registry / write-nostr / 0.2.1

write-nostr@0.2.1

Browser-based long-form writing app for the Nostr protocol — NIP-23 editor, feed reader, and publishing tool

AI Security Review

scanned 7h ago · by lpm-firewall-ai

The executable static server does not validate request paths before resolving and reading them. If a user runs the server and it is reachable by an attacker, traversal-style paths may disclose readable files outside `build/`.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the `write-nostr` CLI server.

Impact

Potential local file disclosure from the package directory or accessible parent paths.

Mechanism

Unvalidated HTTP path joined to filesystem root and synchronously read.

Rationale

Source inspection found a concrete file-disclosure vulnerability in the published CLI server, but no evidence of malicious intent or automatic execution. Warn rather than block so the server path handling can be fixed.

Evidence

package.jsonscripts/serve.mjsscripts/dev-tauri.mjsscripts/deploy-remote.shscripts/spa-http-server.pybuild/_app/immutable/chunks/B7wZLrgw.jsbuild/

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

write-nostr@0.2.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code