registry / nlpplus / 1.3.1

nlpplus@1.3.1

Node.js bindings for the NLP++ text-analysis engine (peer of the Python package NLPPlus)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 155 KB of source, external domains: nlp-compile-dispatcher.dehilster.workers.dev

Source & flagged code

8 flagged

package.jsonView file

Lines 1-31json

2 "name": "nlpplus",

3 "version": "1.3.1",

4 "description": "Node.js bindings for the NLP++ text-analysis engine (peer of the Python package NLPPlus)",

5 "main": "index.js",

6 "types": "index.d.ts",

7 "engines": {

8 "node": ">=18"

9 },

10 "scripts": {

11 "install": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "build": "cmake-js compile",

13 "build:debug": "cmake-js compile --debug",

14 "rebuild": "cmake-js rebuild",

15 "test": "node test/engine.test.js"

16 },

17 "files": [

18 "index.js",

19 "index.d.ts",

20 "lib/*.js",

21 "src/",

22 "scripts/",

23 "CMakeLists.txt",

24 "vcpkg.json",

25 "analyzers/",

26 "data/",

27 "nlp-engine/",

28 "prebuilds/"

29 ],

30 "keywords": [

31 "nlp",

nlp-engine/visualtext/Help/helps/ehlpdhtm.jsView file

Lines 774-814javascript

774 return gstrPopupShadowID + nIndex;

775}

776

777function getPopupTopicID(nIndex)

778{

779 return gstrPopupTopicID + nIndex;

780}

781

782function getPopupIFrameID

index.jsView file

Lines 1-8javascript

1'use strict';

3// Package entry point. The implementation lives in lib/ to keep the native

4// addon loader, the cloud-compile port, and the ergonomic API cleanly

5// separated (mirrors NLPPlus/__init__.py + NLPPlus/cloud.py on the Python

6// side).

7module.exports = require('./lib/index');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L6

prebuilds/win32-x64/icuio78.dllView file

•path = prebuilds/win32-x64/icuio78.dll kind = native_binary sizeBytes = 53760 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilds/win32-x64/icuio78.dllView on unpkg

nlp-engine/analyzers/nlp-tutorials/tutorial-13/tutorial-13-a/input/urlfetch.pyView file

•path = nlp-engine/analyzers/nlp-tutorials/tutorial-13/tutorial-13-a/input/urlfetch.py kind = build_helper sizeBytes = 1664 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

nlp-engine/analyzers/nlp-tutorials/tutorial-13/tutorial-13-a/input/urlfetch.pyView on unpkg

nlp-engine/scripts/old/distsrc-x.zipView file

•path = nlp-engine/scripts/old/distsrc-x.zip kind = compressed_blob sizeBytes = 1262 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

nlp-engine/scripts/old/distsrc-x.zipView on unpkg

•path = nlp-engine/scripts/old/distsrc-x.zip kind = nested_archive_needs_inspection sizeBytes = 1262 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

nlp-engine/scripts/old/distsrc-x.zipView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.install = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

nlp-engine/visualtext/Help/helps/ehlpdhtm.jsView file

794{ L795: return eval("document.all['" + getPopupTopicID(nIndex) + "']").style; L796: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

nlp-engine/visualtext/Help/helps/ehlpdhtm.jsView on unpkg · L794

index.jsView file

6// side). L7: module.exports = require('./lib/index');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L6

prebuilds/win32-x64/icuio78.dllView file

•path = prebuilds/win32-x64/icuio78.dll kind = native_binary sizeBytes = 53760 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilds/win32-x64/icuio78.dllView on unpkg

nlp-engine/analyzers/nlp-tutorials/tutorial-13/tutorial-13-a/input/urlfetch.pyView file

•path = nlp-engine/analyzers/nlp-tutorials/tutorial-13/tutorial-13-a/input/urlfetch.py kind = build_helper sizeBytes = 1664 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

nlp-engine/analyzers/nlp-tutorials/tutorial-13/tutorial-13-a/input/urlfetch.pyView on unpkg

nlp-engine/scripts/old/distsrc-x.zipView file

•path = nlp-engine/scripts/old/distsrc-x.zip kind = compressed_blob sizeBytes = 1262 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

nlp-engine/scripts/old/distsrc-x.zipView on unpkg

•path = nlp-engine/scripts/old/distsrc-x.zip kind = nested_archive_needs_inspection sizeBytes = 1262 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

nlp-engine/scripts/old/distsrc-x.zipView on unpkg

Findings

1 High8 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requireindex.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryprebuilds/win32-x64/icuio78.dll

MediumShips Build Helpernlp-engine/analyzers/nlp-tutorials/tutorial-13/tutorial-13-a/input/urlfetch.py

MediumShips Compressed Blobnlp-engine/scripts/old/distsrc-x.zip

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalnlp-engine/visualtext/Help/helps/ehlpdhtm.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionnlp-engine/scripts/old/distsrc-x.zip

Source & flagged code

8 flagged

package.jsonView file

Lines 1-31json

2 "name": "nlpplus",

3 "version": "1.3.1",

4 "description": "Node.js bindings for the NLP++ text-analysis engine (peer of the Python package NLPPlus)",

5 "main": "index.js",

6 "types": "index.d.ts",

7 "engines": {

8 "node": ">=18"

9 },

10 "scripts": {

11 "install": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "build": "cmake-js compile",

13 "build:debug": "cmake-js compile --debug",

14 "rebuild": "cmake-js rebuild",

15 "test": "node test/engine.test.js"

16 },

17 "files": [

18 "index.js",

19 "index.d.ts",

20 "lib/*.js",

21 "src/",

22 "scripts/",

23 "CMakeLists.txt",

24 "vcpkg.json",

25 "analyzers/",

26 "data/",

27 "nlp-engine/",

28 "prebuilds/"

29 ],

30 "keywords": [

31 "nlp",

nlp-engine/visualtext/Help/helps/ehlpdhtm.jsView file

Lines 774-814javascript

774 return gstrPopupShadowID + nIndex;

775}

776

777function getPopupTopicID(nIndex)

778{

779 return gstrPopupTopicID + nIndex;

780}

781

782function getPopupIFrameID

index.jsView file

Lines 1-8javascript

1'use strict';

3// Package entry point. The implementation lives in lib/ to keep the native

4// addon loader, the cloud-compile port, and the ergonomic API cleanly

5// separated (mirrors NLPPlus/__init__.py + NLPPlus/cloud.py on the Python

6// side).

7module.exports = require('./lib/index');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L6

prebuilds/win32-x64/icuio78.dllView file

•path = prebuilds/win32-x64/icuio78.dll kind = native_binary sizeBytes = 53760 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilds/win32-x64/icuio78.dllView on unpkg

nlp-engine/analyzers/nlp-tutorials/tutorial-13/tutorial-13-a/input/urlfetch.pyView file

•path = nlp-engine/analyzers/nlp-tutorials/tutorial-13/tutorial-13-a/input/urlfetch.py kind = build_helper sizeBytes = 1664 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

nlp-engine/analyzers/nlp-tutorials/tutorial-13/tutorial-13-a/input/urlfetch.pyView on unpkg

nlp-engine/scripts/old/distsrc-x.zipView file

•path = nlp-engine/scripts/old/distsrc-x.zip kind = compressed_blob sizeBytes = 1262 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

nlp-engine/scripts/old/distsrc-x.zipView on unpkg

•path = nlp-engine/scripts/old/distsrc-x.zip kind = nested_archive_needs_inspection sizeBytes = 1262 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

nlp-engine/scripts/old/distsrc-x.zipView on unpkg