registry / write-nostr / 0.2.3

write-nostr@0.2.3

Browser-based long-form writing app for the Nostr protocol — NIP-23 editor, feed reader, and publishing tool

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The published CLI starts an HTTP static-file server with a path-traversal flaw. Untrusted request paths are normalized against `build/` but are not checked to remain inside it, allowing reads of files outside the intended asset directory.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the `write-nostr` bin and a network client sends a traversal request.

Impact

An exposed server can disclose package-adjacent or other process-readable files to a remote requester.

Mechanism

Arbitrary readable-file disclosure through unsanitized HTTP path joining.

Rationale

No malicious install-time behavior, covert exfiltration, or persistence was found. However, the published server has a concrete path-traversal vulnerability that can disclose readable files when reachable.

Evidence

package.jsonscripts/serve.mjsscripts/dev-tauri.mjsscripts/deploy-remote.shbuild/sw.jsbuild/

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

`scripts/serve.mjs` joins untrusted `req.url` directly to `build/` without containment validation.

write-nostr@0.2.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code