registry / numbl / 0.4.7

numbl@0.4.7

Run .m source files in the browser and on the command line by compiling to JavaScript

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 4.80 MB of source, external domains: concept-collection.github.io, figures.numbl.org, github.com, jcgt.org, mip-cors-proxy.figurl.workers.dev, numbl.org, react.dev, www.w3.org

Oversized source lightweight scan

dist-cli/cli.js3.39 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsNativeBindingsCryptoShellHighEntropyStringsUrlStringsgithub.com

dist-lib/lib.js2.88 MB file, sampled 256 KB

EvalHighEntropyStrings

dist-plot-viewer/assets/hdf5_hl-C9YUKPMe.js4.56 MB file, sampled 256 KB

NetworkChildProcessObfuscatedMinified

dist-site-viewer/assets/hdf5_hl-C9YUKPMe.js4.56 MB file, sampled 256 KB

NetworkChildProcessObfuscatedMinified

dist-site-viewer/assets/index-RucHpf4b.js2.58 MB file, sampled 256 KB

NetworkHighEntropyStringsMinifiedUrlStringsgithub.commip-cors-proxy.figurl.workers.devnumbl.orgreact.dev

Source & flagged code

7 flagged

package.jsonView file

Lines 41-81json

41 "dist-site-viewer/",

42 "native/",

43 "binding.gyp"

44 ],

45 "scripts": {

46 "dev": "npm run build:snippets && npm run bundle:stdlib && vite",

47 "build": "npm run build:web && npm run build:test-runner && npm run copy:test-scripts && npm run build:cli && npm run build:plot-viewer && npm run build:site-viewer",

48 "build:plot-viewer": "vite build --config vite.plot-viewer.config.ts",

49 "build:site-viewer": "npm run build:snippets && npm run bundle:stdlib && vite build --config vite.site-viewer.config.ts",

50 "dev:site-viewer": "npm run build:snippets && npm run bundle:stdlib && vite --config vite.site-viewer.config.ts",

51 "build:test-runner": "npm run build:snippets && npm run bundle:stdlib && vite build --config vite.test-runner.config.ts",

52 "dev:test-runner": "npm run build:snippets && npm run bundle:stdlib && vite --config vite.test-runner.config.ts",

53 "copy:test-scripts": "tsx scripts/copy-test-scripts.ts",

54 "bundle:stdlib": "tsx scripts/bundle-stdlib.ts",

55 "build:snippets": "tsx scripts/build_runtime_snippets.ts",

56 "build:snippets:check": "tsx scripts/build_runtime_snippets.ts --check",

57 "build:web": "npm run build:snippets && npm run bundle:stdlib && tsc -b && vite build",

58 "build:lib": "npm run build:snippets && npm run bundle:stdlib && esbuild src/lib.ts --bundle --platform=node --format=esm --outfile=dist-lib/lib.js --packages=external --loader:.wasm=file && tsc -p tsconfig.lib.json",

59 "build:cli": "npm run build:snippets && npm run bundle:stdlib && esbuild src/cli.ts --bundle --platform=node --format=esm --outfile=dist-cli/cli.js --packages=external --loader:.wasm=file",

60 "build:graphics": "esbuild src/graphics-lib.ts --bundle --platform=browser --format=esm --outfile=dist-graphics/index.js --external:react --external:react-dom --external:react/jsx-runtime --external:h5wasm --jsx=automatic && tsc -p tsconfig.graphics.json",

61 "install": "true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L61

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L61

62 "build:addon": "node-gyp rebuild",

63 "format": "prettier --write .",

64 "format:check": "prettier --check .",

65 "lint": "eslint .",

66 "typecheck": "tsc -b",

67 "preview": "vite preview",

68 "test": "vitest run",

69 "test:coverage": "vitest run --coverage",

70 "test:coverage:all": "bash scripts/coverage-all.sh",

71 "test:scripts": "bash numbl_test_scripts/run_all.sh",

72 "jit-parity": "node jit_parity/run.mjs",

73 "test:browser": "playwright test",

74 "build:wasm": "bash numbl_test_scripts/build_wasm.sh",

75 "update-readme": "tsx scripts/update-readme-usage.ts",

76 "check-readme": "tsx scripts/update-readme-usage.ts --check",

77 "bump": "tsx scripts/bump-version.ts",

78 "prepublishOnly": "npm run build:lib && npm run build:graphics && npm run build:cli && npm run build:plot-viewer && npm run build:site-viewer",

79 "prepare": "husky"

80 },

81 "dependencies": {

dist-site-viewer/assets/numbl-worker-IO39kohI.jsView file

108`),0}setWorkspaceAccessor(t,n,r){this.workspaceAccessors.set(t,{get:n,set:r})}getWorkspaceVariable(t){const n=this.workspaceAccessors.get(t);return n?n.get():this.dynamicWorkspaceV... L109: `);for(const r of n){const s=r.match(/^\s*\/\/\s*(\w+):\s*(\S+)/);if(!s)break;const o=s[1],i=s[2];o==="wasm"?t.wasm=i:o==="native"&&(t.native=i)}return t}function Zu(e){return e.en... L110: `)}function f4(e){return!/[/\\]/.test(e)&&!e.endsWith(".m")?e:e.replace(/\.m$/,"").split(/[/\\]/).filter(r=>r.length>0).map(r=>r.startsWith("+")?r.slice(1):r).join(".")}Cn("help",(...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist-site-viewer/assets/numbl-worker-IO39kohI.jsView on unpkg · L108

