registry / @module-federation/vite / 1.16.16

@module-federation/vite@1.16.16

Vite plugin for Module Federation

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 311 KB of source, external domains: www.w3schools.com

Source & flagged code

2 flagged

lib/ssrVmStrategy-DtpfkCw1.jsView file

Lines 1-35javascript

1import { SsrEntryHttpError, neutralizeBrowserPreloadHelpers } from "./utils/ssrEntryLoader.js";

2//#region src/utils/ssrVmStrategy.ts

3/**

4* vm.SourceTextModule strategy for loading remote SSR entries.

6* Unlike the temp-file strategy (which rewrites bare shared imports to

7* host-resolved file:// paths at fetch time), this strategy evaluates the

8* remote's ESM graph with `vm.SourceTextModule` in the current context and

9* resolves bare imports through a linker, in order:

10*

11* 1. The host's federation share scope — `instance.loadShare(name)` on the

12* global `__FEDERATION__` instances. This restores real share-scope

13* semantics (version negotiation, loaded-first reuse) on the server.

14* 2. The build-time `resolvedShared` file map (same source as the temp-file

15* strategy) as a fallback when no instance shares the package.

16* 3. Plain host `import(specifier)` for everything else (node builtins,

17* packages the remote expects the host to provide).

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/ssrVmStrategy-DtpfkCw1.jsView on unpkg · L15

18*

19* Requires Node with `--experimental-vm-modules`; callers must check

20* `isVmStrategyAvailable()` and fall back to the temp-file strategy when the

21* API is missing.

22*/

23let vmApiPromise;

24async function getVmApi() {

25 if (!vmApiPromise) vmApiPromise = (async () => {

26 try {

27 const vm = await import(

28 /* @vite-ignore */

29 "vm"

30);

31 if (typeof vm.SourceTextModule !== "function" || typeof vm.SyntheticModule !== "function") return null;

32 return vm;

33 } catch {

34 return null;

35 }

lib/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @module-federation/vite@1.16.15 matchedIdentity = npm:QG1vZHVsZS1mZWRlcmF0aW9uL3ZpdGU:1.16.15 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/index.jsView on unpkg

Source & flagged code

2 flagged · loading source

lib/ssrVmStrategy-DtpfkCw1.jsView file

15* strategy) as a fallback when no instance shares the package. L16: * 3. Plain host `import(specifier)` for everything else (node builtins, L17: * packages the remote expects the host to provide).

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/ssrVmStrategy-DtpfkCw1.jsView on unpkg · L15

lib/index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/index.jsView on unpkg

Findings

1 High4 Medium5 Low

HighPrevious Version Dangerous Deltalib/index.js

MediumDynamic Requirelib/ssrVmStrategy-DtpfkCw1.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

lib/ssrVmStrategy-DtpfkCw1.jsView file

Lines 1-35javascript

1import { SsrEntryHttpError, neutralizeBrowserPreloadHelpers } from "./utils/ssrEntryLoader.js";

2//#region src/utils/ssrVmStrategy.ts

3/**

4* vm.SourceTextModule strategy for loading remote SSR entries.

6* Unlike the temp-file strategy (which rewrites bare shared imports to

7* host-resolved file:// paths at fetch time), this strategy evaluates the

8* remote's ESM graph with `vm.SourceTextModule` in the current context and

9* resolves bare imports through a linker, in order:

10*

11* 1. The host's federation share scope — `instance.loadShare(name)` on the

12* global `__FEDERATION__` instances. This restores real share-scope

13* semantics (version negotiation, loaded-first reuse) on the server.

14* 2. The build-time `resolvedShared` file map (same source as the temp-file

15* strategy) as a fallback when no instance shares the package.

16* 3. Plain host `import(specifier)` for everything else (node builtins,

17* packages the remote expects the host to provide).

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/ssrVmStrategy-DtpfkCw1.jsView on unpkg · L15

18*

19* Requires Node with `--experimental-vm-modules`; callers must check

20* `isVmStrategyAvailable()` and fall back to the temp-file strategy when the

21* API is missing.

22*/

23let vmApiPromise;

24async function getVmApi() {

25 if (!vmApiPromise) vmApiPromise = (async () => {

26 try {

27 const vm = await import(

28 /* @vite-ignore */

29 "vm"

30);

31 if (typeof vm.SourceTextModule !== "function" || typeof vm.SyntheticModule !== "function") return null;

32 return vm;

33 } catch {

34 return null;

35 }

lib/index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/index.jsView on unpkg