registry / swift-rust / 1.10.8

swift-rust@1.10.8

⚠ Under review

The full-stack React framework powered with Rust + Bun. TSX-first, Rust rendering, 10x faster than Next.js, single binary deploy.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 235 KB of source, external domains: bun.sh, fonts.googleapis.com, fonts.gstatic.com, github.com

Source & flagged code

9 flagged

package.jsonView file

Lines 73-113json

73 }

74 },

75 "bin": {

76 "swift-rust": "./bin/swift-rust.js"

77 },

78 "files": [

79 "dist",

80 "bin",

81 "scripts",

82 "native",

83 "tsconfig.base.json"

84 ],

85 "scripts": {

86 "build": "tsc -p tsconfig.json",

87 "dev": "tsc -p tsconfig.json --watch",

88 "lint": "biome check --no-errors-on-unmatched $(pwd)/src",

89 "typecheck": "tsc --noEmit",

90 "test": "bun test",

91 "clean": "rm -rf dist .turbo native",

92 "prepublishOnly": "bun run build",

93 "postinstall": "node ./scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L93

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L93

94 },

95 "dependencies": {

96 "@dotenvx/dotenvx": "^1.0.0",

97 "@swift-rust/env": "^0.2.0",

98 "@swift-rust/font": "^0.3.1",

99 "@swift-rust/image": "^1.0.0",

100 "@swift-rust/pdf": "^0.2.0",

101 "@swift-rust/video": "^0.2.1",

102 "react": "^19.0.0",

103 "react-dom": "^19.0.0"

104 },

105 "peerDependencies": {

106 "react": "^18 || ^19",

107 "react-dom": "^18 || ^19"

108 },

109 "peerDependenciesMeta": {

110 "react": {

111 "optional": true

112 },

113 "react-dom": {

bin/build.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import {

High

Child Process

Package source references child process execution.

bin/build.mjsView on unpkg · L1

4 existsSync,

5 mkdirSync,

6 readdirSync,

7 writeFileSync,

bin/dev-server.mjsView file

Lines 6-46javascript

6import { performance } from "node:perf_hooks";

7import { errorOverlayHTML as renderErrorOverlay } from "./error-overlay.mjs";

8import {

9 isSupportedBunVersion,

10 unsupportedBunMessage,

11} from

scripts/postinstall.jsView file

Lines 1-30javascript

1import {

2 chmodSync,

3 copyFileSync,

4 existsSync,

5 mkdirSync,

6 readFileSync,

7 writeFileSync,

8} from "node:fs";

9import { join, dirname, resolve } from

bin/swift-rust.jsView file

Lines 1-24javascript

1#!/usr/bin/env bun

2import { existsSync, readFileSync, realpathSync } from "node:fs";

3import { fileURLToPath } from "node:url";

4import { delimiter, dirname, join, resolve } from "node:path";

5import { spawn, spawnSync } from

Source & flagged code

9 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code