registry / node-gtk / 4.0.0

node-gtk@4.0.0

GNOME Gtk+ bindings for NodeJS

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNativeBindings

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 41 file(s), 206 KB of source, external domains: github.com, gitlab.gnome.org

Source & flagged code

5 flagged

package.jsonView file

Lines 4-44json

4 "description": "GNOME Gtk+ bindings for NodeJS",

5 "main": "lib/index.js",

6 "exports": {

7 ".": {

8 "import": "./lib/index.mjs",

9 "require": "./lib/index.js"

10 },

11 "./register": "./lib/esm/register.mjs",

12 "./hooks": "./lib/esm/hooks.mjs",

13 "./styles": {

14 "types": "./lib/styles.d.ts",

15 "default": "./lib/styles.js"

16 },

17 "./package.json": "./package.json",

18 "./*": "./*"

19 },

20 "bin": {

21 "node-gtk": "bin/node-gtk.js"

22 },

23 "scripts": {

24 "install": "npx node-pre-gyp install --fallback-to-build",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "build:test-fixtures": "node scripts/build-test-fixtures.js",

26 "pretest": "node scripts/build-test-fixtures.js",

27 "test": "mocha tests/__run__.js",

28 "build": "npx node-pre-gyp build",

29 "build:full": "npx node-pre-gyp rebuild",

30 "configure": "npx node-pre-gyp configure --debug"

31 },

32 "repository": {

33 "type": "git",

34 "url": "git+https://github.com/romgrk/node-gtk.git"

35 },

36 "keywords": [

37 "GNOME",

38 "gobject-introspection",

39 "GObject",

40 "Gtk+",

41 "Gtk",

42 "cairo"

43 ],

44 "author": "Jasper St. Pierre",

tools/list-libraries.jsView file

Lines 1-25javascript

1/*

2 * list-libraries.js — list the GObject-Introspection libraries (typelibs)

3 * available on this machine, grouped by namespace with their versions.

4 *

5 * Driven by the CLI: `node-gtk list [filter] [options]`. The names/versions it

6 * prints are exactly what you pass to `require()` / the `gi:` import scheme /

7 * `generate-types` (e.g. `Gtk-4.0`).

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/list-libraries.jsView on unpkg · L5

8 */

10const

lib/binding/node-v127-linux-x64/node_gtk.nodeView file

•path = lib/binding/node-v127-linux-x64/node_gtk.node kind = native_binary sizeBytes = 4087720 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

lib/binding/node-v127-linux-x64/node_gtk.nodeView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 5714 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.install = npx node-pre-gyp install --fallback-to-build

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = npx node-pre-gyp install --fallback-to-build

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

tools/list-libraries.jsView file

5* Driven by the CLI: `node-gtk list [filter] [options]`. The names/versions it L6: * prints are exactly what you pass to `require()` / the `gi:` import scheme / L7: * `generate-types` (e.g. `Gtk-4.0`).

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/list-libraries.jsView on unpkg · L5

lib/binding/node-v127-linux-x64/node_gtk.nodeView file

•path = lib/binding/node-v127-linux-x64/node_gtk.node kind = native_binary sizeBytes = 4087720 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

lib/binding/node-v127-linux-x64/node_gtk.nodeView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 5714 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

Findings

1 High6 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiretools/list-libraries.js

MediumEnvironment Vars

MediumShips Native Binarylib/binding/node-v127-linux-x64/node_gtk.node

MediumShips Build Helperbinding.gyp

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

package.jsonView file

Lines 4-44json

4 "description": "GNOME Gtk+ bindings for NodeJS",

5 "main": "lib/index.js",

6 "exports": {

7 ".": {

8 "import": "./lib/index.mjs",

9 "require": "./lib/index.js"

10 },

11 "./register": "./lib/esm/register.mjs",

12 "./hooks": "./lib/esm/hooks.mjs",

13 "./styles": {

14 "types": "./lib/styles.d.ts",

15 "default": "./lib/styles.js"

16 },

17 "./package.json": "./package.json",

18 "./*": "./*"

19 },

20 "bin": {

21 "node-gtk": "bin/node-gtk.js"

22 },

23 "scripts": {

24 "install": "npx node-pre-gyp install --fallback-to-build",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "build:test-fixtures": "node scripts/build-test-fixtures.js",

26 "pretest": "node scripts/build-test-fixtures.js",

27 "test": "mocha tests/__run__.js",

28 "build": "npx node-pre-gyp build",

29 "build:full": "npx node-pre-gyp rebuild",

30 "configure": "npx node-pre-gyp configure --debug"

31 },

32 "repository": {

33 "type": "git",

34 "url": "git+https://github.com/romgrk/node-gtk.git"

35 },

36 "keywords": [

37 "GNOME",

38 "gobject-introspection",

39 "GObject",

40 "Gtk+",

41 "Gtk",

42 "cairo"

43 ],

44 "author": "Jasper St. Pierre",

tools/list-libraries.jsView file

Lines 1-25javascript

1/*

2 * list-libraries.js — list the GObject-Introspection libraries (typelibs)

3 * available on this machine, grouped by namespace with their versions.

4 *

5 * Driven by the CLI: `node-gtk list [filter] [options]`. The names/versions it

6 * prints are exactly what you pass to `require()` / the `gi:` import scheme /

7 * `generate-types` (e.g. `Gtk-4.0`).

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/list-libraries.jsView on unpkg · L5

8 */

10const

lib/binding/node-v127-linux-x64/node_gtk.nodeView file

•path = lib/binding/node-v127-linux-x64/node_gtk.node kind = native_binary sizeBytes = 4087720 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

lib/binding/node-v127-linux-x64/node_gtk.nodeView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 5714 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg