registry / @conf-ts/webpack-plugin / 0.0.12

@conf-ts/webpack-plugin@0.0.12

Webpack plugin for conf-ts

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

Filesystem

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 3 file(s), 10.3 KB of source

Source & flagged code

1 flagged

dist/cjs/worker.jsView file

Lines 1-29javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.resolveCompile = resolveCompile;

4exports.default = default_1;

5let cachedCompile;

6function resolveCompile(prefer) {

7 if (cachedCompile && (prefer === 'auto' || cachedCompile.kind === prefer)) {

8 return cachedCompile;

9 }

10 if (prefer !== 'js') {

11 try {

12 const native = require('@conf-ts/compiler-native');

13 cachedCompile = { fn: native.compile, kind: 'native' };

14 return cachedCompile;

15 }

16 catch (err) {

17 if (prefer === 'native')

18 throw err;

19 }

20 }

21 const js = require('@conf-ts/compiler');

22 cachedCompile = { fn: js.compile, kind: 'js' };

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cjs/worker.jsView on unpkg · L20

23 return cachedCompile;

24}

25function default_1(message) {

26 const { resourcePath, format, options, compiler } = message;

27 return resolveCompile(compiler).fn(resourcePath, format, options);

28}

Source & flagged code

1 flagged · loading source

dist/cjs/worker.jsView file

20package = @conf-ts/webpack-plugin; repositoryIdentity = conf-ts; dependency = @conf-ts/compiler L20: } L21: const js = require('@conf-ts/compiler'); L22: cachedCompile = { fn: js.compile, kind: 'js' };

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cjs/worker.jsView on unpkg · L20

Findings

1 High1 Medium3 Low

HighCopied Package Dependency Bridgedist/cjs/worker.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowNo License

Source & flagged code

1 flagged

dist/cjs/worker.jsView file

Lines 1-29javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.resolveCompile = resolveCompile;

4exports.default = default_1;

5let cachedCompile;

6function resolveCompile(prefer) {

7 if (cachedCompile && (prefer === 'auto' || cachedCompile.kind === prefer)) {

8 return cachedCompile;

9 }

10 if (prefer !== 'js') {

11 try {

12 const native = require('@conf-ts/compiler-native');

13 cachedCompile = { fn: native.compile, kind: 'native' };

14 return cachedCompile;

15 }

16 catch (err) {

17 if (prefer === 'native')

18 throw err;

19 }

20 }

21 const js = require('@conf-ts/compiler');

22 cachedCompile = { fn: js.compile, kind: 'js' };

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cjs/worker.jsView on unpkg · L20

23 return cachedCompile;

24}

25function default_1(message) {

26 const { resourcePath, format, options, compiler } = message;

27 return resolveCompile(compiler).fn(resourcePath, format, options);

28}