registry / numbl / 0.4.11

numbl@0.4.11

Run .m source files in the browser and on the command line by compiling to JavaScript

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 5.08 MB of source, external domains: concept-collection.github.io, figures.numbl.org, github.com, jcgt.org, mip-cors-proxy.figurl.workers.dev, numbl.org, react.dev, www.w3.org

Oversized source lightweight scan

dist-browser/browser.js3.09 MB file, sampled 256 KB

FilesystemNetworkEvalMinifiedUrlStringsProtestwaregithub.commip-cors-proxy.figurl.workers.dev

dist-cli/cli.js3.44 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsNativeBindingsCryptoShellHighEntropyStringsUrlStringsgithub.com

dist-lib/lib.js2.95 MB file, sampled 256 KB

FilesystemNetworkEvalHighEntropyStringsUrlStringsgithub.commip-cors-proxy.figurl.workers.dev

dist-plot-viewer/assets/hdf5_hl-C9YUKPMe.js4.56 MB file, sampled 256 KB

NetworkChildProcessObfuscatedMinified

dist-site-viewer/assets/hdf5_hl-C9YUKPMe.js4.56 MB file, sampled 256 KB

NetworkChildProcessObfuscatedMinified

dist-site-viewer/assets/index-fhKbvuOM.js2.60 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsMinifiedUrlStringsgithub.commip-cors-proxy.figurl.workers.devnumbl.orgreact.dev

Source & flagged code

7 flagged

package.jsonView file

Lines 46-86json

46 "dist-site-viewer/",

47 "native/",

48 "binding.gyp"

49 ],

50 "scripts": {

51 "dev": "npm run build:snippets && npm run bundle:stdlib && vite",

52 "build": "npm run build:web && npm run build:test-runner && npm run copy:test-scripts && npm run build:cli && npm run build:plot-viewer && npm run build:site-viewer",

53 "build:plot-viewer": "vite build --config vite.plot-viewer.config.ts",

54 "build:site-viewer": "npm run build:snippets && npm run bundle:stdlib && vite build --config vite.site-viewer.config.ts",

55 "dev:site-viewer": "npm run build:snippets && npm run bundle:stdlib && vite --config vite.site-viewer.config.ts",

56 "build:test-runner": "npm run build:snippets && npm run bundle:stdlib && vite build --config vite.test-runner.config.ts",

57 "dev:test-runner": "npm run build:snippets && npm run bundle:stdlib && vite --config vite.test-runner.config.ts",

58 "copy:test-scripts": "tsx scripts/copy-test-scripts.ts",

59 "bundle:stdlib": "tsx scripts/bundle-stdlib.ts",

60 "build:snippets": "tsx scripts/build_runtime_snippets.ts",

61 "build:snippets:check": "tsx scripts/build_runtime_snippets.ts --check",

62 "build:web": "npm run build:snippets && npm run bundle:stdlib && tsc -b && vite build",

63 "build:lib": "npm run build:snippets && npm run bundle:stdlib && esbuild src/lib.ts --bundle --platform=node --format=esm --outfile=dist-lib/lib.js --packages=external --loader:.wasm=file && tsc -p tsconfig.lib.json",

64 "build:cli": "npm run build:snippets && npm run bundle:stdlib && esbuild src/cli.ts --bundle --platform=node --format=esm --outfile=dist-cli/cli.js --packages=external --loader:.wasm=file",

65 "build:graphics": "esbuild src/graphics-lib.ts --bundle --platform=browser --format=esm --outfile=dist-graphics/index.js --external:react --external:react-dom --external:react/jsx-runtime --external:h5wasm --jsx=automatic && tsc -p tsconfig.graphics.json",

66 "install": "true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L66

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L66

67 "build:addon": "node-gyp rebuild",

68 "format": "prettier --write .",

69 "format:check": "prettier --check .",

70 "lint": "eslint .",

71 "typecheck": "tsc -b",

72 "preview": "vite preview",

73 "test": "vitest run",

74 "test:coverage": "vitest run --coverage",

75 "test:coverage:all": "bash scripts/coverage-all.sh",

76 "test:scripts": "bash numbl_test_scripts/run_all.sh",

77 "jit-parity": "node jit_parity/run.mjs",

78 "test:browser": "playwright test",

79 "build:wasm": "bash numbl_test_scripts/build_wasm.sh",

80 "update-readme": "tsx scripts/update-readme-usage.ts",

81 "check-readme": "tsx scripts/update-readme-usage.ts --check",

82 "bump": "tsx scripts/bump-version.ts",

83 "prepublishOnly": "npm run build:lib && npm run build:browser && npm run build:graphics && npm run build:cli && npm run build:plot-viewer && npm run build:site-viewer",

84 "prepare": "husky",

85 "build:browser": "npm run build:snippets && npm run bundle:stdlib && tsx scripts/build_browser.ts"

