registry  /  @wavemaker/rn-codegen  /  11.15.5-1.256

@wavemaker/rn-codegen@11.15.5-1.256

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 283 file(s), 1.49 MB of source, external domains: noserverrequired.com, npmjs.com

Source & flagged code

4 flagged · loading source
package.jsonView file
•scripts.postinstall = node ./scripts/post-build.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
src/templates/project/component/dynamic/component-generator.jsView file
73// Evaluate the transformed code synchronously L74: const dynamicComponentFunction = new Function(['React, fragment', ...Object.keys(importedComponents)].join(', '), `return ${transformedCode}`); L75: const dynamicComponent = dynamicComponentFunction(React, fragment, ...Object.values(importedComponents));
Low
Eval

Package source references a known benign dynamic code generation pattern.

src/templates/project/component/dynamic/component-generator.jsView on unpkg · L73
index.jsView file
6Object.defineProperty(exports, "__esModule", { value: true }); L7: const yargs_1 = __importDefault(require("yargs")); L8: const fs_extra_1 = __importDefault(require("fs-extra"));
Medium
Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L6
src/templates/project/esbuild/esbuild.script.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = @wavemaker/rn-codegen@11.9.1-6.647649 matchedIdentity = npm:QHdhdmVtYWtlci9ybi1jb2RlZ2Vu:11.9.1-6.647649 similarity = 0.692 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/templates/project/esbuild/esbuild.script.jsView on unpkg

Findings

2 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltasrc/templates/project/esbuild/esbuild.script.js
MediumDynamic Requireindex.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvalsrc/templates/project/component/dynamic/component-generator.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings