registry / @htyf-mp/taro-rn-supporter / 0.4.4

@htyf-mp/taro-rn-supporter@0.4.4

Taro rn supporter

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 59.6 KB of source, external domains: github.com

Source & flagged code

2 flagged

TerminalReporter.jsView file

Lines 1-2javascript

1module.exports = require('./dist/TerminalReporter').default

Medium

Dynamic Require

Package source references dynamic require/import behavior.

TerminalReporter.jsView on unpkg · L1

dist/babel.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.getBabelConfig = getBabelConfig;

4// @ts-ignore

5const helper_1 = require("@tarojs/helper");

6const shared_1 = require("@tarojs/shared");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/babel.jsView on unpkg · L4

7function parseDefineConst(defineConstants) {

8 const result = {};

9 for (const [key, value] of Object.entries(defineConstants)) {

10 try {

11 // @ts-ignore

12 result[key] = JSON.parse(value);

13 }

14 catch (e) {

15 console.error('defineConstants error: ', e);

16 // @ts-ignore

17 result[key] = '';

18 }

19 }

20 return result;

21}

22function getEnv(config) {

23 var _a;

24 const envConst = {

Source & flagged code

2 flagged · loading source

TerminalReporter.jsView file

1module.exports = require('./dist/TerminalReporter').default

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code