numbl@0.4.12: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

numbl@0.4.12: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.install = true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist-site-viewer/assets/numbl-worker-DddtCPW_.jsView file

110`),0}setWorkspaceAccessor(t,n,r){this.workspaceAccessors.set(t,{get:n,set:r})}getWorkspaceVariable(t){const n=this.workspaceAccessors.get(t);return n?n.get():this.dynamicWorkspaceV... L111: `);for(const r of n){const s=r.match(/^\s*\/\/\s*(\w+):\s*(\S+)/);if(!s)break;const o=s[1],i=s[2];o==="wasm"?t.wasm=i:o==="native"&&(t.native=i)}return t}function Zc(e){return e.en... L112: `)}function Y4(e){return!/[/\\]/.test(e)&&!e.endsWith(".m")?e:e.replace(/\.m$/,"").split(/[/\\]/).filter(r=>r.length>0).map(r=>r.startsWith("+")?r.slice(1):r).join(".")}Sn("help",(...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist-site-viewer/assets/numbl-worker-DddtCPW_.jsView on unpkg · L110

dist-site-viewer/assets/qhull-DM50poqF.wasmView file

•path = dist-site-viewer/assets/qhull-DM50poqF.wasm kind = wasm_module sizeBytes = 388780 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist-site-viewer/assets/qhull-DM50poqF.wasmView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 3080 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

dist-lib/lib.jsView file

•path = dist-lib/lib.js kind = oversized_source_file sizeBytes = 3094850 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-lib/lib.jsView on unpkg

dist-cli/cli.jsView file

•path = dist-cli/cli.js kind = oversized_cli_entrypoint sizeBytes = 3605731 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist-cli/cli.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 46-86json

46 "dist-site-viewer/",

47 "native/",

48 "binding.gyp"

49 ],

50 "scripts": {

51 "dev": "npm run build:snippets && npm run bundle:stdlib && vite",

52 "build": "npm run build:web && npm run build:test-runner && npm run copy:test-scripts && npm run build:cli && npm run build:plot-viewer && npm run build:site-viewer",

53 "build:plot-viewer": "vite build --config vite.plot-viewer.config.ts",

54 "build:site-viewer": "npm run build:snippets && npm run bundle:stdlib && vite build --config vite.site-viewer.config.ts",

55 "dev:site-viewer": "npm run build:snippets && npm run bundle:stdlib && vite --config vite.site-viewer.config.ts",

56 "build:test-runner": "npm run build:snippets && npm run bundle:stdlib && vite build --config vite.test-runner.config.ts",

57 "dev:test-runner": "npm run build:snippets && npm run bundle:stdlib && vite --config vite.test-runner.config.ts",

58 "copy:test-scripts": "tsx scripts/copy-test-scripts.ts",

59 "bundle:stdlib": "tsx scripts/bundle-stdlib.ts",

60 "build:snippets": "tsx scripts/build_runtime_snippets.ts",

61 "build:snippets:check": "tsx scripts/build_runtime_snippets.ts --check",

62 "build:web": "npm run build:snippets && npm run bundle:stdlib && tsc -b && vite build",

63 "build:lib": "npm run build:snippets && npm run bundle:stdlib && esbuild src/lib.ts --bundle --platform=node --format=esm --outfile=dist-lib/lib.js --packages=external --loader:.wasm=file && tsc -p tsconfig.lib.json",

64 "build:cli": "npm run build:snippets && npm run bundle:stdlib && esbuild src/cli.ts --bundle --platform=node --format=esm --outfile=dist-cli/cli.js --packages=external --loader:.wasm=file",

65 "build:graphics": "esbuild src/graphics-lib.ts --bundle --platform=browser --format=esm --outfile=dist-graphics/index.js --external:react --external:react-dom --external:react/jsx-runtime --external:h5wasm --jsx=automatic && tsc -p tsconfig.graphics.json",

66 "install": "true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L66

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L66

67 "build:addon": "node-gyp rebuild",

68 "format": "prettier --write .",

69 "format:check": "prettier --check .",

70 "lint": "eslint .",

71 "typecheck": "tsc -b",

72 "preview": "vite preview",

73 "test": "vitest run",

74 "test:coverage": "vitest run --coverage",

75 "test:coverage:all": "bash scripts/coverage-all.sh",

76 "test:scripts": "bash numbl_test_scripts/run_all.sh",

77 "jit-parity": "node jit_parity/run.mjs",

78 "test:browser": "playwright test",

79 "build:wasm": "bash numbl_test_scripts/build_wasm.sh",

80 "update-readme": "tsx scripts/update-readme-usage.ts",

81 "check-readme": "tsx scripts/update-readme-usage.ts --check",

82 "bump": "tsx scripts/bump-version.ts",

83 "prepublishOnly": "npm run build:lib && npm run build:browser && npm run build:graphics && npm run build:cli && npm run build:plot-viewer && npm run build:site-viewer",

84 "prepare": "husky",

85 "build:browser": "npm run build:snippets && npm run bundle:stdlib && tsx scripts/build_browser.ts"

86 },

dist-site-viewer/assets/numbl-worker-DddtCPW_.jsView file

110`),0}setWorkspaceAccessor(t,n,r){this.workspaceAccessors.set(t,{get:n,set:r})}getWorkspaceVariable(t){const n=this.workspaceAccessors.get(t);return n?n.get():this.dynamicWorkspaceV... L111: `);for(const r of n){const s=r.match(/^\s*\/\/\s*(\w+):\s*(\S+)/);if(!s)break;const o=s[1],i=s[2];o==="wasm"?t.wasm=i:o==="native"&&(t.native=i)}return t}function Zc(e){return e.en... L112: `)}function Y4(e){return!/[/\\]/.test(e)&&!e.endsWith(".m")?e:e.replace(/\.m$/,"").split(/[/\\]/).filter(r=>r.length>0).map(r=>r.startsWith("+")?r.slice(1):r).join(".")}Sn("help",(...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist-site-viewer/assets/numbl-worker-DddtCPW_.jsView on unpkg · L110

dist-site-viewer/assets/qhull-DM50poqF.wasmView file

•path = dist-site-viewer/assets/qhull-DM50poqF.wasm kind = wasm_module sizeBytes = 388780 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist-site-viewer/assets/qhull-DM50poqF.wasmView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 3080 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

dist-lib/lib.jsView file

•path = dist-lib/lib.js kind = oversized_source_file sizeBytes = 3094850 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-lib/lib.jsView on unpkg

dist-cli/cli.jsView file

•path = dist-cli/cli.js kind = oversized_cli_entrypoint sizeBytes = 3605731 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist-cli/cli.jsView on unpkg