registry / vize / 0.291.0

vize@0.291.0

Vize - High-performance Vue.js toolchain in Rust

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 42.8 KB of source

Source & flagged code

2 flagged

package.jsonView file

•name = vize; similarTo = vite

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/config-D1BwAgHh.mjsView file

Lines 80-120javascript

80 const projectSchemaPath = path.join(configDir, "node_modules", "vize", "pkl", schemaFile);

81 if (fs.existsSync(projectSchemaPath)) return match;

82 const bundledSchemaPath = path.join(PACKAGE_ROOT$1, "pkl", schemaFile);

83 if (!fs.existsSync(bundledSchemaPath)) return match;

84 patched = true;

85 return `${prefix}${quote}${pathToFileURL(bundledSchemaPath).href}${quote}`;

86 });

87 if (!patched) return null;

88 const tempFile = path.join(configDir, `.vize-config-${process.pid}-${Date.now()}-${randomUUID()}.pkl`);

89 fs.writeFileSync(tempFile, content, {

90 flag: "wx",

91 mode: 384

92 });

93 return tempFile;

94}

95function getErrorMessage$1(error) {

96 if (error instanceof Error) return error.message;

97 return String(error);

98}

99//#endregion

100//#region src/config.ts

101const native = createRequire(import.meta.url)("@vizejs/native");

102const CONFIG_FILE_NAMES = [

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config-D1BwAgHh.mjsView on unpkg · L100

103 "vize.config.pkl",

104 "vize.config.ts",

105 "vize.config.js",

106 "vize.config.mjs",

107 "vize.config.json"

108];

109const DEFAULT_CONFIG_ENV = {

110 mode: "development",

111 command: "serve"

112};

113const PACKAGE_ROOT = path.resolve(fileURLToPath(new URL(".", import.meta.url)), "..");

114const VIZE_CONFIG_JSON_SCHEMA_PATH = path.join(PACKAGE_ROOT, "schemas", "vize.config.schema.json");

115const VIZE_CONFIG_PKL_SCHEMA_PATH = path.join(PACKAGE_ROOT, "pkl", "vize.pkl");

116/**

117* Define a Vize configuration with type checking.

118* Accepts a plain object or a function that receives ConfigEnv.

119*/

120function defineConfig(config) {

Source & flagged code

2 flagged · loading source

package.jsonView file

•name = vize; similarTo = vite

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/config-D1BwAgHh.mjsView file

100//#region src/config.ts L101: const native = createRequire(import.meta.url)("@vizejs/native"); L102: const CONFIG_FILE_NAMES = [

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config-D1BwAgHh.mjsView on unpkg · L100

Findings

2 Medium3 Low

MediumTyposquat Namepackage.json

MediumDynamic Requiredist/config-D1BwAgHh.mjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

package.jsonView file

•name = vize; similarTo = vite

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/config-D1BwAgHh.mjsView file

Lines 80-120javascript

80 const projectSchemaPath = path.join(configDir, "node_modules", "vize", "pkl", schemaFile);

81 if (fs.existsSync(projectSchemaPath)) return match;

82 const bundledSchemaPath = path.join(PACKAGE_ROOT$1, "pkl", schemaFile);

83 if (!fs.existsSync(bundledSchemaPath)) return match;

84 patched = true;

85 return `${prefix}${quote}${pathToFileURL(bundledSchemaPath).href}${quote}`;

86 });

87 if (!patched) return null;

88 const tempFile = path.join(configDir, `.vize-config-${process.pid}-${Date.now()}-${randomUUID()}.pkl`);

89 fs.writeFileSync(tempFile, content, {

90 flag: "wx",

91 mode: 384

92 });

93 return tempFile;

94}

95function getErrorMessage$1(error) {

96 if (error instanceof Error) return error.message;

97 return String(error);

98}

99//#endregion

100//#region src/config.ts

101const native = createRequire(import.meta.url)("@vizejs/native");

102const CONFIG_FILE_NAMES = [

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config-D1BwAgHh.mjsView on unpkg · L100

103 "vize.config.pkl",

104 "vize.config.ts",

105 "vize.config.js",

106 "vize.config.mjs",

107 "vize.config.json"

108];

109const DEFAULT_CONFIG_ENV = {

110 mode: "development",

111 command: "serve"

112};

113const PACKAGE_ROOT = path.resolve(fileURLToPath(new URL(".", import.meta.url)), "..");

114const VIZE_CONFIG_JSON_SCHEMA_PATH = path.join(PACKAGE_ROOT, "schemas", "vize.config.schema.json");

115const VIZE_CONFIG_PKL_SCHEMA_PATH = path.join(PACKAGE_ROOT, "pkl", "vize.pkl");

116/**

117* Define a Vize configuration with type checking.

118* Accepts a plain object or a function that receives ConfigEnv.

119*/

120function defineConfig(config) {