registry / cachoujs / 0.5.1

cachoujs@0.5.1

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 56 file(s), 677 KB of source, external domains: github.com, local.invalid, schema.org, www.sitemaps.org

Source & flagged code

3 flagged

package.jsonView file

Lines 75-115json

75 "files": [

76 "src",

77 "plugin",

78 "scripts/run-compiler.mjs",

79 "scripts/ensure-compiler.mjs",

80 "compiler.go",

81 "go.mod",

82 "bin/cachou-compiler-wrapper.mjs",

83 "packages/compiler",

84 "packages/create-cachou",

85 "create-cachou",

86 "README.md",

87 "docs",

88 "CHANGELOG.md",

89 "examples/README.md",

90 "packages/README.md",

91 "bin/cachou-compiler.js",

92 "bin/create-cachou.js"

93 ],

94 "scripts": {

95 "postinstall": "node scripts/ensure-compiler.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L95

96 "dev": "CACHOU_DEMO=1 npm run compile && CACHOU_DEMO=1 vite --host",

97 "compiler": "node scripts/run-compiler.mjs",

98 "compile": "node scripts/run-compiler.mjs -dir demo/components -out demo/components -runtime cachoujs",

99 "compiler:build": "go build -o bin/cachou-compiler compiler.go",

100 "compiler:build:multiarch": "node scripts/build-multiarch-compiler.mjs",

101 "compiler:package-binaries": "node scripts/package-compiler-binaries.mjs",

102 "compiler:js": "node packages/compiler/bin/cachou-compiler.js",

103 "build": "npm run compile && vite build",

104 "preview": "vite preview",

105 "start": "NODE_ENV=production node server.js",

106 "check": "node scripts/check.mjs",

107 "test": "npm run test:unit && npm run test:browser",

108 "test:unit": "node --test tests/unit/*.test.js tests/files.test.js",

109 "test:browser": "node scripts/run-browser-tests.mjs",

110 "test:files": "node --test tests/files.test.js",

111 "guardrails": "node scripts/guardrails.mjs",

112 "bench": "node scripts/run-benchmarks.mjs",

113 "bench:memory": "node scripts/run-memory-benchmarks.mjs",

114 "bench:compare": "node scripts/run-competitive-benchmarks.mjs",

115 "bench:ssr": "node scripts/run-ssr-benchmarks.mjs",

src/media.jsView file

Lines 46-86javascript

46 pipeline = pipeline.avif({ quality });

47 } else if (format === "jpeg" || format === "jpg") {

48 pipeline = pipeline.jpeg({ quality, progressive: options.progressive !==

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/ensure-compiler.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

src/media.jsView file

66if (options.output) { L67: const fs = await import("node:fs/promises"); L68: await fs.writeFile(options.output, buffer.data);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/media.jsView on unpkg · L66

377const specifier = "sharp"; L378: const dynamicImport = new Function("s", "return import(s)"); L379: const mod = await dynamicImport(specifier);

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/media.jsView on unpkg · L377

Findings

1 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumDynamic Requiresrc/media.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalsrc/media.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings