by AlexSergey
Zero-config React with built-in SSR, automated quality gates, and AI-ready project structure - ship clean code whether you write it yourself or with an AI assistant.
# Add to your Claude Code skills
git clone https://github.com/AlexSergey/rockpackLast scanned: 5/21/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@babel/plugin-transform-modules-systemjs: @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@unhead/react: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "axios: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF",
"severity": "high"
},
{
"type": "npm-audit",
"message": "basic-ftp: basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands",
"severity": "high"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "flatted: flatted vulnerable to unbounded recursion DoS in parse() revive phase",
"severity": "high"
},
{
"type": "npm-audit",
"message": "follow-redirects: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "handlebars: Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "lodash: lodash vulnerable to Code Injection via `_.template` imports key names",
"severity": "high"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "serialize-javascript: Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "unhead: Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "webpack-dev-server: webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ws: ws: Uninitialized memory disclosure",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "yaml: yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
"severity": "medium"
}
],
"status": "FAILED",
"scannedAt": "2026-05-21T07:52:30.876Z",
"semgrepRan": false,
"npmAuditRan": true,
"pipAuditRan": true
}Rockpack is a lightweight, zero-configuration solution for quickly setting up a React application with full support for Server-Side Rendering (SSR), bundling, linting, and testing. In just 5 minutes, you can get up and running with a modern React app that's optimized for performance and best practices. Perfect for developers who want to skip the setup and focus on building their app!
Get started with Rockpack today and streamline your React app development!
Rockpack will help if:
No comments yet. Be the first to share your thoughts!
Also, pay attention to module iSSR. This tiny module helps you to move your React application to Server-Side Rendering. Please see articles:
Working on many React projects, we are faced with the same type of routine tasks. We answer questions every time:
Every time we spend weeks on these routine tasks.
Using Rockpack you can deploy your project in minutes and start writing really useful code.
Rockpack consists of modules. Let's consider them in more detail:
this is create-react-app on steroids.
Rockpack provides the best practice to set up your application. Project structure has feature based approach (see article here).
Supports the following types of applications:
React SPA – Preset for a Single Page Application using React. React SPA + SSR – Preset for a React Single Page Application with Server-Side Rendering. React Component – Preset for publishing a reusable React component to NPM. UMD Library – Preset for a vanilla JavaScript UMD library, suitable for NPM publishing.
All types of applications support:
Full list of features see here
Additionally, for each type of application, you can install:
More details...
This is React bundler (based on Webpack) using a set of necessary loaders, plugins and using the best practices out of the box.
@rockpack/compiler can help you with:
More details...
This is Jest with cool config, add-ons and fully compatible with TS / Babel.
More details...
This is an efficiently customized Eslint with many best practical rules and additions.
More details...
In order to get more detailed info please follow each module links.
Rockpack is a completely free project. We are always open to collaboration and contributors.
The Rockpack project was inspired by:
...if we have create-react-app or other?
Copyright (c) Sergey Aleksandrov
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.