registry / vite-plugin-react-server / 3.1.2

vite-plugin-react-server@3.1.2

build.inlineFlight: the inlined flight payload could be read before the HTML parser finished writing it, leaving pages permanently un-hydrated (React #412). Fixed in 3.1.6.

Vite plugin for React Server Components (RSC)

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 665 file(s), 4.32 MB of source

Source & flagged code

6 flagged

scripts/verify-package-entrypoints.mjsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

scripts/verify-package-entrypoints.mjsView on unpkg · L1

3import { dirname, join } from "node:path";

4import { fileURLToPath } from "node:url";

5import pkg from "../package.json" with { type: "json" };

7const root = dirname(dirname(fileURLToPath(import.meta.url)));

8const directFields = ["main", "module", "types"];

10const targets = [];

11for (const field of directFields) {

12 if (typeof pkg[field] === "string") {

13 targets.push([field, pkg[field]]);

14 }

15}

17function collectExports(value, label) {

18 if (typeof value === "string") {

19 targets.push([label, value]);

20 return;

21 }

dist/plugin/dev-server/configureRequestHandler.client.jsView file

Lines 95-135javascript

95 error: routeFiles.error,

96 logger,

97 mode: getNodeEnv(server.config.mode),

98 panicThreshold: handlerOptions.panicThreshold,

99 critical: false,

100 context: "configureWorkerRequestHandler"

101 });

102

dist/plugin/config/createRollupLikeHash.jsView file

Lines 1-38javascript

1/**

2* vite-plugin-react-server

3* Copyright (c) Nico Brinkkemper

4* MIT License

5*/

6import { createHash } from "node:crypto";

7//#region plugin/config/createRollupLikeHash.ts

8/**

9* Content-addressed hash for client-component module IDs that mimics Rollup's

10* `hashCharacters` semantics. Used to give every hosted client module a stable,

scripts/verify-dev-flight-hydration.mjsView file

Lines 14-54javascript

14// 2. serve the static dist;

15// 3. drive Chromium (Playwright) and assert the client component actually

16// hydrates (the Counter increments on click), with zero console/page errors.

17//

18// node scripts/verify-dev-flight-hydration.mjs # dev-flight + prod client

19// node scripts/verify-dev-flight-hydration.mjs --prod # all-prod control

20//

21// Uses bidoof-template as the fixture, same as the e2e suite. Exits non-zero on

22// any failure so it can gate CI.

24import { execSync }

scripts/fix-unused-imports.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

3import { readFileSync, writeFileSync } from 'fs';

4import { execSync } from 'child_process';

6// Get ESLint output

7const eslintOutput = execSync('npx eslint plugin --format json', { encoding: 'utf8' });

scripts/test-both.shView file

•path = scripts/test-both.sh kind = build_helper sizeBytes = 2146 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/test-both.shView on unpkg

Source & flagged code

6 flagged · loading source

scripts/verify-package-entrypoints.mjsView file

1import { execFileSync } from "node:child_process"; L2: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

scripts/verify-package-entrypoints.mjsView on unpkg · L1

dist/plugin/dev-server/configureRequestHandler.client.jsView file

115if (isReactServerCondition() && serverEnv && "runner" in serverEnv && serverEnv.runner) try { L116: propsModule = await serverEnv.runner.import(fullPropsPath); L117: } catch (runnerError) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugin/dev-server/configureRequestHandler.client.jsView on unpkg · L115

dist/plugin/config/createRollupLikeHash.jsView file

18* default; short, filename-safe, no special characters. L19: * - `base64`: first 8 hex chars decoded to bytes and base64-encoded with L20: * URL-safe substitutions (`+`→`-`, `/`→`_`, `=` stripped). ... L39: L40: //# sourceMappingURL=data:application/json;charset=utf-8;base64,[redacted]...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/plugin/config/createRollupLikeHash.jsView on unpkg · L18

scripts/verify-dev-flight-hydration.mjsView file

34const PORT = 4178; L35: const ORIGIN = `http://localhost:${PORT}`; L36: const BASE = "/"; ... L39: const env = (extra) => ({ L40: ...process.env, L41: BASE_URL: BASE, ... L46: const run = (cmd, extra) => L47: execSync(cmd, { cwd: FIXTURE, stdio: "inherit", env: env(extra) }); L48:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/verify-dev-flight-hydration.mjsView on unpkg · L34

scripts/fix-unused-imports.mjsView file

6// Get ESLint output L7: const eslintOutput = execSync('npx eslint plugin --format json', { encoding: 'utf8' }); L8: const results = JSON.parse(eslintOutput);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/fix-unused-imports.mjsView on unpkg · L6

scripts/test-both.shView file

•path = scripts/test-both.sh kind = build_helper sizeBytes = 2146 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/test-both.shView on unpkg

Findings

4 High5 Medium5 Low

HighChild Processscripts/verify-package-entrypoints.mjs

HighShell

HighSame File Env Network Executionscripts/verify-dev-flight-hydration.mjs

HighRuntime Package Installscripts/fix-unused-imports.mjs

MediumDynamic Requiredist/plugin/dev-server/configureRequestHandler.client.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/test-both.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/plugin/config/createRollupLikeHash.js

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

6 flagged

scripts/verify-package-entrypoints.mjsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

scripts/verify-package-entrypoints.mjsView on unpkg · L1

3import { dirname, join } from "node:path";

4import { fileURLToPath } from "node:url";

5import pkg from "../package.json" with { type: "json" };

7const root = dirname(dirname(fileURLToPath(import.meta.url)));

8const directFields = ["main", "module", "types"];

10const targets = [];

11for (const field of directFields) {

12 if (typeof pkg[field] === "string") {

13 targets.push([field, pkg[field]]);

14 }

15}

17function collectExports(value, label) {

18 if (typeof value === "string") {

19 targets.push([label, value]);

20 return;

21 }

dist/plugin/dev-server/configureRequestHandler.client.jsView file

Lines 95-135javascript

95 error: routeFiles.error,

96 logger,

97 mode: getNodeEnv(server.config.mode),

98 panicThreshold: handlerOptions.panicThreshold,

99 critical: false,

100 context: "configureWorkerRequestHandler"

101 });

102

dist/plugin/config/createRollupLikeHash.jsView file

Lines 1-38javascript

1/**

2* vite-plugin-react-server

3* Copyright (c) Nico Brinkkemper

4* MIT License

5*/

6import { createHash } from "node:crypto";

7//#region plugin/config/createRollupLikeHash.ts

8/**

9* Content-addressed hash for client-component module IDs that mimics Rollup's

10* `hashCharacters` semantics. Used to give every hosted client module a stable,

scripts/verify-dev-flight-hydration.mjsView file

Lines 14-54javascript

14// 2. serve the static dist;

15// 3. drive Chromium (Playwright) and assert the client component actually

16// hydrates (the Counter increments on click), with zero console/page errors.

17//

18// node scripts/verify-dev-flight-hydration.mjs # dev-flight + prod client

19// node scripts/verify-dev-flight-hydration.mjs --prod # all-prod control

20//

21// Uses bidoof-template as the fixture, same as the e2e suite. Exits non-zero on

22// any failure so it can gate CI.

24import { execSync }

scripts/fix-unused-imports.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

3import { readFileSync, writeFileSync } from 'fs';

4import { execSync } from 'child_process';

6// Get ESLint output

7const eslintOutput = execSync('npx eslint plugin --format json', { encoding: 'utf8' });

scripts/test-both.shView file

•path = scripts/test-both.sh kind = build_helper sizeBytes = 2146 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/test-both.shView on unpkg