registry / chaincss / 2.10.8

chaincss@2.10.8

⚠ Under review

ChainCSS - The first CSS-in-JS library with true auto-detection mixed mode. Zero runtime by default, dynamic when you need it.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 131 file(s), 3.04 MB of source, external domains: chaincss.dev, github.com, www.w3.org

Source & flagged code

7 flagged

dist/cli/index.jsView file

Lines 7280-7320javascript

7280 console.log(chalk3.gray("\n\n\u{1F44B} Stopped watching\n"));

7281 process.exit(0);

7282 });

7283 break;

7284 default:

7285 console.log(chalk3.yellow(`

7286\u274C Unknown action: ${action}`));

7287 console.log(chalk3.gray("\nAvailable actions:"));

7288 console.log(chalk3.cyan(" list ") + chalk3.gray("- List all timeline snapshots"));

7289 console.log(chalk3.cyan(" diff ") + chalk3.gray("- Compare two snapshots"));

7290 console.log(chalk3.cyan(" changes ") + chalk3.gray("- Show individual style changes"));

7291 console.log(chalk3.cyan(" stats ") + chalk3.gray("- Show timeline statistics"));

7292 console.log(chalk3.cyan(" export ") + chalk3.gray("- Export timeline to JSON"));

7293 console.log(chalk3.cyan(" clear ") + chalk3.gray("- Clear timeline data"));

7294 console.log(chalk3.cyan(" watch ") + chalk3.gray("- Watch for timeline updates\n"));

7295 }

7296}

7297

7298// src/cli/commands/dev.ts

7299import path8 from "path";

7300import fs9 from "fs";

7301import { spawn } from "child_process";

7302import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L7300

7303var MIME_TYPES = {

7304 ".html": "text/html; charset=utf-8",

7305 ".css": "text/css; charset=utf-8",

7306 ".js": "application/javascript; charset=utf-8",

7307 ".mjs": "application/javascript; charset=utf-8",

7308 ".json": "application/json; charset=utf-8",

7309 ".png": "image/png",

7310 ".jpg": "image/jpeg",

7311 ".svg": "image/svg+xml",

7312 ".ico": "image/x-icon"

7313};

7314var LIVE_RELOAD_SCRIPT = `<script>

7315(function() {

7316 if (window.__chaincss_reloading) return;

7317 var es = new EventSource('/__chaincss_reload');

7318 var debounce = null, connected = false;

7319 es.onopen = function() { connected = true; };

7320 es.onmessage = function() {

Lines 7390-7430javascript

7390 destroy() {

7391 if (this.timer) {

7392 clearTimeout(this.timer);

7393 this.timer = null;

7394 }

7395 }

7396};

7397async function devCommand(options) {

dist/plugins/webpack.jsView file

Lines 112-152javascript

112 CACHE_PRUNE_SIZE: 100 * 1024 * 1024,

113 // 100MB

114 MAX_STRING_BUFFER: 10 * 1024 * 1024,

115 // 10MB

116 BATCH_SIZE

src/cli/commands/dev.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = chaincss@2.10.4 matchedIdentity = npm:Y2hhaW5jc3M:2.10.4 similarity = 0.883 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli/commands/dev.tsView on unpkg

Source & flagged code

7 flagged · loading source

dist/cli/index.jsView file

7300import fs9 from "fs"; L7301: import { spawn } from "child_process"; L7302: import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L7300

7410logger.info("\u{1F3A8} Starting CSS compiler..."); L7411: const cssWatcher = spawn("npx", ["chaincss", "build", "--watch", ...options.config ? ["--config", options.config] : []], { stdio: ["inherit", "pipe", "pipe"], shell: true, env: { .... L7412: const cssReady = new Promise((resolve) => {

High

Shell

Package source references shell execution.

dist/cli/index.jsView on unpkg · L7410

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L7410

dist/plugins/webpack.jsView file

463function __import__(name) { L464: return new Function("name", "return import(name)")(name); L465: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins/webpack.jsView on unpkg · L463

