registry / netpack / 0.2.0

netpack@0.2.0

The blazing fast bundler and optimizer that just works for most web projects.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 19.9 KB of source, external domains: nodejs.org, registry.npmjs.org, yarnpkg.com

Source & flagged code

6 flagged

package.jsonView file

Lines 1-30json

2 "name": "netpack",

3 "version": "0.2.0",

4 "description": "The blazing fast bundler and optimizer that just works for most web projects.",

5 "repository": {

6 "type": "git",

7 "url": "git+https://github.com/FlorianRappl/netpack.git"

8 },

9 "scripts": {

10 "postinstall": "node dist/install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 },

12 "main": "dist/main.js",

13 "types": "main.d.ts",

14 "files": [

15 "dist",

16 "cli",

17 "main.d.ts"

18 ],

19 "engines": {

20 "node": ">=20"

21 },

22 "bin": {

23 "netpack": "cli/netpack.js"

24 },

25 "optionalDependencies": {

26 "@netpack/linux-x64": "0.2.0",

27 "@netpack/osx-arm64": "0.2.0",

28 "@netpack/win-x64": "0.2.0"

29 },

30 "license": "MIT"

•name = netpack; similarTo = webpack

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/main.jsView file

Lines 16-56javascript

16 }

17 return to;

18};

19var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

dist/install.jsView file

Lines 156-196javascript

156 let str = (i, n) => String.fromCharCode(...buffer.subarray(i, i + n)).replace(/\0.*$/, "");

157 let offset = 0;

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•name = netpack; similarTo = webpack

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/main.jsView file

233// main.ts L234: var child_process = __toESM(require("child_process")); L235: var { binPath } = generateBinPath();

High

Child Process

Package source references child process execution.

dist/main.jsView on unpkg · L233

36// platform.ts L37: var fs = __toESM(require("fs")); L38: var os = __toESM(require("os"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/main.jsView on unpkg · L36

dist/install.jsView file

176fs.writeFileSync(path2.join(installDir, "package.json"), "{}"); L177: child_process.execSync( L178: `npm install --loglevel=error --prefer-offline --no-audit --progress=false ${pkg}@${versionFromPackageJSON}`, L179: { cwd: installDir, stdio: "pipe", env }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/install.jsView on unpkg · L176

Findings

3 High6 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/main.js

HighRuntime Package Installdist/install.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumTyposquat Namepackage.json

MediumDynamic Requiredist/main.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 1-30json

2 "name": "netpack",

3 "version": "0.2.0",

4 "description": "The blazing fast bundler and optimizer that just works for most web projects.",

5 "repository": {

6 "type": "git",

7 "url": "git+https://github.com/FlorianRappl/netpack.git"

8 },

9 "scripts": {

10 "postinstall": "node dist/install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 },

12 "main": "dist/main.js",

13 "types": "main.d.ts",

14 "files": [

15 "dist",

16 "cli",

17 "main.d.ts"

18 ],

19 "engines": {

20 "node": ">=20"

21 },

22 "bin": {

23 "netpack": "cli/netpack.js"

24 },

25 "optionalDependencies": {

26 "@netpack/linux-x64": "0.2.0",

27 "@netpack/osx-arm64": "0.2.0",

28 "@netpack/win-x64": "0.2.0"

29 },

30 "license": "MIT"

•name = netpack; similarTo = webpack

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/main.jsView file

Lines 16-56javascript

16 }

17 return to;

18};

19var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

dist/install.jsView file

Lines 156-196javascript

156 let str = (i, n) => String.fromCharCode(...buffer.subarray(i, i + n)).replace(/\0.*$/, "");

157 let offset = 0;

Lines 213-253javascript

213 const binTargetPath = path.join(

214 root,

215 "node_modules",

216 ".cache",

217 "netpack",

218 `pnpapi-${pkg.replace("/", "-")}-${NETPACK_VERSION}-${path.basename(

219 subpath

220 )}`

221 );

222 if (!fs.existsSync(binTargetPath)) {

223 fs.mkdirSync(path.dirname(binTargetPath), { recursive: true });

224 fs.copyFileSync(binPath2, binTargetPath);

225 fs.chmodSync(binTargetPath, 493);

226 }

227 return { binPath: binTargetPath, isWASM };

228 }

229 }

230 return { binPath: binPath2, isWASM };

231}

232

233// main.ts

234var child_process = __toESM(require("child_process"));

235var { binPath } = generateBinPath();

High

Child Process

Package source references child process execution.

dist/main.jsView on unpkg · L233

236function argToString(name, value) {

237 if (value === true) {

238 return `--${name}`;

239 } else if (value === false) {

240 return `--no-${name}`;

241 } else if (typeof value === "string") {

242 return `--${name}=${value}`;

243 } else {

244 return "";

245 }

246}

247function run(command, args) {

248 if (typeof command === "string") {

249 const argv = Object.entries(args).map(([name, value]) => argToString(name, value)).join(" ");

250 return run([command, ...argv]);

251 }

252 return child_process.spawn(binPath, command, {

253 windowsHide: true,