registry / @nexaloid/nexaloid / 0.1.22

@nexaloid/nexaloid@0.1.22

Chinese tokenizer runtime

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 4.19 KB of source

Source & flagged code

4 flagged

package.jsonView file

Lines 1-19json

2 "name": "@nexaloid/nexaloid",

3 "version": "0.1.22",

4 "description": "Chinese tokenizer runtime",

5 "license": "Apache-2.0",

6 "repository": {

7 "type": "git",

8 "url": "git+https://github.com/Nexaloid/Nexaloid.git",

9 "directory": "bindings/node"

10 },

11 "main": "index.js",

12 "scripts": {

13 "build": "node-gyp rebuild && node scripts/stage-local.js",

14 "install": "node scripts/check-prebuild.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

15 "test:binding": "node test/regression.js"

16 },

17 "gypfile": true

18}

index.jsView file

Lines 1-21javascript

1const path = require("node:path");

2const fs = require("node:fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L1

4const root = path.resolve(__dirname, "../..");

5const platformArch = require("./platform");

6const prebuildDir = path.join(__dirname, "prebuilds", platformArch);

7const localBuild = path.join(__dirname, "build/Release/nexaloid_node.node");

8if (process.platform === "win32" && fs.existsSync(localBuild)) {

9 process.env.PATH = path.join(root, "core", "zig-out", "bin") + path.delimiter + process.env.PATH;

10} else if (process.platform === "win32" && fs.existsSync(prebuildDir)) {

11 process.env.PATH = prebuildDir + path.delimiter + process.env.PATH;

12} else if (process.platform === "win32") {

13 process.env.PATH = path.join(root, "core", "zig-out", "bin") + path.delimiter + process.env.PATH;

14}

16const prebuild = path.join(prebuildDir, "nexaloid_node.node");

17const native = require(fs.existsSync(localBuild) ? localBuild : fs.existsSync(prebuild) ? prebuild : localBuild);

18const packagedDict = path.join(__dirname, "data", "dict", "nexaloid.tsv");

19const repoDict = path.join(root, "data", "dict", "nexaloid.tsv");

20const hmmArtifactName = "bmes_hmm_wordhub_lattice.nxhmm";

21const hmmManifestName = "bmes_hmm_wordhub_lattice.manifest.json";

prebuilds/windows-x64/nexaloid.dllView file

•path = prebuilds/windows-x64/nexaloid.dll kind = native_binary sizeBytes = 363520 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilds/windows-x64/nexaloid.dllView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 753 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.install = node scripts/check-prebuild.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

1const path = require("node:path"); L2: const fs = require("node:fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L1

prebuilds/windows-x64/nexaloid.dllView file

•path = prebuilds/windows-x64/nexaloid.dll kind = native_binary sizeBytes = 363520 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilds/windows-x64/nexaloid.dllView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 753 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

Findings

1 High5 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumDynamic Requireindex.js

MediumEnvironment Vars

MediumShips Native Binaryprebuilds/windows-x64/nexaloid.dll

MediumShips Build Helperbinding.gyp

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Source & flagged code

4 flagged

package.jsonView file

Lines 1-19json

2 "name": "@nexaloid/nexaloid",

3 "version": "0.1.22",

4 "description": "Chinese tokenizer runtime",

5 "license": "Apache-2.0",

6 "repository": {

7 "type": "git",

8 "url": "git+https://github.com/Nexaloid/Nexaloid.git",

9 "directory": "bindings/node"

10 },

11 "main": "index.js",

12 "scripts": {

13 "build": "node-gyp rebuild && node scripts/stage-local.js",

14 "install": "node scripts/check-prebuild.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

15 "test:binding": "node test/regression.js"

16 },

17 "gypfile": true

18}

index.jsView file

Lines 1-21javascript

1const path = require("node:path");

2const fs = require("node:fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L1

4const root = path.resolve(__dirname, "../..");

5const platformArch = require("./platform");

6const prebuildDir = path.join(__dirname, "prebuilds", platformArch);

7const localBuild = path.join(__dirname, "build/Release/nexaloid_node.node");

8if (process.platform === "win32" && fs.existsSync(localBuild)) {

9 process.env.PATH = path.join(root, "core", "zig-out", "bin") + path.delimiter + process.env.PATH;

10} else if (process.platform === "win32" && fs.existsSync(prebuildDir)) {

11 process.env.PATH = prebuildDir + path.delimiter + process.env.PATH;

12} else if (process.platform === "win32") {

13 process.env.PATH = path.join(root, "core", "zig-out", "bin") + path.delimiter + process.env.PATH;

14}

16const prebuild = path.join(prebuildDir, "nexaloid_node.node");

17const native = require(fs.existsSync(localBuild) ? localBuild : fs.existsSync(prebuild) ? prebuild : localBuild);

18const packagedDict = path.join(__dirname, "data", "dict", "nexaloid.tsv");

19const repoDict = path.join(root, "data", "dict", "nexaloid.tsv");

20const hmmArtifactName = "bmes_hmm_wordhub_lattice.nxhmm";

21const hmmManifestName = "bmes_hmm_wordhub_lattice.manifest.json";

prebuilds/windows-x64/nexaloid.dllView file

•path = prebuilds/windows-x64/nexaloid.dll kind = native_binary sizeBytes = 363520 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilds/windows-x64/nexaloid.dllView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 753 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg