registry  /  @bentley/imodeljs-native  /  5.12.2

@bentley/imodeljs-native@5.12.2

iModel.js native module

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystem
Supply chain
UrlStrings
Manifest
NoLicense
scanned 4 file(s), 12.2 KB of source, external domains: www.itwinjs.org

Source & flagged code

3 flagged · loading source
package.jsonView file
•scripts.postinstall = node ./installNativePlatform.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
installNativePlatform.jsView file
4*--------------------------------------------------------------------------------------------*/ L5: const exec = require("child_process").exec; L6: const path = require("path");
High
Child Process

Package source references child process execution.

installNativePlatform.jsView on unpkg · L4
77} else { L78: // We have to run npm install in a temp directory. If we try to run it in the current directory, L79: // it will fight over a (file?) lock that the parent npm install holds. ... L91: console.log(cmdLine); L92: exec(cmdLine, { cwd: installDir }, (error, stdout, stderr) => { L93: if (error)
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

installNativePlatform.jsView on unpkg · L77

Findings

3 High2 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild ProcessinstallNativePlatform.js
HighRuntime Package InstallinstallNativePlatform.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License