registry / @depup/astro / 7.2.2-depup.1

@depup/astro@7.2.2-depup.1

Astro is a modern site builder with web best practices, performance, and DX front-of-mind. (with updated dependencies)

Static Scan Results

scanned 21h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 88.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source closely matched a different package identity

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 654 file(s), 1.77 MB of source, external domains: astro.build, developer.mozilla.org, docs.astro.build, docs.github.com, docs.netlify.com, example.com, github.com, registry.npmjs.org, sharp.pixelplumbing.com, vercel.com, vite.dev, www.w3.org

Source & flagged code

4 flagged

dist/core/module-loader/vite.jsView file

Lines 36-76javascript

36 if (msg?.type === "error") {

37 if (!msg["__isEnhancedAstroErrorPayload"]) {

38 const err = collectErrorMetadata(msg.err, pathToFileURL(viteServer.config.root));

39 getViteErrorPayload(err).then((payload) => {

40 events.emit("hmr-error", {

41 type: "error",

42 err: {

43 message: payload.err.message,

44 stack: payload.err.stack

45 }

46 });

47 args[0] = payload;

48 _wsSend.apply(this, args);

49 });

50 return;

51 }

52 events.emit("hmr-error", msg);

53 }

54 _wsSend.apply(this, args);

55 };

56 return {

57 import(src) {

58 return ssrEnvironment.runner.import(src);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/module-loader/vite.jsView on unpkg · L56

59 },

60 async resolveId(spec, parent) {

61 const ret = await ssrEnvironment.pluginContainer.resolveId(spec, parent);

62 return ret?.id;

63 },

64 getModuleById(id) {

65 return ssrEnvironment.moduleGraph.getModuleById(id);

66 },

67 getModulesByFile(file) {

68 return ssrEnvironment.moduleGraph.getModulesByFile(file);

69 },

70 getModuleInfo(id) {

71 return ssrEnvironment.pluginContainer.getModuleInfo(id);

72 },

73 eachModule(cb) {

74 return ssrEnvironment.moduleGraph.idToModuleMap.forEach(cb);

75 },

76 invalidateModule(mod) {

bin/astro.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2'use strict';

4const CI_INSTRUCTIONS = {

5 NETLIFY: 'https://docs.netlify.com/configure-builds/manage-dependencies/#node-js-and-javascript',

6 GITHUB_ACTIONS:

7 'https://docs.github.com/en/actions/guides/building-and-testing-nodejs#specifying-the-nodejs-version',

High

dist/cli/add/index.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/add/index.jsView on unpkg

dist/core/routing/create-manifest.jsView file

•matchType = package_source_clone_identity_mismatch matchedPackage = astro@7.2.2 matchedPath = bin/astro.mjs matchedIdentity = npm:YXN0cm8:7.2.2 similarity = 1.000 shingleOverlap = 80 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

dist/core/routing/create-manifest.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/core/module-loader/vite.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code