registry / chaincss / 2.11.1

chaincss@2.11.1

ChainCSS - The first CSS-in-JS library with true auto-detection mixed mode. Zero runtime by default, dynamic when you need it.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 2.27 MB of source, external domains: github.com, www.w3.org

Source & flagged code

6 flagged

dist/cli/index.jsView file

Lines 7664-7704javascript

7664 console.log(chalk3.gray("\n\n\u{1F44B} Stopped watching\n"));

7665 process.exit(0);

7666 });

7667 break;

7668 default:

7669 console.

Source & flagged code

6 flagged · loading source

dist/cli/index.jsView file

7684import fs10 from "fs"; L7685: import { spawn } from "child_process"; L7686: import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L7684

7794logger.info("\u{1F3A8} Starting CSS compiler..."); L7795: const cssWatcher = spawn("npx", ["chaincss", "build", "--watch", ...options.config ? ["--config", options.config] : []], { stdio: ["inherit", "pipe", "pipe"], shell: true, env: { .... L7796: const cssReady = new Promise((resolve) => {

High

Shell

Package source references shell execution.

dist/cli/index.jsView on unpkg · L7794

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L7794

dist/plugins/webpack.jsView file

534function __import__(name) { L535: return new Function("name", "return import(name)")(name); L536: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins/webpack.jsView on unpkg · L534

534function __import__(name) { L535: return new Function("name", "return import(name)")(name); L536: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/plugins/webpack.jsView on unpkg · L534

132threshold: 2, L133: naming: process.env.NODE_ENV === "production" ? "hash" : "readable", L134: cache: true, ... L534: function __import__(name) { L535: return new Function("name", "return import(name)")(name); L536: } ... L2591: if (!macro2) return null; L2592: const merged = JSON.parse(JSON.stringify(macro2)); L2593: if (!overrides) return merged; ... L5127: type: "responsive-issues", L5128: data: { issues, count: issues.length }, L5129: confidence: issues.some((i) => i.severity === "error") ? 1 : 0.7

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/plugins/webpack.jsView on unpkg · L132

Findings

3 High4 Medium7 Low

HighChild Processdist/cli/index.js

HighShelldist/cli/index.js

HighRuntime Package Installdist/cli/index.js

MediumDynamic Requiredist/plugins/webpack.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/plugins/webpack.js

LowWeak Cryptodist/plugins/webpack.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 7774-7814javascript

7774 destroy() {

7775 if (this.timer) {

7776 clearTimeout(this.timer);

7777 this.timer = null;

7778 }

7779 }

7780};

7781async function devCommand(options) {

7782 const logger = createLogger(true);

7783 logger.header("ChainCSS Dev Server");

7784 const config = await loadConfig(options.config);

7785 const PORT = options.port || config.dev?.port || 3e3;

7786 const publicDir = config.dev?.publicDir || ".";

7787 const distDir = typeof config.output === "object" ? path9.dirname(config.output.cssFile || "dist/styles.css") : typeof config.output === "string" ? config.output : "dist";

7788 const entryFile = resolveEntry();

7789 const jsBundlePath = entryFile ? path9.join(distDir, "bundle.js") : null;

7790 const deps = getDeps();

7791 const locations = [path9.join(process.cwd(), publicDir, "index.html"), path9.join(process.cwd(), "index.html"), path9.join(process.cwd(), "public", "index.html")];

7792 const indexHtml = locations.find((l) => fs10.existsSync(l)) || null;

7793 if (indexHtml) logger.info(`\u{1F4C4} Serving: ${path9.relative(process.cwd(), indexHtml)}`);

7794 logger.info("\u{1F3A8} Starting CSS compiler...");

7795 const cssWatcher = spawn("npx", ["chaincss", "build", "--watch", ...options.config ? ["--config", options.config] : []], { stdio: ["inherit", "pipe", "pipe"], shell: true, env: { ...process.env, NODE_ENV: "development" } });

7796 const cssReady = new Promise((resolve) => {

High

Shell

Package source references shell execution.

dist/cli/index.jsView on unpkg · L7794

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L7794

7797 if (!entryFile) return resolve();

7798 const artifact = path9.join(process.cwd(), entryFile.replace(/\.(ts|js)x?$/, ".class.js"));

7799 const start = Date.now();

7800 function poll() {

7801 try {

7802 if (fs10.existsSync(artifact) && fs10.readFileSync(artifact, "utf8").trim().length > 0) {

7803 logger.info(`\u2705 CSS ready`);

7804 return resolve();

7805 }

7806 } catch {

7807 }

7808 if (Date.now() - start > 1e4) return resolve();

7809 setTimeout(poll, 30);

7810 }

7811 poll();

7812 });

7813 let esbuildAvailable = false;

7814 try {

dist/plugins/webpack.jsView file

Lines 112-152javascript

112 CACHE_PRUNE_SIZE: 100 * 1024 * 1024,

113 // 100MB

114 MAX_STRING_BUFFER: 10 * 1024 * 1024,

115 // 10MB

116 BATCH_SIZE: 100,

117 CLEANUP_INTERVAL_MS: 3e5,

118 // 5 minutes

119 CACHE_CHECK_INTERVAL_MS: 6e4,

120 // 1 minute

121 MEMORY_CHECK_INTERVAL_MS: 3e4

122 // 30 seconds

123};

124var DEFAULT_CONFIG = {

125 inputs: ["src/**/*.chain.{js,ts}", "src/**/*.tsx"],

126 tokens: {

127 enabled: true,

128 prefix: "chain"

129 },

130 atomic: {

131 enabled: true,

132 threshold: 2,

133 naming: process.env.NODE_ENV === "production" ? "hash" : "readable",

134 cache: true,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/plugins/webpack.jsView on unpkg · L132

135 cachePath: DEFAULT_CACHE_PATH,

136 minify: true,

137 mode: "hybrid",

138 outputStrategy: "component-first",

139 alwaysAtomic: ALWAYS_ATOMIC_PROPERTIES,

140 neverAtomic: NEVER_ATOMIC_PROPERTIES,

141 verbose: false

142 },

143 prefixer: {

144 enabled: true,

145 mode: "auto",

146 browsers: DEFAULT_BROWSERS,

147 sourceMap: true,

148 sourceMapInline: false

149 },

150 output: {

151 cssFile: DEFAULT_CSS_FILENAME,

152 classMapFile: DEFAULT_CLASS_MAP_FILENAME,

Lines 514-554javascript

514 dynamicValues._nestedRules = dynamicNestedRules;

515 }

516 if (Object.keys(dynamicAtRules).length > 0) {

517 dynamicValues._atRules = dynamicAtRules;

518 }

519 const hasDynamic = Object.keys(dynamicValues).length > 0;