registry / @utoo/pack / 1.4.18

@utoo/pack@1.4.18

> 🌖 High-performance bundler core for the Utoo toolchain, powered by [Turbopack](https://turbo.build/pack).

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 54 file(s), 229 KB of source, external domains: github.com

Source & flagged code

4 flagged

esm/utils/mkcert.jsView file

Lines 1-21javascript

1import { execSync } from "node:child_process";

2import { createPrivateKey, X509Certificate } from "node:crypto";

High

Child Process

Package source references child process execution.

esm/utils/mkcert.jsView on unpkg · L1

3import fs from "node:fs";

4import path from "node:path";

5import { WritableStream } from "node:stream/web";

6import os from "os";

7const MKCERT_VERSION = "v1.4.4";

8function getBinaryName() {

9 const platform = process.platform;

10 const arch = process.arch === "x64" ? "amd64" : process.arch;

11 if (platform === "win32") {

12 return `mkcert-${MKCERT_VERSION}-windows-${arch}.exe`;

13 }

14 if (platform === "darwin") {

15 return `mkcert-${MKCERT_VERSION}-darwin-${arch}`;

16 }

17 if (platform === "linux") {

18 return `mkcert-${MKCERT_VERSION}-linux-${arch}`;

19 }

20 throw new Error(`Unsupported platform: ${platform}`);

21}

esm/commands/build.jsView file

Lines 92-127javascript

92 await plugin.generate(outputDir, assets, publicPath);

93 }

94 }

95 if (process.env.ANALYZE) {

96 await analyzeBundle(((_k = bundleOptions.config.output) === null || _k === void 0

esm/config/readWebpackConfig.jsView file

Lines 1-32javascript

1import fs from "fs";

2import path from "path";

3export function readWebpackConfig(projectPath, rootPath) {

4 const projectPathOutOfRoot = projectPath === undefined

Source & flagged code

4 flagged · loading source

esm/utils/mkcert.jsView file

1import { execSync } from "node:child_process"; L2: import { createPrivateKey, X509Certificate } from "node:crypto";

High

Child Process

Package source references child process execution.

esm/utils/mkcert.jsView on unpkg · L1

esm/commands/build.jsView file

114stdio: "inherit", L115: shell: true, L116: });

High

Shell

Package source references shell execution.

esm/commands/build.jsView on unpkg · L114

112return new Promise((resolve, reject) => { L113: const analyzer = spawn("npx", ["webpack-bundle-analyzer", statsPath], { L114: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

esm/commands/build.jsView on unpkg · L112

esm/config/readWebpackConfig.jsView file

12.find(fs.existsSync); L13: const config = require(configFile || configPath); L14: if (typeof config === "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

esm/config/readWebpackConfig.jsView on unpkg · L12

Findings

3 High4 Medium4 Low

HighChild Processesm/utils/mkcert.js

HighShellesm/commands/build.js

HighRuntime Package Installesm/commands/build.js

MediumDynamic Requireesm/config/readWebpackConfig.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

4 flagged

esm/utils/mkcert.jsView file

Lines 1-21javascript

1import { execSync } from "node:child_process";

2import { createPrivateKey, X509Certificate } from "node:crypto";

High

Child Process

Package source references child process execution.

esm/utils/mkcert.jsView on unpkg · L1

3import fs from "node:fs";

4import path from "node:path";

5import { WritableStream } from "node:stream/web";

6import os from "os";

7const MKCERT_VERSION = "v1.4.4";

8function getBinaryName() {

9 const platform = process.platform;

10 const arch = process.arch === "x64" ? "amd64" : process.arch;

11 if (platform === "win32") {

12 return `mkcert-${MKCERT_VERSION}-windows-${arch}.exe`;

13 }

14 if (platform === "darwin") {

15 return `mkcert-${MKCERT_VERSION}-darwin-${arch}`;

16 }

17 if (platform === "linux") {

18 return `mkcert-${MKCERT_VERSION}-linux-${arch}`;

19 }

20 throw new Error(`Unsupported platform: ${platform}`);

21}

esm/commands/build.jsView file

Lines 92-127javascript

92 await plugin.generate(outputDir, assets, publicPath);

93 }

94 }

95 if (process.env.ANALYZE) {

96 await analyzeBundle(((_k = bundleOptions.config.output) === null || _k === void 0

esm/config/readWebpackConfig.jsView file

Lines 1-32javascript

1import fs from "fs";

2import path from "path";

3export function readWebpackConfig(projectPath, rootPath) {

4 const projectPathOutOfRoot = projectPath === undefined