registry / next-bun-compile / 1.0.0

next-bun-compile@1.0.0

Compile your Next.js app into a Bun single-file executable

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 66.5 KB of source, external domains: bun.sh

Source & flagged code

3 flagged

package.jsonView file

Lines 1-41json

2 "name": "next-bun-compile",

3 "version": "1.0.0",

4 "description": "Compile your Next.js app into a Bun single-file executable",

5 "type": "module",

6 "main": "./dist/index.js",

7 "types": "./dist/index.d.ts",

8 "exports": {

9 ".": {

10 "types": "./dist/index.d.ts",

11 "default": "./dist/index.js"

12 }

13 },

14 "files": [

15 "dist"

16 ],

17 "scripts": {

18 "build": "rm -rf dist && bun build src/index.ts --outdir dist --target node && mkdir -p dist/runtime && cp src/runtime/serve.js dist/runtime/serve.js",

19 "typecheck": "tsc --noEmit",

20 "test:regression": "bash test/regression/run.sh",

21 "postinstall": "bun -e \"try{require('fs').symlinkSync('..','node_modules/next-bun-compile')}catch{}\""

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 },

23 "peerDependencies": {

24 "next": ">=16.2.0"

25 },

26 "devDependencies": {

27 "next": "16.1.6",

28 "@types/bun": "^1",

29 "@types/node": "^20",

30 "typescript": "^5"

31 },

32 "keywords": [

33 "nextjs",

34 "bun",

35 "compile",

36 "standalone",

37 "executable"

38 ],

39 "license": "MIT",

40 "homepage": "https://github.com/ramonmalcolm10/next-bun-compile#readme",

41 "bugs": {

dist/runtime/serve.jsView file

Lines 1-37javascript

1/**

2 * Single-server Bun.serve runtime for compiled Next.js binaries.

3 *

4 * Request flow, fastest tier first:

5 * Tier 1 — immutable /_next/static/* and public/* files, served as

6 * in-memory Responses via Bun's static route dispatch.

7 * Tier 2 — fully-static prerendered pages (revalidate: false, no PPR

8 * postponed state, not covered by middleware), served from

9 * embedded bytes with RSC content negotiation and ETag/304.

10 * Invalidation-aware: a cache-handler hook drops a page from

11 * the route table (via server.reload) the moment Next

12 * revalidates it, so on-demand revalidation keeps working.

13 * Tier 3 — everything else (PPR resume, ISR, API routes, server

14 * actions, dynamic rendering) goes to Next's own request

15 * handler in-process through a fetch→node bridge. One

16 * process, one listener — Next never opens a socket.

17 */

18const path = require("path");

19const { Readable, Writable } = require("stream");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runtime/serve.jsView on unpkg · L17

21/* ---------------------------------------------------------------- *

22 * fetch → node bridge

23 *

24 * Next's request handler wants Node (req, res). We synthesize both

25 * from a fetch Request and collect the response into a fetch Response

26 * whose body streams as Next writes — the Response resolves on first

27 * flush, not at end, so streamed SSR / PPR resume behave identically.

28 * ---------------------------------------------------------------- */

30function makeSocket(remoteAddr) {

31 return {

32 remoteAddress: remoteAddr,

33 remotePort: 0,

34 localAddress: "127.0.0.1",

35 localPort: 0,

36 encrypted: false,

37 destroyed: false,

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = bun -e "try{require('fs').symlinkSync('..','node_modules/next-bun-compile')}catch{}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bun -e "try{require('fs').symlinkSync('..','node_modules/next-bun-compile')}catch{}"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/runtime/serve.jsView file

17*/ L18: const path = require("path"); L19: const { Readable, Writable } = require("stream");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runtime/serve.jsView on unpkg · L17

Findings

1 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/runtime/serve.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

package.jsonView file

Lines 1-41json

2 "name": "next-bun-compile",

3 "version": "1.0.0",

4 "description": "Compile your Next.js app into a Bun single-file executable",

5 "type": "module",

6 "main": "./dist/index.js",

7 "types": "./dist/index.d.ts",

8 "exports": {

9 ".": {

10 "types": "./dist/index.d.ts",

11 "default": "./dist/index.js"

12 }

13 },

14 "files": [

15 "dist"

16 ],

17 "scripts": {

18 "build": "rm -rf dist && bun build src/index.ts --outdir dist --target node && mkdir -p dist/runtime && cp src/runtime/serve.js dist/runtime/serve.js",

19 "typecheck": "tsc --noEmit",

20 "test:regression": "bash test/regression/run.sh",

21 "postinstall": "bun -e \"try{require('fs').symlinkSync('..','node_modules/next-bun-compile')}catch{}\""

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 },

23 "peerDependencies": {

24 "next": ">=16.2.0"

25 },

26 "devDependencies": {

27 "next": "16.1.6",

28 "@types/bun": "^1",

29 "@types/node": "^20",

30 "typescript": "^5"

31 },

32 "keywords": [

33 "nextjs",

34 "bun",

35 "compile",

36 "standalone",

37 "executable"

38 ],

39 "license": "MIT",

40 "homepage": "https://github.com/ramonmalcolm10/next-bun-compile#readme",

41 "bugs": {

dist/runtime/serve.jsView file

Lines 1-37javascript

1/**

2 * Single-server Bun.serve runtime for compiled Next.js binaries.

3 *

4 * Request flow, fastest tier first:

5 * Tier 1 — immutable /_next/static/* and public/* files, served as

6 * in-memory Responses via Bun's static route dispatch.

7 * Tier 2 — fully-static prerendered pages (revalidate: false, no PPR

8 * postponed state, not covered by middleware), served from

9 * embedded bytes with RSC content negotiation and ETag/304.

10 * Invalidation-aware: a cache-handler hook drops a page from

11 * the route table (via server.reload) the moment Next

12 * revalidates it, so on-demand revalidation keeps working.

13 * Tier 3 — everything else (PPR resume, ISR, API routes, server

14 * actions, dynamic rendering) goes to Next's own request

15 * handler in-process through a fetch→node bridge. One

16 * process, one listener — Next never opens a socket.

17 */

18const path = require("path");

19const { Readable, Writable } = require("stream");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runtime/serve.jsView on unpkg · L17

21/* ---------------------------------------------------------------- *

22 * fetch → node bridge

23 *

24 * Next's request handler wants Node (req, res). We synthesize both

25 * from a fetch Request and collect the response into a fetch Response

26 * whose body streams as Next writes — the Response resolves on first

27 * flush, not at end, so streamed SSR / PPR resume behave identically.

28 * ---------------------------------------------------------------- */

30function makeSocket(remoteAddr) {

31 return {

32 remoteAddress: remoteAddr,

33 remotePort: 0,

34 localAddress: "127.0.0.1",

35 localPort: 0,

36 encrypted: false,

37 destroyed: false,