registry / chaincss / 2.12.0

chaincss@2.12.0

ChainCSS - The first CSS-in-JS library with true auto-detection mixed mode. Zero runtime by default, dynamic when you need it.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 3.20 MB of source, external domains: github.com, raw.githubusercontent.com, www.w3.org

Source & flagged code

6 flagged

dist/cli/index.jsView file

Lines 8457-8497javascript

8457 console.log(chalk4.gray("\n\n\u{1F44B} Stopped watching\n"));

8458 process.exit(0);

8459 });

8460 break;

8461 default:

8462 console.log(chalk4.yellow(`

8463\u274C Unknown action: ${action}`));

8464 console.log(chalk4.gray("\nAvailable actions:"));

8465 console.log(chalk4.cyan(" list ") + chalk4.gray("- List all timeline snapshots"));

8466 console.log(chalk4.cyan(" diff ") + chalk4.gray("- Compare two snapshots"));

8467 console.log(chalk4.cyan(" changes ") + chalk4.gray("- Show individual style changes"));

8468 console.log(chalk4.cyan(" stats ") + chalk4.gray("- Show timeline statistics"));

8469 console.log(chalk4.cyan(" export ") + chalk4.gray("- Export timeline to JSON"));

8470 console.log(chalk4.cyan(" clear ") + chalk4.gray("- Clear timeline data"));

8471 console.log(chalk4.cyan(" watch ") + chalk4.gray("- Watch for timeline updates\n"));

8472 }

8473}

8474

8475// src/cli/commands/dev.ts

8476import path10 from "path";

8477import fs11 from "fs";

8478import { spawn } from "child_process";

8479import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L8477

8480var MIME_TYPES = {

8481 ".html": "text/html; charset=utf-8",

8482 ".css": "text/css; charset=utf-8",

8483 ".js": "application/javascript; charset=utf-8",

8484 ".mjs": "application/javascript; charset=utf-8",

8485 ".json": "application/json; charset=utf-8",

8486 ".png": "image/png",

8487 ".jpg": "image/jpeg",

8488 ".svg": "image/svg+xml",

8489 ".ico": "image/x-icon"

8490};

8491var LIVE_RELOAD_SCRIPT = `<script>

8492(function() {

8493 if (window.__chaincss_reloading) return;

8494 var es = new EventSource('/__chaincss_reload');

8495 var debounce = null, connected = false;

8496 es.onopen = function() { connected = true; };

8497 es.onmessage = function() {

Lines 8567-8607javascript

8567 destroy() {

8568 if (this.timer) {

8569 clearTimeout(this.timer);

8570 this.timer = null;

8571 }

8572 }

8573};

8574async function devCommand(options) {

dist/plugins/webpack.jsView file

Lines 859-899javascript

859 if (Array.isArray(v)) {

860 colors = v;

861 angle = 90;

862 } else {

863 colors = v.colors;

864 angle = v.angle || 90;

865 }

Source & flagged code

6 flagged · loading source

dist/cli/index.jsView file

8477import fs11 from "fs"; L8478: import { spawn } from "child_process"; L8479: import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L8477

8587logger.info("\u{1F3A8} Starting CSS compiler..."); L8588: const cssWatcher = spawn("npx", ["chaincss", "build", "--watch", ...options.config ? ["--config", options.config] : []], { stdio: ["inherit", "pipe", "pipe"], shell: true, env: { .... L8589: const cssReady = new Promise((resolve) => {

High

Shell

Package source references shell execution.

dist/cli/index.jsView on unpkg · L8587

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L8587

dist/plugins/webpack.jsView file

3050function __import__(name) { L3051: return new Function("name", "return import(name)")(name); L3052: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins/webpack.jsView on unpkg · L3050

3050function __import__(name) { L3051: return new Function("name", "return import(name)")(name); L3052: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/plugins/webpack.jsView on unpkg · L3050

879const op = typeof v === "number" ? v : 0.05; L880: c.backgroundImage = `url("data:image/svg+xml,%3Csvg viewBox='0 0 200 200' xmlns='http://www.w3.org/2000/svg'%3E%3Cfilter id='n'%3E%3CfeTurbulence type='fractalNoise' baseFrequency=... L881: }, ... L1183: function recordHistory(decl, pass, action, previous, reason) { L1184: if (process.env.NODE_ENV === "production") return; L1185: decl.history.push({ ... L1481: let minInRow = cur[0]; L1482: const ca = a.charCodeAt(i - 1); L1483: for (let j = 1; j <= bl; j++) { ... L3050: function __import__(name) { L3051: return new Function("name", "return import(name)")(name); L3052: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/plugins/webpack.jsView on unpkg · L879