dist-site-viewer/assets/qhull-DM50poqF.wasmView file

•path = dist-site-viewer/assets/qhull-DM50poqF.wasm kind = wasm_module sizeBytes = 388780 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist-site-viewer/assets/qhull-DM50poqF.wasmView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 3080 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

dist-lib/lib.jsView file

•path = dist-lib/lib.js kind = oversized_source_file sizeBytes = 3017815 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-lib/lib.jsView on unpkg

dist-cli/cli.jsView file

•path = dist-cli/cli.js kind = oversized_cli_entrypoint sizeBytes = 3549877 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist-cli/cli.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.install = true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist-site-viewer/assets/numbl-worker-IO39kohI.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist-site-viewer/assets/numbl-worker-IO39kohI.jsView on unpkg · L108

dist-site-viewer/assets/qhull-DM50poqF.wasmView file

•path = dist-site-viewer/assets/qhull-DM50poqF.wasm kind = wasm_module sizeBytes = 388780 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist-site-viewer/assets/qhull-DM50poqF.wasmView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 3080 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

dist-lib/lib.jsView file

•path = dist-lib/lib.js kind = oversized_source_file sizeBytes = 3017815 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-lib/lib.jsView on unpkg

dist-cli/cli.jsView file

•path = dist-cli/cli.js kind = oversized_cli_entrypoint sizeBytes = 3549877 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist-cli/cli.jsView on unpkg

Findings

2 High8 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighOversized Source Filedist-lib/lib.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Wasm Moduledist-site-viewer/assets/qhull-DM50poqF.wasm

MediumShips Build Helperbinding.gyp

MediumOversized Cli Entrypointdist-cli/cli.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist-site-viewer/assets/numbl-worker-IO39kohI.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

package.jsonView file

Lines 41-81json

41 "dist-site-viewer/",

42 "native/",

43 "binding.gyp"

44 ],

45 "scripts": {

46 "dev": "npm run build:snippets && npm run bundle:stdlib && vite",

47 "build": "npm run build:web && npm run build:test-runner && npm run copy:test-scripts && npm run build:cli && npm run build:plot-viewer && npm run build:site-viewer",

48 "build:plot-viewer": "vite build --config vite.plot-viewer.config.ts",

49 "build:site-viewer": "npm run build:snippets && npm run bundle:stdlib && vite build --config vite.site-viewer.config.ts",

50 "dev:site-viewer": "npm run build:snippets && npm run bundle:stdlib && vite --config vite.site-viewer.config.ts",

51 "build:test-runner": "npm run build:snippets && npm run bundle:stdlib && vite build --config vite.test-runner.config.ts",

52 "dev:test-runner": "npm run build:snippets && npm run bundle:stdlib && vite --config vite.test-runner.config.ts",

53 "copy:test-scripts": "tsx scripts/copy-test-scripts.ts",

54 "bundle:stdlib": "tsx scripts/bundle-stdlib.ts",

55 "build:snippets": "tsx scripts/build_runtime_snippets.ts",

56 "build:snippets:check": "tsx scripts/build_runtime_snippets.ts --check",

57 "build:web": "npm run build:snippets && npm run bundle:stdlib && tsc -b && vite build",

59 "build:cli": "npm run build:snippets && npm run bundle:stdlib && esbuild src/cli.ts --bundle --platform=node --format=esm --outfile=dist-cli/cli.js --packages=external --loader:.wasm=file",

61 "install": "true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L61

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L61

62 "build:addon": "node-gyp rebuild",

63 "format": "prettier --write .",

64 "format:check": "prettier --check .",

65 "lint": "eslint .",

66 "typecheck": "tsc -b",

67 "preview": "vite preview",

68 "test": "vitest run",

69 "test:coverage": "vitest run --coverage",

70 "test:coverage:all": "bash scripts/coverage-all.sh",

71 "test:scripts": "bash numbl_test_scripts/run_all.sh",

72 "jit-parity": "node jit_parity/run.mjs",

73 "test:browser": "playwright test",

74 "build:wasm": "bash numbl_test_scripts/build_wasm.sh",

75 "update-readme": "tsx scripts/update-readme-usage.ts",

76 "check-readme": "tsx scripts/update-readme-usage.ts --check",

77 "bump": "tsx scripts/bump-version.ts",

78 "prepublishOnly": "npm run build:lib && npm run build:graphics && npm run build:cli && npm run build:plot-viewer && npm run build:site-viewer",

79 "prepare": "husky"

80 },

81 "dependencies": {

dist-site-viewer/assets/numbl-worker-IO39kohI.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist-site-viewer/assets/numbl-worker-IO39kohI.jsView on unpkg · L108

dist-site-viewer/assets/qhull-DM50poqF.wasmView file

•path = dist-site-viewer/assets/qhull-DM50poqF.wasm kind = wasm_module sizeBytes = 388780 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist-site-viewer/assets/qhull-DM50poqF.wasmView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 3080 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

dist-lib/lib.jsView file

•path = dist-lib/lib.js kind = oversized_source_file sizeBytes = 3017815 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-lib/lib.jsView on unpkg

dist-cli/cli.jsView file

•path = dist-cli/cli.js kind = oversized_cli_entrypoint sizeBytes = 3549877 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist-cli/cli.jsView on unpkg