registry / houdini-react / 2.1.0

houdini-react@2.1.0

The React plugin for houdini

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 40 file(s), 185 KB of source, external domains: registry.npmjs.org

Source & flagged code

4 flagged

package.jsonView file

Lines 75-100json

75 "server": [

76 "./server/index.d.ts"

77 ],

78 "vite": [

79 "./vite/index.d.ts"

80 ]

81 }

82 },

83 "optionalDependencies": {

84 "houdini-react-darwin-x64": "2.1.0",

85 "houdini-react-darwin-arm64": "2.1.0",

86 "houdini-react-linux-x64": "2.1.0",

87 "houdini-react-linux-arm64": "2.1.0",

88 "houdini-react-win32-x64": "2.1.0",

89 "houdini-react-win32-arm64": "2.1.0",

90 "houdini-react-wasm": "2.1.0"

91 },

92 "scripts": {

93 "compile": "scripts build-go",

94 "typedefs": "scripts typedefs --plugin --go-package",

95 "postinstall": "node postInstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L95

96 },

97 "bin": {

98 "houdini-react": "bin/houdini-react"

99 }

100}

postInstall.jsView file

Lines 1-24javascript

1const fs = require('fs')

2const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

postInstall.jsView on unpkg · L1

3const zlib = require('zlib')

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node postInstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

postInstall.jsView file

4const https = require('https') L5: const child_process = require('child_process') L6:

High

Child Process

Package source references child process execution.

postInstall.jsView on unpkg · L4

83function installUsingNPM() { L84: // Erase "npm[redacted]" so that "npm install --global" works. L85: // Otherwise this nested "npm install" will also be global, and the install ... L96: // Run npm install in the temporary directory L97: child_process.execSync( L98: `npm install --loglevel=error --prefer-offline --no-audit --progress=false ${platformSpecificPackageName}@${BINARY_DISTRIBUTION_VERSION}`,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

postInstall.jsView on unpkg · L83

1const fs = require('fs') L2: const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

postInstall.jsView on unpkg · L1

Findings

3 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild ProcesspostInstall.js

HighRuntime Package InstallpostInstall.js

MediumDynamic RequirepostInstall.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 75-100json

75 "server": [

76 "./server/index.d.ts"

77 ],

78 "vite": [

79 "./vite/index.d.ts"

80 ]

81 }

82 },

83 "optionalDependencies": {

84 "houdini-react-darwin-x64": "2.1.0",

85 "houdini-react-darwin-arm64": "2.1.0",

86 "houdini-react-linux-x64": "2.1.0",

87 "houdini-react-linux-arm64": "2.1.0",

88 "houdini-react-win32-x64": "2.1.0",

89 "houdini-react-win32-arm64": "2.1.0",

90 "houdini-react-wasm": "2.1.0"

91 },

92 "scripts": {

93 "compile": "scripts build-go",

94 "typedefs": "scripts typedefs --plugin --go-package",

95 "postinstall": "node postInstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L95

96 },

97 "bin": {

98 "houdini-react": "bin/houdini-react"

99 }

100}

postInstall.jsView file

Lines 1-24javascript

1const fs = require('fs')

2const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

postInstall.jsView on unpkg · L1

3const zlib = require('zlib')

Lines 63-103javascript

63 // Header blocks contain file names of the archive in the first 100 bytes, terminated by a null byte.

64 // The size of a file is contained in bytes 124-135 of a header block and in octal format.

65 // The following blocks will be data blocks containing the file.

66 let offset = 0

67 while (offset < tarballBuffer.length) {

68 const header = tarballBuffer.subarray(offset, offset + 512)

69 offset += 512

71 const fileName = header.toString('utf-8', 0, 100).replace(/\0.*/g, '')

72 const fileSize = parseInt(header.toString('utf-8', 124, 136).replace(/\0.*/g, ''), 8)

74 if (fileName === filepath) {

75 return tarballBuffer.subarray(offset, offset + fileSize)

76 }

78 // Clamp offset to the uppoer multiple of 512

79 offset = (offset + fileSize + 511) & ~511

80 }

81}

83function installUsingNPM() {

84 // Erase "npm_config_global" so that "npm install --global" works.

85 // Otherwise this nested "npm install" will also be global, and the install

86 // will deadlock waiting for the global installation lock.

87 const env = { ...process.env, npm_config_global: undefined };

89 // Create a temporary directory with an empty package.json

90 const tempDir = path.join(__dirname, 'npm-install-temp');

92 try {

93 fs.mkdirSync(tempDir);

94 fs.writeFileSync(path.join(tempDir, 'package.json'), '{}');

96 // Run npm install in the temporary directory

97 child_process.execSync(

98 `npm install --loglevel=error --prefer-offline --no-audit --progress=false ${platformSpecificPackageName}@${BINARY_DISTRIBUTION_VERSION}`,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

postInstall.jsView on unpkg · L83

99 { cwd: tempDir, stdio: 'pipe', env }

100 );

101

102 // Move the downloaded binary to the fallback location

103 const installedBinaryPath = path.join(tempDir, 'node_modules', platformSpecificPackageName, 'bin', binaryName);