registry / yamlover / 0.3.23

yamlover@0.3.23

Browse a yamlover tree in the web: npx yamlover <root> serves a React SPA over a directory.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 6.03 MB of source, external domains: example.com, foo.bar, github.com, goo.gl, leafletjs.com, ns.adobe.com, purl.oclc.org, raw.github.com, reactjs.org, schemas.microsoft.com, schemas.openxmlformats.org, schemas.zwobble.org, sheetjs.com, sheetjs.openxmlformats.org, stuartk.com, stuk.github.io, www.openstreetmap.org, www.plantuml.com, www.w3.org, www.xfa.org

Oversized source lightweight scan

dist/server.js2.41 MB file, sampled 256 KB

FilesystemChildProcessHighEntropyStrings

Source & flagged code

5 flagged

dist/client/assets/heic-BMjqVVlg.jsView file

1import{g as j0,d as T0,j as H0}from"./index-CteLUngZ.js";import{D as U0}from"./decoded-D6QOaoKb.js";import"./imagemap-Dn9snPoS.js";import"./openable-DClR-5sz.js";var Y0={exports:{}... L2: var Module=void 0!==Module?Module:{};(function(){var d={print:function(A){A=Array.prototype.slice.call(arguments).join(" "),console.log(A)},printErr:function(A){A=Array.prototype.s... L3: ;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/heic-BMjqVVlg.jsView on unpkg · L1

bin/yamlover.jsView file

Lines 130-170javascript

130 res.end("not found");

131 return;

132 }

133 }

134 if (url.pathname.startsWith("/api/")) {

135 handle(req, res, url);

136 return;

137 }

138 serveClient(req, res, url);

139});

140

141let createHandlers;

142if (prod) {

143 // -- production: prebuilt static client + bundled server, no Vite ---------- //

144 const distClient = join(pkgRoot, "dist/client");

145 const distIndex = join(distClient, "index.html");

146 if (!fs.existsSync(distIndex)) {

147 console.error(`yamlover: production build missing at ${distClient}`);

148 console.error(" run `npm run build` in tools/server first.");

149 process.exit(1);

150 }

151 ({ createHandlers } = await import(pathToFileURL(join(pkgRoot, "dist/server.js")).href));

152 serveClient = (req, res, url) => serveStatic(res, url, distClient, distIndex);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/yamlover.jsView on unpkg · L150

153} else {

154 // -- live: Vite middleware + ssrLoadModule (repo checkout) ----------------- //

155 // Vite and its plugin are DYNAMIC imports so production mode (where they are not

156 // installed) never tries to resolve them.

157 const { createServer } = await import("vite");

158 const { default: react } = await import("@vitejs/plugin-react");

159

160 // Resolve react/react-dom as *this package* sees them, and alias Vite to those

161 // exact copies, so the SPA never picks up a stale React from a parent

162 // node_modules (the "does not provide an export named 'createRoot'" failure).

163 const reactAlias = {};

164 // Directories Vite is allowed to serve over `/@fs`. Start with this package; add

165 // the node_modules that actually holds the heavy deps — under `npx` they hoist to

166 // a `_npx/<hash>/node_modules` outside `pkgRoot` and Vite's default root detection

167 // misses it, so a raw asset (notably pdf.js's worker) 404s to index.html.

168 const fsAllow = [pkgRoot];

169 try {

170 const req = createRequire(join(pkgRoot, "package.json"));

dist/wasm/webp_dec.wasmView file

•path = dist/wasm/webp_dec.wasm kind = wasm_module sizeBytes = 137960 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/wasm/webp_dec.wasmView on unpkg

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/server.jsView file

•path = dist/server.js kind = oversized_source_file sizeBytes = 2530138 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/client/assets/heic-BMjqVVlg.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/heic-BMjqVVlg.jsView on unpkg · L1

bin/yamlover.jsView file

150} L151: ({ createHandlers } = await import(pathToFileURL(join(pkgRoot, "dist/server.js")).href)); L152: serveClient = (req, res, url) => serveStatic(res, url, distClient, distIndex);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/yamlover.jsView on unpkg · L150

dist/wasm/webp_dec.wasmView file

•path = dist/wasm/webp_dec.wasm kind = wasm_module sizeBytes = 137960 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/wasm/webp_dec.wasmView on unpkg

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/server.jsView file

•path = dist/server.js kind = oversized_source_file sizeBytes = 2530138 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server.jsView on unpkg

Findings

3 High6 Medium5 Low

HighObfuscated

HighShips High Entropy Blobdist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2

HighOversized Source Filedist/server.js

MediumDynamic Requirebin/yamlover.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Wasm Moduledist/wasm/webp_dec.wasm

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/client/assets/heic-BMjqVVlg.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/client/assets/heic-BMjqVVlg.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/heic-BMjqVVlg.jsView on unpkg · L1

bin/yamlover.jsView file

Lines 130-170javascript

130 res.end("not found");

131 return;

132 }

133 }

134 if (url.pathname.startsWith("/api/")) {

135 handle(req, res, url);

136 return;

137 }

138 serveClient(req, res, url);

139});

140

141let createHandlers;

142if (prod) {

143 // -- production: prebuilt static client + bundled server, no Vite ---------- //

144 const distClient = join(pkgRoot, "dist/client");

145 const distIndex = join(distClient, "index.html");

146 if (!fs.existsSync(distIndex)) {

147 console.error(`yamlover: production build missing at ${distClient}`);

148 console.error(" run `npm run build` in tools/server first.");

149 process.exit(1);

150 }

151 ({ createHandlers } = await import(pathToFileURL(join(pkgRoot, "dist/server.js")).href));

152 serveClient = (req, res, url) => serveStatic(res, url, distClient, distIndex);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/yamlover.jsView on unpkg · L150

153} else {

154 // -- live: Vite middleware + ssrLoadModule (repo checkout) ----------------- //

155 // Vite and its plugin are DYNAMIC imports so production mode (where they are not

156 // installed) never tries to resolve them.

157 const { createServer } = await import("vite");

158 const { default: react } = await import("@vitejs/plugin-react");

159

160 // Resolve react/react-dom as *this package* sees them, and alias Vite to those

161 // exact copies, so the SPA never picks up a stale React from a parent

162 // node_modules (the "does not provide an export named 'createRoot'" failure).

163 const reactAlias = {};

164 // Directories Vite is allowed to serve over `/@fs`. Start with this package; add

165 // the node_modules that actually holds the heavy deps — under `npx` they hoist to

166 // a `_npx/<hash>/node_modules` outside `pkgRoot` and Vite's default root detection

167 // misses it, so a raw asset (notably pdf.js's worker) 404s to index.html.

168 const fsAllow = [pkgRoot];

169 try {

170 const req = createRequire(join(pkgRoot, "package.json"));

dist/wasm/webp_dec.wasmView file

•path = dist/wasm/webp_dec.wasm kind = wasm_module sizeBytes = 137960 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/wasm/webp_dec.wasmView on unpkg

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/server.jsView file

•path = dist/server.js kind = oversized_source_file sizeBytes = 2530138 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server.jsView on unpkg