registry / netpack / 0.2.1

netpack@0.2.1

⚠ Under review

The blazing fast bundler and optimizer that just works for most web projects.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 20.1 KB of source, external domains: nodejs.org, registry.npmjs.org, yarnpkg.com

Source & flagged code

7 flagged

package.jsonView file

Lines 1-30json

2 "name": "netpack",

3 "version": "0.2.1",

4 "description": "The blazing fast bundler and optimizer that just works for most web projects.",

5 "repository": {

6 "type": "git",

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•name = netpack; similarTo = webpack

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/main.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = netpack@0.2.0 matchedIdentity = npm:bmV0cGFjaw:0.2.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/main.jsView on unpkg

233// main.ts L234: var child_process = __toESM(require("child_process")); L235: var { binPath } = generateBinPath();

High

Child Process

Package source references child process execution.

dist/main.jsView on unpkg · L233

36// platform.ts L37: var fs = __toESM(require("fs")); L38: var os = __toESM(require("os"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/main.jsView on unpkg · L36

dist/install.jsView file

176fs.writeFileSync(path2.join(installDir, "package.json"), "{}"); L177: child_process.execSync( L178: `npm install --loglevel=error --prefer-offline --no-audit --progress=false ${pkg}@${versionFromPackageJSON}`, L179: { cwd: installDir, stdio: "pipe", env }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/install.jsView on unpkg · L176

Findings

1 Critical3 High6 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/main.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/main.js

HighRuntime Package Installdist/install.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumTyposquat Namepackage.json

MediumDynamic Requiredist/main.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/main.jsView file

Lines 16-56javascript

16 }

17 return to;

18};

19var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

20 // If the importer is in node compatibility mode or this is not an ESM

21 // file that has been converted to a CommonJS file using a Babel-

22 // compatible transform (i.e. "__esModule" has not been set), then set

23 // "default" to the CommonJS "module.exports" for node compatibility.

24 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

25 mod

26));

27var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

29// main.ts

30var main_exports = {};

31__export(main_exports, {

32 run: () => run

33});

34module.exports = __toCommonJS(main_exports);

36// platform.ts

37var fs = __toESM(require("fs"));

38var os = __toESM(require("os"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/main.jsView on unpkg · L36

39var path = __toESM(require("path"));

40var NETPACK_BINARY_PATH = process.env.NETPACK_BINARY_PATH || NETPACK_BINARY_PATH;

41var isValidBinaryPath = (x) => !!x && x !== "/usr/bin/netpack";

42var packageDarwin_arm64 = "@netpack/osx-arm64";

43var packageDarwin_x64 = "@netpack/osx-x64";

44var knownWindowsPackages = {

45 // "win32 arm64 LE": "@netpack/win-arm64",

46 // "win32 ia32 LE": "@netpack/win-x86",

47 "win32 x64 LE": "@netpack/win-x64"

48};

49var knownUnixlikePackages = {

50 // "aix ppc64 BE": "@netpack/aix-ppc64",

51 // "android arm64 LE": "@netpack/android-arm64",

52 "darwin arm64 LE": "@netpack/osx-arm64",

53 // "darwin x64 LE": "@netpack/osx-x64",

54 // "freebsd arm64 LE": "@netpack/freebsd-arm64",

55 // "freebsd x64 LE": "@netpack/freebsd-x64",

56 // "linux arm LE": "@netpack/linux-arm",

Lines 213-253javascript

213 const binTargetPath = path.join(

214 root,

215 "node_modules",

216 ".cache",

217 "netpack",

218 `pnpapi-${pkg.replace("/", "-")}-${NETPACK_VERSION}-${path.basename

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/main.jsView on unpkg

dist/install.jsView file

Lines 156-196javascript

156 let str = (i, n) => String.fromCharCode(...buffer.subarray(i, i + n)).replace(/\0.*$/, "");

157 let offset = 0;

158 subpath = `package/${subpath}`;

159 while (offset < buffer.length) {

160 let name = str(offset, 100);

161 let size = parseInt(str(offset + 124, 12), 8);

162 offset += 512;

163 if (!isNaN(size)) {

164 if (name === subpath) return buffer.subarray(offset, offset + size);

165 offset += size + 511 & ~511;

166 }

167 }

168 throw new Error(`Could not find ${JSON.stringify(subpath)} in archive`);

169}

170function installUsingNPM(pkg, subpath, binPath) {

171 const env = { ...process.env, npm_config_global: void 0 };

172 const netpackLibDir = path2.dirname(require.resolve("netpack"));

173 const installDir = path2.join(netpackLibDir, "npm-install");

174 fs.mkdirSync(installDir);

175 try {

176 fs.writeFileSync(path2.join(installDir, "package.json"), "{}");

177 child_process.execSync(

178 `npm install --loglevel=error --prefer-offline --no-audit --progress=false ${pkg}@${versionFromPackageJSON}`,

179 { cwd: installDir, stdio: "pipe", env }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/install.jsView on unpkg · L176

180 );

181 const installedBinPath = path2.join(

182 installDir,

183 "node_modules",

184 pkg,

185 subpath

186 );

187 fs.renameSync(installedBinPath, binPath);

188 } finally {

189 try {

190 removeRecursive(installDir);

191 } catch {

192 }

193 }

194}

195function removeRecursive(dir) {

196 for (const entry of fs.readdirSync(dir)) {