registry / obuild / 0.4.38

obuild@0.4.38

Zero-config ESM/TS package builder

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 25.0 KB of source, external domains: bitbucket.org, github.com, gitlab.com

Source & flagged code

2 flagged

package.jsonView file

•name = obuild; similarTo = esbuild

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/_chunks/build.mjsView file

Lines 586-610javascript

586 const outDirs = [];

587 for (const outDir of entries.map((e) => e.outDir).sort()) if (!outDirs.some((dir) => outDir.startsWith(dir))) outDirs.push(outDir);

588 for (const outDir of outDirs) {

589 consola.log(`🧻 Cleaning up \`${fmtPath(outDir)}\``);

590 await rm(outDir, {

591 recursive: true,

592 force: true

593 });

594 }

595 for (const entry of entries) await (entry.type === "bundle" ? rolldownBuild(ctx, entry, hooks) : transformDir(ctx, entry));

596 await hooks.end?.(ctx);

597 if (!entries.every((e) => e.stub)) {

598 const dirSize = analyzeDir(outDirs);

599 consola.log(colors.dim(`\nΣ Total dist byte size: ${colors.underline(prettyBytes(dirSize.size))} (${colors.underline(dirSize.files)} files)`));

600 }

601 consola.log(`\n✅ obuild finished in ${Date.now() - start}ms`);

602}

603function normalizePath(path, resolveFrom) {

604 return typeof path === "string" && isAbsolute(path) ? path : path instanceof URL ? fileURLToPath(path) : resolve(resolveFrom || ".", path || ".");

605}

606function readJSON(specifier) {

607 return import(isAbsolute(specifier) ? pathToFileURL(specifier).href : specifier, { with: { type: "json" } }).then((r) => r.default);

608}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/_chunks/build.mjsView on unpkg · L606

609export { build };

610

Source & flagged code

2 flagged · loading source

package.jsonView file

•name = obuild; similarTo = esbuild

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/_chunks/build.mjsView file

606function readJSON(specifier) { L607: return import(isAbsolute(specifier) ? pathToFileURL(specifier).href : specifier, { with: { type: "json" } }).then((r) => r.default); L608: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/_chunks/build.mjsView on unpkg · L606

Findings

3 Medium3 Low

MediumTyposquat Namepackage.json

MediumDynamic Requiredist/_chunks/build.mjs

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

2 flagged

package.jsonView file

•name = obuild; similarTo = esbuild

Medium

Typosquat Name

Package name is suspiciously similar to a popular package name.

package.jsonView on unpkg

dist/_chunks/build.mjsView file

Lines 586-610javascript

586 const outDirs = [];

587 for (const outDir of entries.map((e) => e.outDir).sort()) if (!outDirs.some((dir) => outDir.startsWith(dir))) outDirs.push(outDir);

588 for (const outDir of outDirs) {

589 consola.log(`🧻 Cleaning up \`${fmtPath(outDir)}\``);

590 await rm(outDir, {

591 recursive: true,

592 force: true

593 });

594 }

595 for (const entry of entries) await (entry.type === "bundle" ? rolldownBuild(ctx, entry, hooks) : transformDir(ctx, entry));

596 await hooks.end?.(ctx);

597 if (!entries.every((e) => e.stub)) {

598 const dirSize = analyzeDir(outDirs);

599 consola.log(colors.dim(`\nΣ Total dist byte size: ${colors.underline(prettyBytes(dirSize.size))} (${colors.underline(dirSize.files)} files)`));

600 }

601 consola.log(`\n✅ obuild finished in ${Date.now() - start}ms`);

602}

603function normalizePath(path, resolveFrom) {

604 return typeof path === "string" && isAbsolute(path) ? path : path instanceof URL ? fileURLToPath(path) : resolve(resolveFrom || ".", path || ".");

605}

606function readJSON(specifier) {

607 return import(isAbsolute(specifier) ? pathToFileURL(specifier).href : specifier, { with: { type: "json" } }).then((r) => r.default);

608}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/_chunks/build.mjsView on unpkg · L606

609export { build };

610