registry / proposal-decimal / 20260710.0.0

proposal-decimal@20260710.0.0

Champion-maintained polyfill for the TC39 decimal proposal

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 135 KB of source

Source & flagged code

2 flagged

benchmark-test-suite.jsView file

Lines 1-50javascript

1#!/usr/bin/env node

3import { execSync } from "child_process";

4import { existsSync, mkdirSync, writeFileSync } from "fs";

High

Child Process

Package source references child process execution.

benchmark-test-suite.jsView on unpkg · L2

6const ITERATIONS = 5;

7const RESULTS_DIR = "./benchmark-results";

9// Ensure results directory exists

10if (!existsSync(RESULTS_DIR)) {

11 mkdirSync(RESULTS_DIR, { recursive: true });

12}

14function getCurrentBranch() {

15 return execSync("git branch --show-current").toString().trim();

16}

18function runBenchmark(branch, iterations = ITERATIONS) {

19 console.log(`\nBenchmarking branch: ${branch}`);

20 console.log("=".repeat(50));

22 // Switch to branch

23 execSync(`git checkout ${branch}`, { stdio: "inherit" });

25 // Clean install dependencies

26 console.log("Installing dependencies...");

27 execSync("npm ci", { stdio: "inherit" });

29 // Compile TypeScript

30 console.log("Compiling TypeScript...");

31 execSync("npx tsc", { stdio: "inherit" });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

benchmark-test-suite.jsView on unpkg · L30

33 const times = [];

35 for (let i = 1; i <= iterations; i++) {

36 console.log(`\nRunning iteration ${i}/${iterations}...`);

38 const startTime = Date.now();

39 try {

40 execSync(

41 "npm test -- --testPathIgnorePatterns='Decimal/constructor\\.test\\.js'",

42 { stdio: "pipe" }

43 );

44 const endTime = Date.now();

45 const duration = (endTime - startTime) / 1000; // Convert to seconds

46 times.push(duration);

47 console.log(`Iteration ${i} completed in ${duration.toFixed(2)}s`);

48 } catch (error) {

49 console.error(`Test failed on iteration ${i}`);

50 throw error;

Source & flagged code

2 flagged · loading source

benchmark-test-suite.jsView file

2L3: import { execSync } from "child_process"; L4: import { existsSync, mkdirSync, writeFileSync } from "fs";

High

Child Process

Package source references child process execution.

benchmark-test-suite.jsView on unpkg · L2

30console.log("Compiling TypeScript..."); L31: execSync("npx tsc", { stdio: "inherit" }); L32:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

benchmark-test-suite.jsView on unpkg · L30

Findings

3 High2 Low

HighChild Processbenchmark-test-suite.js

HighShell

HighRuntime Package Installbenchmark-test-suite.js

LowScripts Present

LowFilesystem

Source & flagged code

2 flagged

benchmark-test-suite.jsView file

Lines 1-50javascript

1#!/usr/bin/env node

3import { execSync } from "child_process";

4import { existsSync, mkdirSync, writeFileSync } from "fs";

High

Child Process

Package source references child process execution.

benchmark-test-suite.jsView on unpkg · L2

6const ITERATIONS = 5;

7const RESULTS_DIR = "./benchmark-results";

9// Ensure results directory exists

10if (!existsSync(RESULTS_DIR)) {

11 mkdirSync(RESULTS_DIR, { recursive: true });

12}

14function getCurrentBranch() {

15 return execSync("git branch --show-current").toString().trim();

16}

18function runBenchmark(branch, iterations = ITERATIONS) {

19 console.log(`\nBenchmarking branch: ${branch}`);

20 console.log("=".repeat(50));

22 // Switch to branch

23 execSync(`git checkout ${branch}`, { stdio: "inherit" });

25 // Clean install dependencies

26 console.log("Installing dependencies...");

27 execSync("npm ci", { stdio: "inherit" });

29 // Compile TypeScript

30 console.log("Compiling TypeScript...");

31 execSync("npx tsc", { stdio: "inherit" });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

benchmark-test-suite.jsView on unpkg · L30

33 const times = [];

35 for (let i = 1; i <= iterations; i++) {

36 console.log(`\nRunning iteration ${i}/${iterations}...`);

38 const startTime = Date.now();

39 try {

40 execSync(

41 "npm test -- --testPathIgnorePatterns='Decimal/constructor\\.test\\.js'",

42 { stdio: "pipe" }

43 );

44 const endTime = Date.now();

45 const duration = (endTime - startTime) / 1000; // Convert to seconds

46 times.push(duration);

47 console.log(`Iteration ${i} completed in ${duration.toFixed(2)}s`);

48 } catch (error) {

49 console.error(`Test failed on iteration ${i}`);

50 throw error;