registry / node-slim / 1.0.0

node-slim@1.0.0

CLI tool to remove unused packages from node_modules while keeping package.json unchanged.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStrings

Manifest

CopyleftLicense

scanned 1 file(s), 7.51 KB of source

Source & flagged code

2 flagged

clean-deploy.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2const fs = require('fs');

3const path = require('path');

4const { execSync } = require('child_process');

High

Child Process

Package source references child process execution.

clean-deploy.jsView on unpkg · L3

6// --- Helper function to calculate node_modules size ---

7function getSizeInMB(dirPath) {

8 if (!fs.existsSync(dirPath)) return 0;

9 let totalSize = 0;

11 function calculate(currentPath) {

12 const stats = fs.lstatSync(currentPath);

13 if (stats.isDirectory()) {

14 const files = fs.readdirSync(currentPath);

15 for (const file of files) {

16 calculate(path.join(currentPath, file));

17 }

18 } else {

19 totalSize += stats.size;

20 }

21 }

23 try {

Lines 154-194javascript

154

155 Object.keys(originalDeps).forEach((dep) => {

156 if (!usedModules.has(dep)) {

157 console.log(`🗑️ Pruning unused package: ${dep}`);

158 delete updatedDeps[dep];

Source & flagged code

2 flagged · loading source

clean-deploy.jsView file

3const path = require('path'); L4: const { execSync } = require('child_process'); L5:

High

Child Process

Package source references child process execution.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code