registry / cachoujs / 0.6.2

cachoujs@0.6.2

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 58 file(s), 690 KB of source, external domains: github.com, local.invalid, schema.org, www.sitemaps.org

Source & flagged code

3 flagged

package.jsonView file

Lines 152-192json

152 "files": [

153 "src",

154 "plugin",

155 "scripts/run-compiler.mjs",

156 "scripts/ensure-compiler.mjs",

157 "compiler.go",

158 "go.mod",

159 "bin/cachou-compiler-wrapper.mjs",

160 "packages/compiler",

161 "packages/create-cachou",

162 "create-cachou",

163 "README.md",

164 "docs",

165 "CHANGELOG.md",

166 "examples/README.md",

167 "packages/README.md",

168 "bin/cachou-compiler.js",

169 "bin/create-cachou.js"

170 ],

171 "scripts": {

172 "postinstall": "node scripts/ensure-compiler.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L172

173 "dev": "CACHOU_DEMO=1 npm run compile && CACHOU_DEMO=1 vite --host",

174 "compiler": "node scripts/run-compiler.mjs",

175 "compile": "node scripts/run-compiler.mjs -dir demo/components -out demo/components -runtime cachoujs",

176 "compiler:build": "go build -o bin/cachou-compiler compiler.go",

177 "compiler:build:multiarch": "node scripts/build-multiarch-compiler.mjs",

178 "compiler:package-binaries": "node scripts/package-compiler-binaries.mjs",

179 "compiler:js": "node packages/compiler/bin/cachou-compiler.js",

180 "build": "npm run compile && vite build",

181 "preview": "vite preview",

182 "start": "NODE_ENV=production node server.js",

183 "check": "node scripts/check.mjs",

184 "test": "npm run test:unit && npm run test:browser",

185 "test:unit": "node --test tests/unit/*.test.js tests/files.test.js",

186 "test:browser": "node scripts/run-browser-tests.mjs",

187 "test:files": "node --test tests/files.test.js",

188 "guardrails": "node scripts/guardrails.mjs",

189 "bench": "node scripts/run-benchmarks.mjs",

190 "bench:memory": "node scripts/run-memory-benchmarks.mjs",

191 "bench:compare": "node scripts/run-competitive-benchmarks.mjs",

192 "bench:ssr": "node scripts/run-ssr-benchmarks.mjs",

src/media.jsView file

Lines 46-86javascript

46 pipeline = pipeline.avif({ quality });

47 } else if (format === "jpeg" || format === "jpg") {

48 pipeline = pipeline.jpeg({ quality, progressive: options.progressive !==

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/ensure-compiler.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

src/media.jsView file

66if (options.output) { L67: const fs = await import("node:fs/promises"); L68: await fs.writeFile(options.output, buffer.data);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/media.jsView on unpkg · L66

377const specifier = "sharp"; L378: const dynamicImport = new Function("s", "return import(s)"); L379: const mod = await dynamicImport(specifier);

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/media.jsView on unpkg · L377

Findings

1 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumDynamic Requiresrc/media.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalsrc/media.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings