registry / @utoo/pack / 1.4.17

@utoo/pack@1.4.17

⚠ Under review

> 🌖 High-performance bundler core for the Utoo toolchain, powered by [Turbopack](https://turbo.build/pack).

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 52 file(s), 227 KB of source, external domains: github.com

Source & flagged code

5 flagged

esm/utils/mkcert.jsView file

Lines 1-21javascript

1import { execSync } from "node:child_process";

2import { createPrivateKey, X509Certificate } from "node:crypto";

High

Child Process

Package source references child process execution.

esm/utils/mkcert.jsView on unpkg · L1

3import fs from "node:fs";

4import path from "node:path";

5import { WritableStream } from "node:stream/web";

6import os from "os";

7const MKCERT_VERSION = "v1.4.4";

8function getBinaryName() {

9 const platform = process.platform;

10 const arch = process.arch === "x64" ? "amd64" : process.arch;

11 if (platform === "win32") {

12 return `mkcert-${MKCERT_VERSION}-windows-${arch}.exe`;

13 }

14 if (platform === "darwin") {

15 return `mkcert-${MKCERT_VERSION}-darwin-${arch}`;

16 }

17 if (platform === "linux") {

18 return `mkcert-${MKCERT_VERSION}-linux-${arch}`;

19 }

20 throw new Error(`Unsupported platform: ${platform}`);

21}

esm/commands/build.jsView file

Lines 87-122javascript

87 await plugin.generate(outputDir, assets, publicPath);

88 }

89 }

90 if (process.env.ANALYZE) {

91 await analyzeBundle(((_k = bundleOptions.config.output) === null || _k === void 0

esm/config/readWebpackConfig.jsView file

Lines 1-32javascript

1import fs from "fs";

2import path from "path";

3export function readWebpackConfig(projectPath, rootPath) {

4 const projectPathOutOfRoot = projectPath === undefined

cjs/commands/build.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @utoo/pack@1.4.18 matchedIdentity = npm:QHV0b28vcGFjaw:1.4.18 similarity = 0.920 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cjs/commands/build.jsView on unpkg

Source & flagged code

5 flagged · loading source

esm/utils/mkcert.jsView file

1import { execSync } from "node:child_process"; L2: import { createPrivateKey, X509Certificate } from "node:crypto";

High

Child Process

Package source references child process execution.

esm/utils/mkcert.jsView on unpkg · L1

esm/commands/build.jsView file

109stdio: "inherit", L110: shell: true, L111: });

High

Shell

Package source references shell execution.

esm/commands/build.jsView on unpkg · L109

107return new Promise((resolve, reject) => { L108: const analyzer = spawn("npx", ["webpack-bundle-analyzer", statsPath], { L109: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

esm/commands/build.jsView on unpkg · L107

esm/config/readWebpackConfig.jsView file

12.find(fs.existsSync); L13: const config = require(configFile || configPath); L14: if (typeof config === "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

esm/config/readWebpackConfig.jsView on unpkg · L12

cjs/commands/build.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cjs/commands/build.jsView on unpkg

Findings

1 Critical3 High4 Medium4 Low

CriticalPrevious Version Dangerous Deltacjs/commands/build.js

HighChild Processesm/utils/mkcert.js

HighShellesm/commands/build.js

HighRuntime Package Installesm/commands/build.js

MediumDynamic Requireesm/config/readWebpackConfig.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

5 flagged

esm/utils/mkcert.jsView file

Lines 1-21javascript

1import { execSync } from "node:child_process";

2import { createPrivateKey, X509Certificate } from "node:crypto";

High

Child Process

Package source references child process execution.

esm/utils/mkcert.jsView on unpkg · L1

3import fs from "node:fs";

4import path from "node:path";

5import { WritableStream } from "node:stream/web";

6import os from "os";

7const MKCERT_VERSION = "v1.4.4";

8function getBinaryName() {

9 const platform = process.platform;

10 const arch = process.arch === "x64" ? "amd64" : process.arch;

11 if (platform === "win32") {

12 return `mkcert-${MKCERT_VERSION}-windows-${arch}.exe`;

13 }

14 if (platform === "darwin") {

15 return `mkcert-${MKCERT_VERSION}-darwin-${arch}`;

16 }

17 if (platform === "linux") {

18 return `mkcert-${MKCERT_VERSION}-linux-${arch}`;

19 }

20 throw new Error(`Unsupported platform: ${platform}`);

21}

esm/commands/build.jsView file

Lines 87-122javascript

87 await plugin.generate(outputDir, assets, publicPath);

88 }

89 }

90 if (process.env.ANALYZE) {

91 await analyzeBundle(((_k = bundleOptions.config.output) === null || _k === void 0

esm/config/readWebpackConfig.jsView file

Lines 1-32javascript

1import fs from "fs";

2import path from "path";

3export function readWebpackConfig(projectPath, rootPath) {

4 const projectPathOutOfRoot = projectPath === undefined

cjs/commands/build.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cjs/commands/build.jsView on unpkg