registry / @tuananh/sax-parser / 1.2.0

@tuananh/sax-parser@1.2.0

An extremely fast SAX parser for Node.js, written in C++.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsNativeBindings

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 1.91 KB of source

Source & flagged code

3 flagged

package.jsonView file

Lines 1-29json

2 "name": "@tuananh/sax-parser",

3 "version": "1.2.0",

4 "description": "An extremely fast SAX parser for Node.js, written in C++.",

5 "main": "index.js",

6 "scripts": {

7 "test": "cross-env NODE_OPTIONS=\"--expose-gc\" jest",

8 "build": "node-gyp rebuild",

9 "install": "node scripts/build-from-source.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

10 "benchmark": "node benchmark",

11 "fmt": "prettier --write **/*.js index.js",

12 "create-npm-dirs": "node scripts/create-npm-dirs.js",

13 "artifacts": "node scripts/collect-artifacts.js",

14 "prepublishOnly": "node scripts/prepublish.js"

15 },

16 "files": [

17 "index.js",

18 "scripts/build-from-source.js",

19 "binding.gyp",

20 "src/**",

21 "vendor/**"

22 ],

23 "publishConfig": {

24 "access": "public",

25 "registry": "https://registry.npmjs.org/"

26 },

27 "keywords": [

28 "xml",

29 "sax",

index.jsView file

Lines 1-22javascript

1'use strict'

3const EventEmitter = require('events').EventEmitter

4const Stream = require('stream').Stream

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.js

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 977 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.install = node scripts/build-from-source.js

High

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code