vike@0.4.269
⚠ Under review(Replaces Next.js/Nuxt) 🔨 Build mission-critical applications with stability and development freedom.
Static Scan Results
scanned 5h ago · by rust-scannerStatic analysis completed at 97.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/server/runtime/createDevMiddleware.jsView file
6p = new URL(p, import.meta.url).href;
L7: const { createDevMiddleware } = await import(/*webpackIgnore: true*/ /* @vite-ignore */ p);
L8: return createDevMiddleware(...args);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/server/runtime/createDevMiddleware.jsView on unpkg · L6dist/node/vite/plugins/build/pluginDistFileNames.jsView file
2// Attempt to preserve file structure of `.page.js` files:
L3: // - https://github.[redacted]
L4: // - Blocker: https://github.com/rollup/rollup/issues/4724
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/node/vite/plugins/build/pluginDistFileNames.jsView on unpkg · L2package.jsonView file
Findings
1 Critical3 High4 Medium5 Low
CriticalManifest Confusionpackage.json
HighKnown Malware Source Similaritydist/node/vite/plugins/pluginDev/logSkillHint.js
HighKnown Malware Source Similaritydist/node/api/serverEntryDev.js
HighPrevious Version Dangerous Deltadist/node/vite/plugins/pluginDev/logSkillHint.js
MediumDynamic Requiredist/server/runtime/createDevMiddleware.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/node/vite/plugins/build/pluginDistFileNames.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to vike@0.4.269.
See all versions of vike for other recorded verdicts.
- Review the evidence and your use of vike@0.4.269 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.