Findings

3 High4 Medium7 Low

HighChild Processdist/cli/index.js

HighShelldist/cli/index.js

HighRuntime Package Installdist/cli/index.js

MediumDynamic Requiredist/plugins/webpack.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/plugins/webpack.js

LowWeak Cryptodist/plugins/webpack.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/cli/index.jsView file

Lines 8457-8497javascript

8457 console.log(chalk4.gray("\n\n\u{1F44B} Stopped watching\n"));

8458 process.exit(0);

8459 });

8460 break;

8461 default:

8462 console.log(chalk4.yellow(`

8463\u274C Unknown action: ${action}`));

8464 console.log(chalk4.gray("\nAvailable actions:"));

8465 console.log(chalk4.cyan(" list ") + chalk4.gray("- List all timeline snapshots"));

8466 console.log(chalk4.cyan(" diff ") + chalk4.gray("- Compare two snapshots"));

8467 console.log(chalk4.cyan(" changes ") + chalk4.gray("- Show individual style changes"));

8468 console.log(chalk4.cyan(" stats ") + chalk4.gray("- Show timeline statistics"));

8469 console.log(chalk4.cyan(" export ") + chalk4.gray("- Export timeline to JSON"));

8470 console.log(chalk4.cyan(" clear ") + chalk4.gray("- Clear timeline data"));

8471 console.log(chalk4.cyan(" watch ") + chalk4.gray("- Watch for timeline updates\n"));

8472 }

8473}

8474

8475// src/cli/commands/dev.ts

8476import path10 from "path";

8477import fs11 from "fs";

8478import { spawn } from "child_process";

8479import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L8477

8480var MIME_TYPES = {

8481 ".html": "text/html; charset=utf-8",

8482 ".css": "text/css; charset=utf-8",

8483 ".js": "application/javascript; charset=utf-8",

8484 ".mjs": "application/javascript; charset=utf-8",

8485 ".json": "application/json; charset=utf-8",

8486 ".png": "image/png",

8487 ".jpg": "image/jpeg",

8488 ".svg": "image/svg+xml",

8489 ".ico": "image/x-icon"

8490};

8491var LIVE_RELOAD_SCRIPT = `<script>

8492(function() {

8493 if (window.__chaincss_reloading) return;

8494 var es = new EventSource('/__chaincss_reload');

8495 var debounce = null, connected = false;

8496 es.onopen = function() { connected = true; };

8497 es.onmessage = function() {

Lines 8567-8607javascript

8567 destroy() {

8568 if (this.timer) {

8569 clearTimeout(this.timer);

8570 this.timer = null;

8571 }

8572 }

8573};

8574async function devCommand(options) {

dist/plugins/webpack.jsView file

Lines 859-899javascript

859 if (Array.isArray(v)) {

860 colors = v;

861 angle = 90;

862 } else {

863 colors = v.colors;

864 angle = v.angle || 90;

865 }

Lines 3030-3070javascript

3030 fs.writeFileSync(filePath, content, "utf8");

3031}

3032function getBaseName(filePath) {

3033 return path.basename(filePath, path.extname(filePath));

3034}

3035function formatCSS(css, minify = false) {

3036 if (!css || css.trim().length === 0) return "";

3037 if (!minify) {

3038 let formatted = css.replace(/\s*{\s*/g, " {\n ").replace(/;\s*/g, ";\n ").replace(/\s*}\s*/g, "\n}\n").replace

3039 formatted = formatted.replace(/@media[^{]+\{/g, (match) => {

3040 return match.replace(/\{/, " {\n");

3041 });

3042 return formatted.trim();

3043 }

3044 return css.replace(/\/\*.*?\*\//g, "").replace(/\s+/g, " ").replace(/\s*{\s*/g, "{").replace(/\s*}\s*/g, "}"

3045}

3046var currentLogLevel = process.env.DEBUG ? "debug" : "info";

3047

3048// src/compiler/prefixer.ts

3049var postcss = null;

3050function __import__(name) {

3051 return new Function("name", "return import(name)")(name);

3052}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins/webpack.jsView on unpkg · L3050

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/plugins/webpack.jsView on unpkg · L3050

3053var autoprefixer = null;

3054var postcssLoaded = false;

3055var autoprefixerLoaded = false;

3056var loadingPromises = /* @__PURE__ */ new Map();

3057async function loadPostcss() {

3058 if (postcss) return postcss;

3059 if (loadingPromises.has("postcss")) return loadingPromises.get("postcss");

3060 const promise = (async () => {

3061 if (!postcssLoaded) {

3062 try {

3063 const module = await import("postcss");

3064 postcss = module.default || module;

3065 } catch (err) {

3066 if (process.env.DEBUG) {

3067 console.warn("postcss not installed, using lightweight prefixing");

3068 }

3069 }

3070 postcssLoaded = true;