registry / chaincss / 2.11.1

chaincss@2.11.1

ChainCSS - The first CSS-in-JS library with true auto-detection mixed mode. Zero runtime by default, dynamic when you need it.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 2.27 MB of source, external domains: github.com, www.w3.org

Source & flagged code

6 flagged

dist/cli/index.jsView file

Lines 7664-7704javascript

7664 console.log(chalk3.gray("\n\n\u{1F44B} Stopped watching\n"));

7665 process.exit(0);

7666 });

7667 break;

7668 default:

7669 console.log(chalk3.yellow(`

7670\u274C Unknown action: ${action}`));

7671 console.log(chalk3.gray("\nAvailable actions:"));

7672 console.log(chalk3.cyan(" list ") + chalk3.gray("- List all timeline snapshots"));

7673 console.log(chalk3.cyan(" diff ") + chalk3.gray("- Compare two snapshots"));

7674 console.log(chalk3.cyan(" changes ") + chalk3.gray("- Show individual style changes"));

7675 console.log(chalk3.cyan(" stats ") + chalk3.gray("- Show timeline statistics"));

7676 console.log(chalk3.cyan(" export ") + chalk3.gray("- Export timeline to JSON"));

7677 console.log(chalk3.cyan(" clear ") + chalk3.gray("- Clear timeline data"));

7678 console.log(chalk3.cyan(" watch ") + chalk3.gray("- Watch for timeline updates\n"));

7679 }

7680}

7681

7682// src/cli/commands/dev.ts

7683import path9 from "path";

7684import fs10 from "fs";

7685import { spawn } from "child_process";

7686import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L7684

7687var MIME_TYPES = {

7688 ".html": "text/html; charset=utf-8",

7689 ".css": "text/css; charset=utf-8",

7690 ".js": "application/javascript; charset=utf-8",

7691 ".mjs": "application/javascript; charset=utf-8",

7692 ".json": "application/json; charset=utf-8",

7693 ".png": "image/png",

7694 ".jpg": "image/jpeg",

7695 ".svg": "image/svg+xml",

7696 ".ico": "image/x-icon"

7697};

7698var LIVE_RELOAD_SCRIPT = `<script>

7699(function() {

7700 if (window.__chaincss_reloading) return;

7701 var es = new EventSource('/__chaincss_reload');

7702 var debounce = null, connected = false;

7703 es.onopen = function() { connected = true; };

7704 es.onmessage = function() {

Lines 7774-7814javascript

7774 destroy() {

7775 if (this.timer) {

7776 clearTimeout(this.timer);

7777 this.timer = null;

7778 }

7779 }

7780};

7781async function devCommand(options) {

dist/plugins/webpack.jsView file

Lines 112-152javascript

112 CACHE_PRUNE_SIZE: 100 * 1024 * 1024,

113 // 100MB

114 MAX_STRING_BUFFER: 10 * 1024 * 1024,

115 // 10MB

116 BATCH_SIZE

Source & flagged code

6 flagged · loading source

dist/cli/index.jsView file

7684import fs10 from "fs"; L7685: import { spawn } from "child_process"; L7686: import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L7684

7794logger.info("\u{1F3A8} Starting CSS compiler..."); L7795: const cssWatcher = spawn("npx", ["chaincss", "build", "--watch", ...options.config ? ["--config", options.config] : []], { stdio: ["inherit", "pipe", "pipe"], shell: true, env: { .... L7796: const cssReady = new Promise((resolve) => {

High

Shell

Package source references shell execution.

dist/cli/index.jsView on unpkg · L7794

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L7794

dist/plugins/webpack.jsView file

534function __import__(name) { L535: return new Function("name", "return import(name)")(name); L536: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins/webpack.jsView on unpkg · L534

534function __import__(name) { L535: return new Function("name", "return import(name)")(name); L536: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/plugins/webpack.jsView on unpkg · L534

132threshold: 2, L133: naming: process.env.NODE_ENV === "production" ? "hash" : "readable", L134: cache: true, ... L534: function __import__(name) { L535: return new Function("name", "return import(name)")(name); L536: } ... L2591: if (!macro2) return null; L2592: const merged = JSON.parse(JSON.stringify(macro2)); L2593: if (!overrides) return merged; ... L5127: type: "responsive-issues", L5128: data: { issues, count: issues.length }, L5129: confidence: issues.some((i) => i.severity === "error") ? 1 : 0.7

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/plugins/webpack.jsView on unpkg · L132

