registry / extension-develop / 4.0.5

extension-develop@4.0.5

⚠ Under review

Develop, build, preview, and package Extension.js projects.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 54 file(s), 4.84 MB of source, external domains: codeload.github.com, crbug.com, developer.chrome.com, example.invalid, extension.js.org, github.com, radix-ui.com, react.dev, rspack.rs, www.typescriptlang.org, www.w3.org

Source & flagged code

7 flagged

dist/839.mjsView file

Lines 1-22javascript

1import { createRequire as __extjsCreateRequire } from "node:module"; const require = __extjsCreateRequire(import.meta.url);

2import { createRequire } from "module";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/839.mjsView on unpkg · L1

3import { execFileSync, spawn, spawnSync as external_child_process_spawnSync } from "child_process";

4import { buildExecEnv, detectPackageManagerFromLockfile } from "prefers-yarn";

High

Child Process

Package source references child process execution.

dist/839.mjsView on unpkg · L2

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/839.mjsView on unpkg · L2

5import pintor from "pintor";

6import { EventEmitter } from "node:events";

7import { package_namespaceObject, buildSuccessWithWarnings, buildWarningsDetails, loadCommandConfig, needsInstall, getDirs, buildCommandFailed, sanitize, writingTypeDefinitions, buildWebpack, assertNoManagedDependencyConflicts, debugDirs, debugBrowser, normalizeBrowser, debugOutputPath, loadCustomConfig, buildSuccess, writingTypeDefinitionsError, getDistPath, loadBrowserConfig, getProjectStructure, authorInstallNotice, resolveCompanionExtensionsConfig, getSpecialFoldersDataForProjectRoot } from "./101.mjs";

8import { stripBom, parseJsonSafe } from "./23.mjs";

9import { getCanonicalContentScriptEntryName } from "./291.mjs";

10import { fileURLToPath as __rspack_fileURLToPath } from "node:url";

11import { dirname as __rspack_dirname } from "node:path";

12var __rspack_import_meta_dirname__ = __rspack_dirname(__rspack_fileURLToPath(import.meta.url));

13import * as __rspack_external_fs from "fs";

14import * as __rspack_external_path from "path";

15import * as __rspack_external_fs_promises_400951f8 from "fs/promises";

16function getBuildSummary(browser, info) {

17 const assets = info?.assets || [];

18 return {

19 browser,

20 total_assets: assets.length,

21 total_bytes: assets.reduce((n, a)=>n + (a.size || 0), 0),

22 largest_asset_bytes: assets.reduce((m, a)=>Math.max(m, a.size || 0), 0),

Lines 336-376javascript

336 command: pm.name,

337 args

338 };

339}

340function buildSpawnInvocation(command, args) {

341 return {

342 command,

343 args

344 };

345}

346function execInstallCommand

•matchType = previous_version_dangerous_delta matchedPackage = extension-develop@4.0.1 matchedIdentity = npm:ZXh0ZW5zaW9uLWRldmVsb3A:4.0.1 similarity = 0.574 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/839.mjsView on unpkg

dist/0~rspack-config.mjsView file

Lines 54-94javascript

54 for (const [key, value] of Object.entries(node)){

55 const indexOfColon = key.indexOf(':');

56 if (-1 === indexOfColon) {

57 result[key] =

Source & flagged code

7 flagged · loading source

dist/839.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/839.mjsView on unpkg

2import { createRequire } from "module"; L3: import { execFileSync, spawn, spawnSync as external_child_process_spawnSync } from "child_process"; L4: import { buildExecEnv, [redacted] } from "prefers-yarn";

High

Child Process

Package source references child process execution.

dist/839.mjsView on unpkg · L2

356...useShell ? { L357: shell: true L358: } : {}

High

Shell

Package source references shell execution.