86 },

dist-site-viewer/assets/numbl-worker-BFP9xj5e.jsView file

110`),0}setWorkspaceAccessor(t,n,r){this.workspaceAccessors.set(t,{get:n,set:r})}getWorkspaceVariable(t){const n=this.workspaceAccessors.get(t);return n?n.get():this.dynamicWorkspaceV... L111: `);for(const r of n){const s=r.match(/^\s*\/\/\s*(\w+):\s*(\S+)/);if(!s)break;const o=s[1],i=s[2];o==="wasm"?t.wasm=i:o==="native"&&(t.native=i)}return t}function Zc(e){return e.en... L112: `)}function Y4(e){return!/[/\\]/.test(e)&&!e.endsWith(".m")?e:e.replace(/\.m$/,"").split(/[/\\]/).filter(r=>r.length>0).map(r=>r.startsWith("+")?r.slice(1):r).join(".")}Sn("help",(...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist-site-viewer/assets/numbl-worker-BFP9xj5e.jsView on unpkg · L110

dist-site-viewer/assets/qhull-DM50poqF.wasmView file

•path = dist-site-viewer/assets/qhull-DM50poqF.wasm kind = wasm_module sizeBytes = 388780 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist-site-viewer/assets/qhull-DM50poqF.wasmView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 3080 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

dist-lib/lib.jsView file

•path = dist-lib/lib.js kind = oversized_source_file sizeBytes = 3094824 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-lib/lib.jsView on unpkg

dist-cli/cli.jsView file

•path = dist-cli/cli.js kind = oversized_cli_entrypoint sizeBytes = 3605705 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist-cli/cli.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.install = true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist-site-viewer/assets/numbl-worker-BFP9xj5e.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist-site-viewer/assets/numbl-worker-BFP9xj5e.jsView on unpkg · L110

dist-site-viewer/assets/qhull-DM50poqF.wasmView file

•path = dist-site-viewer/assets/qhull-DM50poqF.wasm kind = wasm_module sizeBytes = 388780 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist-site-viewer/assets/qhull-DM50poqF.wasmView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 3080 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

dist-lib/lib.jsView file

•path = dist-lib/lib.js kind = oversized_source_file sizeBytes = 3094824 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-lib/lib.jsView on unpkg

dist-cli/cli.jsView file

•path = dist-cli/cli.js kind = oversized_cli_entrypoint sizeBytes = 3605705 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist-cli/cli.jsView on unpkg

Findings

2 High8 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighOversized Source Filedist-lib/lib.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Wasm Moduledist-site-viewer/assets/qhull-DM50poqF.wasm

MediumShips Build Helperbinding.gyp

MediumOversized Cli Entrypointdist-cli/cli.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist-site-viewer/assets/numbl-worker-BFP9xj5e.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

package.jsonView file

Lines 46-86json

46 "dist-site-viewer/",

47 "native/",

48 "binding.gyp"

49 ],

50 "scripts": {

51 "dev": "npm run build:snippets && npm run bundle:stdlib && vite",

52 "build": "npm run build:web && npm run build:test-runner && npm run copy:test-scripts && npm run build:cli && npm run build:plot-viewer && npm run build:site-viewer",

53 "build:plot-viewer": "vite build --config vite.plot-viewer.config.ts",

54 "build:site-viewer": "npm run build:snippets && npm run bundle:stdlib && vite build --config vite.site-viewer.config.ts",

55 "dev:site-viewer": "npm run build:snippets && npm run bundle:stdlib && vite --config vite.site-viewer.config.ts",

56 "build:test-runner": "npm run build:snippets && npm run bundle:stdlib && vite build --config vite.test-runner.config.ts",

57 "dev:test-runner": "npm run build:snippets && npm run bundle:stdlib && vite --config vite.test-runner.config.ts",

58 "copy:test-scripts": "tsx scripts/copy-test-scripts.ts",

59 "bundle:stdlib": "tsx scripts/bundle-stdlib.ts",

60 "build:snippets": "tsx scripts/build_runtime_snippets.ts",

61 "build:snippets:check": "tsx scripts/build_runtime_snippets.ts --check",

62 "build:web": "npm run build:snippets && npm run bundle:stdlib && tsc -b && vite build",

64 "build:cli": "npm run build:snippets && npm run bundle:stdlib && esbuild src/cli.ts --bundle --platform=node --format=esm --outfile=dist-cli/cli.js --packages=external --loader:.wasm=file",

66 "install": "true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L66

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L66

67 "build:addon": "node-gyp rebuild",

68 "format": "prettier --write .",

69 "format:check": "prettier --check .",

70 "lint": "eslint .",

71 "typecheck": "tsc -b",

72 "preview": "vite preview",

73 "test": "vitest run",

74 "test:coverage": "vitest run --coverage",

75 "test:coverage:all": "bash scripts/coverage-all.sh",

76 "test:scripts": "bash numbl_test_scripts/run_all.sh",

77 "jit-parity": "node jit_parity/run.mjs",

78 "test:browser": "playwright test",

79 "build:wasm": "bash numbl_test_scripts/build_wasm.sh",

80 "update-readme": "tsx scripts/update-readme-usage.ts",

81 "check-readme": "tsx scripts/update-readme-usage.ts --check",

82 "bump": "tsx scripts/bump-version.ts",

83 "prepublishOnly": "npm run build:lib && npm run build:browser && npm run build:graphics && npm run build:cli && npm run build:plot-viewer && npm run build:site-viewer",

84 "prepare": "husky",

85 "build:browser": "npm run build:snippets && npm run bundle:stdlib && tsx scripts/build_browser.ts"

86 },

dist-site-viewer/assets/numbl-worker-BFP9xj5e.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist-site-viewer/assets/numbl-worker-BFP9xj5e.jsView on unpkg · L110

dist-site-viewer/assets/qhull-DM50poqF.wasmView file

•path = dist-site-viewer/assets/qhull-DM50poqF.wasm kind = wasm_module sizeBytes = 388780 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist-site-viewer/assets/qhull-DM50poqF.wasmView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 3080 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

dist-lib/lib.jsView file

•path = dist-lib/lib.js kind = oversized_source_file sizeBytes = 3094824 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-lib/lib.jsView on unpkg

dist-cli/cli.jsView file

•path = dist-cli/cli.js kind = oversized_cli_entrypoint sizeBytes = 3605705 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist-cli/cli.jsView on unpkg