Findings

3 High4 Medium7 Low

HighChild Processdist/cli/index.js

HighShelldist/cli/index.js

HighRuntime Package Installdist/cli/index.js

MediumDynamic Requiredist/plugins/webpack.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/plugins/webpack.js

LowWeak Cryptodist/plugins/webpack.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/cli/index.jsView file

Lines 7664-7704javascript

7664 console.log(chalk3.gray("\n\n\u{1F44B} Stopped watching\n"));

7665 process.exit(0);

7666 });

7667 break;

7668 default:

7669 console.log(chalk3.yellow(`

7670\u274C Unknown action: ${action}`));

7671 console.log(chalk3.gray("\nAvailable actions:"));

7672 console.log(chalk3.cyan(" list ") + chalk3.gray("- List all timeline snapshots"));

7673 console.log(chalk3.cyan(" diff ") + chalk3.gray("- Compare two snapshots"));

7674 console.log(chalk3.cyan(" changes ") + chalk3.gray("- Show individual style changes"));

7675 console.log(chalk3.cyan(" stats ") + chalk3.gray("- Show timeline statistics"));

7676 console.log(chalk3.cyan(" export ") + chalk3.gray("- Export timeline to JSON"));

7677 console.log(chalk3.cyan(" clear ") + chalk3.gray("- Clear timeline data"));

7678 console.log(chalk3.cyan(" watch ") + chalk3.gray("- Watch for timeline updates\n"));

7679 }

7680}

7681

7682// src/cli/commands/dev.ts

7683import path9 from "path";

7684import fs10 from "fs";

7685import { spawn } from "child_process";

7686import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L7684

7687var MIME_TYPES = {

7688 ".html": "text/html; charset=utf-8",

7689 ".css": "text/css; charset=utf-8",

7690 ".js": "application/javascript; charset=utf-8",

7691 ".mjs": "application/javascript; charset=utf-8",

7692 ".json": "application/json; charset=utf-8",

7693 ".png": "image/png",

7694 ".jpg": "image/jpeg",

7695 ".svg": "image/svg+xml",

7696 ".ico": "image/x-icon"

7697};

7698var LIVE_RELOAD_SCRIPT = `<script>

7699(function() {

7700 if (window.__chaincss_reloading) return;

7701 var es = new EventSource('/__chaincss_reload');

7702 var debounce = null, connected = false;

7703 es.onopen = function() { connected = true; };

7704 es.onmessage = function() {

Lines 7774-7814javascript

7774 destroy() {

7775 if (this.timer) {

7776 clearTimeout(this.timer);

7777 this.timer = null;

7778 }

7779 }

7780};

7781async function devCommand(options) {

dist/plugins/webpack.jsView file

Lines 112-152javascript

112 CACHE_PRUNE_SIZE: 100 * 1024 * 1024,

113 // 100MB

114 MAX_STRING_BUFFER: 10 * 1024 * 1024,

115 // 10MB

116 BATCH_SIZE

Lines 514-554javascript

514 dynamicValues._nestedRules = dynamicNestedRules;

515 }

516 if (Object.keys(dynamicAtRules).length > 0) {

517 dynamicValues._atRules = dynamicAtRules;

518 }

519 const hasDynamic = Object.keys(dynamicValues).length > 0;

520 return {

521 css,

522 dynamicValues,

523 hasDynamic,

524 staticObject: staticStyleObject

525 };

526 } catch (error) {

527 const context = options.sourceFile || options.scopeSelector || "unknown";

528 throw new Error(`[ChainCSS] Failed to partition style for "${context}": ${error.message}`);

529 }

530}

531

532// src/compiler/prefixer.ts

533var postcss = null;

534function __import__(name) {

535 return new Function("name", "return import(name)")(name);

536}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins/webpack.jsView on unpkg · L534

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/plugins/webpack.jsView on unpkg · L534

537var autoprefixer = null;

538var postcssLoaded = false;

539var autoprefixerLoaded = false;

540var loadingPromises = /* @__PURE__ */ new Map();

541async function loadPostcss() {

542 if (postcss) return postcss;

543 if (loadingPromises.has("postcss")) return loadingPromises.get("postcss");

544 const promise = (async () => {

545 if (!postcssLoaded) {

546 try {

547 const module = await import("postcss");

548 postcss = module.default || module;

549 } catch (err) {

550 if (process.env.DEBUG) {

551 console.warn("postcss not installed, using lightweight prefixing");

552 }

553 }

554 postcssLoaded = true;