dist/839.mjsView on unpkg · L356

2Cross-file remote execution chain: dist/839.mjs spawns dist/0~rspack-config.mjs; helper contains network access plus dynamic code execution. L2: import { createRequire } from "module"; L3: import { execFileSync, spawn, spawnSync as external_child_process_spawnSync } from "child_process"; L4: import { buildExecEnv, [redacted] } from "prefers-yarn"; ... L27: const cjsRequire = createRequire(import.meta.url); L28: if (!process.env.EXTENSION_JS_OPTIONAL_DEPS_VERSION) process.env.EXTENSION_JS_OPTIONAL_DEPS_VERSION = package_namespaceObject.rE; L29: function resolveDevelopRootFromDir(dir) { L30: try { L31: const packageJsonPath = __rspack_external_path.join(dir, 'package.json'); L32: if (!__rspack_external_fs.existsSync(packageJsonPath)) return; ... L53: if (__rspack_external_fs.existsSync(packageJsonPath)) try { L54: const pkg = JSON.parse(__rspack_external_fs.readFileSync(packageJsonPath, 'utf-8')); L55: if ('extension-develop' === pkg.name) return packageRoot;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/839.mjsView on unpkg · L2

1import { createRequire as __extjsCreateRequire } from "node:module"; const require = __extjsCreateRequire(import.meta.url); L2: import { createRequire } from "module";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/839.mjsView on unpkg · L1

dist/0~rspack-config.mjsView file

1715const req = createRequire(configPath); L1716: const fn = new Function('require', 'module', 'exports', '__filename', '__dirname', source); L1717: fn(req, moduleObj, exportsObj, configPath, __rspack_external_path.dirname(configPath));

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/0~rspack-config.mjsView on unpkg · L1715

74try { L75: return JSON.parse(__rspack_external_fs.readFileSync(filePath, 'utf-8')); L76: } catch { ... L82: while(true){ L83: const packageJsonPath = __rspack_external_path.join(currentDir, 'package.json'); L84: const packageJson = tryReadJson(packageJsonPath); ... L228: trackChange(projectPath, folder, change, filePath) { L229: if ('true' === process.env.EXTENSION_AUTHOR_MODE) console.log(specialFolderChangeDetected('add' === change ? 'add' : 'remove', folder, __rspack_external_path.relative(projectPath, ... L230: this.pendingChanges.push({ ... L236: collectChanges(compiler) { L237: const projectPath = compiler.options.context || process.cwd(); L238: this.snapshotFolderFiles(projectPath);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/0~rspack-config.mjsView on unpkg · L74

Findings

1 Critical3 High4 Medium7 Low

CriticalPrevious Version Dangerous Deltadist/839.mjs

HighChild Processdist/839.mjs

HighShelldist/839.mjs

HighCross File Remote Execution Contextdist/839.mjs

MediumDynamic Requiredist/839.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/0~rspack-config.mjs

LowWeak Cryptodist/0~rspack-config.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/839.mjsView file

Lines 1-22javascript

1import { createRequire as __extjsCreateRequire } from "node:module"; const require = __extjsCreateRequire(import.meta.url);

2import { createRequire } from "module";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/839.mjsView on unpkg · L1

3import { execFileSync, spawn, spawnSync as external_child_process_spawnSync } from "child_process";

4import { buildExecEnv, detectPackageManagerFromLockfile } from "prefers-yarn";

High

Child Process

Package source references child process execution.

dist/839.mjsView on unpkg · L2

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/839.mjsView on unpkg · L2

5import pintor from "pintor";

6import { EventEmitter } from "node:events";

8import { stripBom, parseJsonSafe } from "./23.mjs";

9import { getCanonicalContentScriptEntryName } from "./291.mjs";

10import { fileURLToPath as __rspack_fileURLToPath } from "node:url";

11import { dirname as __rspack_dirname } from "node:path";

12var __rspack_import_meta_dirname__ = __rspack_dirname(__rspack_fileURLToPath(import.meta.url));

13import * as __rspack_external_fs from "fs";

14import * as __rspack_external_path from "path";

15import * as __rspack_external_fs_promises_400951f8 from "fs/promises";

16function getBuildSummary(browser, info) {

17 const assets = info?.assets || [];

18 return {

19 browser,

20 total_assets: assets.length,

21 total_bytes: assets.reduce((n, a)=>n + (a.size || 0), 0),

22 largest_asset_bytes: assets.reduce((m, a)=>Math.max(m, a.size || 0), 0),

Lines 336-376javascript

336 command: pm.name,

337 args

338 };

339}

340function buildSpawnInvocation(command, args) {

341 return {

342 command,

343 args

344 };

345}

346function execInstallCommand

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/839.mjsView on unpkg

dist/0~rspack-config.mjsView file

Lines 54-94javascript

54 for (const [key, value] of Object.entries(node)){

55 const indexOfColon = key.indexOf(':');

56 if (-1 === indexOfColon) {

57 result[key] =