registry / xypriss / 9.12.8

xypriss@9.12.8

XyPriss is a high-performance, TypeScript-first hyper-system web framework powered by a native Go core (XHSC), featuring robust multi-tenant sandboxing, secure native file streaming, and zero Express dependencies.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

Manifest

CopyleftLicense

scanned 358 file(s), 2.60 MB of source, external domains: 127.0.0.1, api.nehonix.com, cdn.jsdelivr.net, cdnjs.cloudflare.com, dll.nehonix.com, fonts.googleapis.com, fonts.gstatic.com, github.com, lab.nehonix.com, xypriss.nehonix.com

Source & flagged code

7 flagged

package.jsonView file

Lines 19-59json

19 "require": "./dist/cjs/src/index.js",

20 "types": "./dist/index.d.ts"

21 }

22 },

23 "files": [

24 "dist/",

25 "shared/",

26 "scripts/",

27 "README.md",

28 "LICENSE",

29 "CONTRIBUTING.md"

30 ],

31 "scripts": {

32 "XCIS:bench.all": "bash bench/xcis-bench/scripts/bench_all.sh",

33 "XCIS:bench.xstatic": "bash simulations/XCIS/bench_static.sh",

34 "benchmark": "node benchmarks/index.js",

35 "build": "rm -rf dist && NODE_OPTIONS='--max-old-space-size=4096' xfpm exec rollup -c rollup.config.js",

36 "build:memory": "NODE_OPTIONS='--max-old-space-size=6144' xfpm exec rollup -c rollup.config.js",

37 "install-memory-cli": "node scripts/install-memory-cli.js",

38 "install-xhsc": "node scripts/postinstall-xhsc.js",

39 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L39

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L39

40 "prepublishOnly": "xfpm run build",

41 "test": "jest",

42 "test:coverage": "jest --coverage",

43 "test:watch": "jest --watch"

44 },

45 "dependencies": {

46 "ioredis": "^5.10.0",

47 "nehoid": "^2.2.1",

48 "redis": "^5.11.0",

49 "reliant-type": "^2.1.5",

50 "strulink": "^1.3.0",

51 "xss": "^1.0.15",

52 "xypriss-compression": "^1.0.6"

53 },

54 "devDependencies": {

55 "@rollup/plugin-commonjs": "^25.0.8",

56 "@rollup/plugin-json": "^6.1.0",

57 "@rollup/plugin-node-resolve": "^15.3.1",

58 "@rollup/plugin-terser": "^1.0.0",

59 "@rollup/plugin-typescript": "^11.1.6",

•name = xypriss; similarTo = cypress

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/esm/src/middleware/built-in/security/UriNormalizer.jsView file

Lines 139-179javascript

139 }

140 // Calculate adaptive timeout

141 const effectiveTimeout = UriNormalizer.computeRegexTimeout(str.length, timeoutMs);

142 try {

143 const sandbox = { result: false, pattern, str };

144

scripts/postinstall.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

3/**

4 * XyPriss Post-Install Script

5 * Runs after `npm install` to set up all platform-specific binaries.

6 */

8import { fileURLToPath } from "url";

9import path from "path";

10import fs from

scripts/monitor_memory.shView file

•path = scripts/monitor_memory.sh kind = build_helper sizeBytes = 3955 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/monitor_memory.shView on unpkg

dist/index.d.tsView file

Lines 599-639typescript

599 /** Security settings for cache */

600 security?: CacheSecurityConfig;

601 /** Monitoring and metrics configuration */

602 monitoring?: CacheMonitoringConfig;

603 /** Resilience and fault tolerance settings */

604 resilience?: CacheResilienceConfig;

605}

606/**

607 * Redis cache configuration.

