registry / @rslint/core / 0.6.5

@rslint/core@0.6.5

rslint core library

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 2.03 MB of source

Source & flagged code

5 flagged

dist/internal.jsView file

Lines 1-21javascript

1import { spawn } from "child_process";

2import { Socket } from "node:net";

High

Child Process

Package source references child process execution.

dist/internal.jsView on unpkg · L1

3import { resolveRslintBinary } from "./770.js";

4import { RSLintService } from "./service.js";

5class NodeRslintService {

6 nextMessageId;

7 pendingMessages;

8 rslintPath;

9 process;

10 chunks;

11 chunkSize;

12 expectedSize;

13 dead;

14 closing;

15 constructor(options = {}){

16 this.nextMessageId = 1;

17 this.pendingMessages = new Map();

18 this.rslintPath = options.rslintPath || resolveRslintBinary();

19 this.dead = false;

20 this.closing = false;

21 this.process = spawn(this.rslintPath, [

dist/eslint-plugin/lint-worker.jsView file

11548[ L11549: 'RegExpExecArray', L11550: base_config_1.TYPE

High

Shell

Package source references shell execution.

dist/eslint-plugin/lint-worker.jsView on unpkg · L11548

3Cross-file remote execution chain: dist/eslint-plugin/lint-worker.js spawns dist/eslint-plugin/index.js; helper contains network access plus dynamic code execution. L3: import { createRequire } from "node:module"; L4: import { execSync } from "node:child_process"; L5: import node_path from "node:path"; ... L51: }; L52: __webpack_require__("../../node_modules/.pnpm/esrecurse@4.3.0/node_modules/esrecurse/package.json"); L53: exports.le = Visitor; ... L96: ChainExpression: 'ChainExpression', L97: ClassBody: 'ClassBody', L98: ClassDeclaration: 'ClassDeclaration', ... L930: case 'u': L931: return JSON.parse("\"" + all + "\""); L932: default:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/eslint-plugin/lint-worker.jsView on unpkg · L3

dist/config-loader.jsView file

Lines 29-69javascript

29 if (!Array.isArray(ignorePatterns)) throw new TypeError('ignorePatterns must be an array');

30 if (0 === ignorePatterns.length) throw new TypeError('ignorePatterns must contain at least one pattern');

31 return {

dist/cli.jsView file

Lines 1-24javascript

1import fs_0, * as __rspack_external_fs from "fs";

2import path_0, { basename, dirname, normalize, posix, relative as external_path_relative, resolve, sep } from "path";

3import { fileURLToPath } from "url";

4import { createRequire } from "module";

5import picomatch

Source & flagged code

5 flagged · loading source

dist/internal.jsView file

1import { spawn } from "child_process"; L2: import { Socket } from "node:net";

High

Child Process

Package source references child process execution.

dist/internal.jsView on unpkg · L1

dist/eslint-plugin/lint-worker.jsView file

11548[ L11549: 'RegExpExecArray', L11550: base_config_1.TYPE

High

Shell

Package source references shell execution.

dist/eslint-plugin/lint-worker.jsView on unpkg · L11548

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/eslint-plugin/lint-worker.jsView on unpkg · L3

dist/config-loader.jsView file

49if ('.js' === ext || '.mjs' === ext) { L50: const mod = await import(pathToFileURL(configPath).href); L51: return mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config-loader.jsView on unpkg · L49

dist/cli.jsView file

4package = @rslint/core; repositoryIdentity = rslint; dependency = picomatch L4: import { createRequire } from "module"; L5: import picomatch from "picomatch"; L6: import node_fs from "node:fs";

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cli.jsView on unpkg · L4

Findings

4 High3 Medium3 Low

HighChild Processdist/internal.js

HighShelldist/eslint-plugin/lint-worker.js

HighCopied Package Dependency Bridgedist/cli.js

HighCross File Remote Execution Contextdist/eslint-plugin/lint-worker.js

MediumDynamic Requiredist/config-loader.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

5 flagged

dist/internal.jsView file

Lines 1-21javascript

1import { spawn } from "child_process";

2import { Socket } from "node:net";

High

Child Process

Package source references child process execution.

dist/internal.jsView on unpkg · L1

3import { resolveRslintBinary } from "./770.js";

4import { RSLintService } from "./service.js";

5class NodeRslintService {

6 nextMessageId;

7 pendingMessages;

8 rslintPath;

9 process;

10 chunks;

11 chunkSize;

12 expectedSize;

13 dead;

14 closing;

15 constructor(options = {}){

16 this.nextMessageId = 1;

17 this.pendingMessages = new Map();

18 this.rslintPath = options.rslintPath || resolveRslintBinary();

19 this.dead = false;

20 this.closing = false;

21 this.process = spawn(this.rslintPath, [

dist/eslint-plugin/lint-worker.jsView file

11548[ L11549: 'RegExpExecArray', L11550: base_config_1.TYPE

High

Shell

Package source references shell execution.

dist/eslint-plugin/lint-worker.jsView on unpkg · L11548

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/eslint-plugin/lint-worker.jsView on unpkg · L3

dist/config-loader.jsView file

Lines 29-69javascript

29 if (!Array.isArray(ignorePatterns)) throw new TypeError('ignorePatterns must be an array');

30 if (0 === ignorePatterns.length) throw new TypeError('ignorePatterns must contain at least one pattern');

31 return {

dist/cli.jsView file

Lines 1-24javascript

1import fs_0, * as __rspack_external_fs from "fs";

2import path_0, { basename, dirname, normalize, posix, relative as external_path_relative, resolve, sep } from "path";

3import { fileURLToPath } from "url";

4import { createRequire } from "module";

5import picomatch