463function __import__(name) { L464: return new Function("name", "return import(name)")(name); L465: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/plugins/webpack.jsView on unpkg · L463

132threshold: 2, L133: naming: process.env.NODE_ENV === "production" ? "hash" : "readable", L134: cache: true, ... L463: function __import__(name) { L464: return new Function("name", "return import(name)")(name); L465: } ... L2513: if (!macro2) return null; L2514: const merged = JSON.parse(JSON.stringify(macro2)); L2515: if (!overrides) return merged; ... L4926: type: "responsive-issues", L4927: data: { issues, count: issues.length }, L4928: confidence: issues.some((i) => i.severity === "error") ? 1 : 0.7

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/plugins/webpack.jsView on unpkg · L132

src/cli/commands/dev.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli/commands/dev.tsView on unpkg

Findings

1 Critical3 High4 Medium7 Low

CriticalPrevious Version Dangerous Deltasrc/cli/commands/dev.ts

HighChild Processdist/cli/index.js

HighShelldist/cli/index.js

HighRuntime Package Installdist/cli/index.js

MediumDynamic Requiredist/plugins/webpack.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/plugins/webpack.js

LowWeak Cryptodist/plugins/webpack.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/cli/index.jsView file

Lines 7280-7320javascript

7280 console.log(chalk3.gray("\n\n\u{1F44B} Stopped watching\n"));

7281 process.exit(0);

7282 });

7283 break;

7284 default:

7285 console.log(chalk3.yellow(`

7286\u274C Unknown action: ${action}`));

7287 console.log(chalk3.gray("\nAvailable actions:"));

7288 console.log(chalk3.cyan(" list ") + chalk3.gray("- List all timeline snapshots"));

7289 console.log(chalk3.cyan(" diff ") + chalk3.gray("- Compare two snapshots"));

7290 console.log(chalk3.cyan(" changes ") + chalk3.gray("- Show individual style changes"));

7291 console.log(chalk3.cyan(" stats ") + chalk3.gray("- Show timeline statistics"));

7292 console.log(chalk3.cyan(" export ") + chalk3.gray("- Export timeline to JSON"));

7293 console.log(chalk3.cyan(" clear ") + chalk3.gray("- Clear timeline data"));

7294 console.log(chalk3.cyan(" watch ") + chalk3.gray("- Watch for timeline updates\n"));

7295 }

7296}

7297

7298// src/cli/commands/dev.ts

7299import path8 from "path";

7300import fs9 from "fs";

7301import { spawn } from "child_process";

7302import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L7300

7303var MIME_TYPES = {

7304 ".html": "text/html; charset=utf-8",

7305 ".css": "text/css; charset=utf-8",

7306 ".js": "application/javascript; charset=utf-8",

7307 ".mjs": "application/javascript; charset=utf-8",

7308 ".json": "application/json; charset=utf-8",

7309 ".png": "image/png",

7310 ".jpg": "image/jpeg",

7311 ".svg": "image/svg+xml",

7312 ".ico": "image/x-icon"

7313};

7314var LIVE_RELOAD_SCRIPT = `<script>

7315(function() {

7316 if (window.__chaincss_reloading) return;

7317 var es = new EventSource('/__chaincss_reload');

7318 var debounce = null, connected = false;

7319 es.onopen = function() { connected = true; };

7320 es.onmessage = function() {

Lines 7390-7430javascript

7390 destroy() {

7391 if (this.timer) {

7392 clearTimeout(this.timer);

7393 this.timer = null;

7394 }

7395 }

7396};

7397async function devCommand(options) {

dist/plugins/webpack.jsView file

Lines 112-152javascript

112 CACHE_PRUNE_SIZE: 100 * 1024 * 1024,

113 // 100MB

114 MAX_STRING_BUFFER: 10 * 1024 * 1024,

115 // 10MB

116 BATCH_SIZE

src/cli/commands/dev.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli/commands/dev.tsView on unpkg