608 *

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•name = xypriss; similarTo = cypress

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/esm/src/middleware/built-in/security/UriNormalizer.jsView file

159// ───────────────────────────────────────────────────────────────────────── L160: // Private Methods — URI Decoding L161: // ─────────────────────────────────────────────────────────────────────────

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/esm/src/middleware/built-in/security/UriNormalizer.jsView on unpkg · L159

scripts/postinstall.jsView file

10Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network L10: import fs from "fs"; L11: import { execSync } from "child_process"; L12: import { installXems } from "./install-xems.js"; ... L83: // 1. Initial gate: Check environment variable L84: if (process.env.XFPM !== "true") return false; L85: L86: // 2. Windows Robust verification L87: if (process.platform === "win32") { L88: let pid = process.ppid; ... L132: log.blank(); L133: log.info("Installation Guide: https://xypriss.nehonix.com/docs/xfpm#installation"); L134: log.divider();

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/postinstall.jsView on unpkg · L10

scripts/monitor_memory.shView file

•path = scripts/monitor_memory.sh kind = build_helper sizeBytes = 3955 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/monitor_memory.shView on unpkg

dist/index.d.tsView file

619patternName = generic_password severity = medium line = 619 matchedText = * pass...rd',

Medium

Secret Pattern

Hardcoded password in dist/index.d.ts

dist/index.d.tsView on unpkg · L619

Findings

2 High8 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighEntrypoint Build Divergencescripts/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumTyposquat Namepackage.json

MediumUnsafe Vm Contextdist/esm/src/middleware/built-in/security/UriNormalizer.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/monitor_memory.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/index.d.ts

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

7 flagged

package.jsonView file

Lines 19-59json

19 "require": "./dist/cjs/src/index.js",

20 "types": "./dist/index.d.ts"

21 }

22 },

23 "files": [

24 "dist/",

25 "shared/",

26 "scripts/",

27 "README.md",

28 "LICENSE",

29 "CONTRIBUTING.md"

30 ],

31 "scripts": {

32 "XCIS:bench.all": "bash bench/xcis-bench/scripts/bench_all.sh",

33 "XCIS:bench.xstatic": "bash simulations/XCIS/bench_static.sh",

34 "benchmark": "node benchmarks/index.js",

35 "build": "rm -rf dist && NODE_OPTIONS='--max-old-space-size=4096' xfpm exec rollup -c rollup.config.js",

36 "build:memory": "NODE_OPTIONS='--max-old-space-size=6144' xfpm exec rollup -c rollup.config.js",

37 "install-memory-cli": "node scripts/install-memory-cli.js",

38 "install-xhsc": "node scripts/postinstall-xhsc.js",

39 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L39

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L39

40 "prepublishOnly": "xfpm run build",

41 "test": "jest",

42 "test:coverage": "jest --coverage",

43 "test:watch": "jest --watch"

44 },

45 "dependencies": {

46 "ioredis": "^5.10.0",

47 "nehoid": "^2.2.1",

48 "redis": "^5.11.0",

49 "reliant-type": "^2.1.5",

50 "strulink": "^1.3.0",

51 "xss": "^1.0.15",

52 "xypriss-compression": "^1.0.6"

53 },

54 "devDependencies": {

55 "@rollup/plugin-commonjs": "^25.0.8",

56 "@rollup/plugin-json": "^6.1.0",

57 "@rollup/plugin-node-resolve": "^15.3.1",

58 "@rollup/plugin-terser": "^1.0.0",

59 "@rollup/plugin-typescript": "^11.1.6",

•name = xypriss; similarTo = cypress

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/esm/src/middleware/built-in/security/UriNormalizer.jsView file

Lines 139-179javascript

139 }

140 // Calculate adaptive timeout

141 const effectiveTimeout = UriNormalizer.computeRegexTimeout(str.length, timeoutMs);

142 try {

143 const sandbox = { result: false, pattern, str };

144

scripts/postinstall.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

3/**

4 * XyPriss Post-Install Script

5 * Runs after `npm install` to set up all platform-specific binaries.

6 */

8import { fileURLToPath } from "url";

9import path from "path";

10import fs from

scripts/monitor_memory.shView file

•path = scripts/monitor_memory.sh kind = build_helper sizeBytes = 3955 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/monitor_memory.shView on unpkg

dist/index.d.tsView file

Lines 599-639typescript

599 /** Security settings for cache */

600 security?: CacheSecurityConfig;

601 /** Monitoring and metrics configuration */

602 monitoring?: CacheMonitoringConfig;

603 /** Resilience and fault tolerance settings */

604 resilience?: CacheResilienceConfig;

605}

606/**

607 * Redis cache configuration.

608 *