registry / @blksails/pi-web-react / 0.5.0

@blksails/pi-web-react@0.5.0

Static Scan Results

scanned 23h ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 6 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireNetwork

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 35 file(s), 208 KB of source

Source & flagged code

2 flagged

src/web-ext/extension-loader.tsView file

Lines 1-26typescript

1/**

2 * extension-loader — 宿主侧运行时扩展加载器(任务 3.2 / Req 1.1, 1.2, 1.4, 6.x)。

3 *

4 * 流程:读 manifest → 安全门校验(extension-gate)→

5 * - 纯声明(无 entry):从 manifest.config 合成描述符,**零 bundle**(Tier 5)。

6 * - 代码扩展:fetch entry 字节 → 门控通过后,经 import map 把裸 specifier 解析到宿主

7 * 单例,动态 `import()` 入口,取默认导出描述符。

8 * 任何缺失/非法/拒绝 → 返回可回退结果(宿主用默认 UI),不抛、不崩。

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/web-ext/extension-loader.tsView on unpkg · L6

9 *

10 * 依赖注入:`LoaderDeps` 让 fetch/import 可在测试中替身;`browserLoaderDeps()` 提供

11 * 真实浏览器实现(动态 import 经 `new Function` 规避打包器静态改写)。

12 */

13import type { WebExtensionManifest } from "@blksails/pi-web-protocol";

14import { isDeclarativeOnly } from "@blksails/pi-web-protocol";

15import type { WebExtension } from "@blksails/pi-web-kit";

16import { verifyExtension, type GateOptions } from "./extension-gate.js";

18export interface LoaderDeps {

19 /** 取 entry 字节(SRI 校验用)。 */

20 fetchBytes(url: string): Promise<Uint8Array>;

21 /** 动态 import 入口(裸 specifier 由预装 import map 解析到宿主单例)。 */

22 importModule(url: string): Promise<{ default: WebExtension }>;

23}

25export type LoadOutcome =

26 | { readonly status: "loaded"; readonly extension: WebExtension }

src/client/pi-client.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @blksails/pi-web-react@0.2.0 matchedIdentity = npm:QGJsa3NhaWxzL3BpLXdlYi1yZWFjdA:0.2.0 similarity = 0.788 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/client/pi-client.tsView on unpkg

Source & flagged code

2 flagged · loading source

src/web-ext/extension-loader.tsView file

6* - 代码扩展:fetch entry 字节 → 门控通过后,经 import map 把裸 specifier 解析到宿主 L7: * 单例,动态 `import()` 入口,取默认导出描述符。 L8: * 任何缺失/非法/拒绝 → 返回可回退结果(宿主用默认 UI),不抛、不崩。

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/web-ext/extension-loader.tsView on unpkg · L6

src/client/pi-client.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/client/pi-client.tsView on unpkg

Findings

1 High2 Medium3 Low

HighPrevious Version Dangerous Deltasrc/client/pi-client.ts

MediumDynamic Requiresrc/web-ext/extension-loader.ts

MediumNetwork

LowScripts Present

LowHigh Entropy Strings

LowNo License