mjs

MediumDynamic Requiredist/loader.mjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings