registry / @trackunit/iris-app-sdk-vite / 1.2.4

@trackunit/iris-app-sdk-vite@1.2.4

Custom NX executors for building and serving Iris Apps using Vite.

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 16 file(s), 84.8 KB of source, external domains: dev.manager.trackunit.com, iris.trackunit.app, new.manager.trackunit.com

Source & flagged code

3 flagged

src/executors/utils/loadCssInjectedByJsPlugin.jsView file

Lines 1-41javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.defaultSearchRoots = void 0;

4exports.resolveCssInjectedByJsPluginEntry = resolveCssInjectedByJsPluginEntry;

5exports.loadCssInjectedByJsPlugin = loadCssInjectedByJsPlugin;

6const tslib_1 = require("tslib");

7/**

8 * Indirect loader for `vite-plugin-css-injected-by-js` (ESM-only since v5).

9 *

10 * ## Why this file exists

11 *

12 * 1. Iris remotes must inject CSS into the JS bundle. The host iframe's CSP

13 * blocks external stylesheets, so a separate `.css` file leaves the app

14 * unstyled. Vite 8/Rolldown stopped emitting CSS the way Rollup did, so we

15 * need this plugin (v5+) to inline it.

16 * 2. The plugin only publishes an `import` export condition. A plain

17 * `import … from "vite-plugin-css-injected-by-js"` (or a static `require`)

18 * fails under Nx's CJS executor hooks, which rewrite dynamic `import()` into

19 * `require()` and hit `ERR_PACKAGE_PATH_NOT_EXPORTED`.

20 *

21 * This module therefore resolves the package's ESM entry from its manifest and

22 * loads it via an indirect `new Function("return import(...)")` so Node really

23 * does an ESM import.

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/executors/utils/loadCssInjectedByJsPlugin.jsView on unpkg · L21

24 *

25 * ## When to delete this file

26 *

27 * Replace the call site in `getTrackunitIrisAppVitePlugins.ts` with a normal

28 * `import cssInjectedByJsPlugin from "vite-plugin-css-injected-by-js"` and

29 * delete this module once **all** of the following are true:

30 *

31 * - Nx executors for this package run as native ESM (no CJS rewrite of

32 * `import()`), **or** the plugin ships a CJS/`require` export again; and

33 * - A plain static import of the plugin works inside

34 * `yarn nx build <any-iris-app>` (Iris apps still load with styles).

35 *

36 * Until then, do not "simplify" this back to a static import — that is the

37 * regression that left Iris apps blank after the Vite 8 upgrade.

38 */

39const fs = tslib_1.__importStar(require("node:fs"));

40const path = tslib_1.__importStar(require("node:path"));

41const node_url_1 = require("node:url");

src/index.jsView file

Lines 1-6javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.svgSpriteInline = void 0;

4var svgSpriteInline_1 = require(

src/executors/utils/getTrackunitIrisAppVitePlugins.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @trackunit/iris-app-sdk-vite@1.1.3 matchedIdentity = npm:[redacted]:1.1.3 similarity = 0.867 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/executors/utils/getTrackunitIrisAppVitePlugins.jsView on unpkg

Source & flagged code

3 flagged · loading source

src/executors/utils/loadCssInjectedByJsPlugin.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code