registry / rastack / 0.0.22

rastack@0.0.22

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 105 file(s), 343 KB of source, external domains: 127.0.0.1

Source & flagged code

2 flagged

provider/wasm.tsView file

Lines 1-32typescript

1import { AxiosAdapter, AxiosError, AxiosResponse } from "axios";

2import { RadEngine, RadEngineLoader, RadWasmModule } from "./types";

4/**

5 * Default WASM loader: import the bundle `rad wasm` generates

6 * (`rastack/wasm/rad_wasm.js`) and run its init. The indirection through

7 * `new Function` keeps a genuine dynamic `import()` at runtime even when the

8 * package is transpiled to CommonJS, so the consumer's bundler resolves and

9 * code-splits the `.wasm`.

10 */

11const runtimeImport: (specifier: string) => Promise<any> =

12 // eslint-disable-next-line no-new-func

13 new Function("s", "return import(s)") as any;

Low

Eval

Package source references a known benign dynamic code generation pattern.

provider/wasm.tsView on unpkg · L12

15export const defaultEngineLoader: RadEngineLoader = async () => {

16 const mod: RadWasmModule = await runtimeImport("rastack/wasm/rad_wasm.js");

17 const init = mod.default || mod.init;

18 if (typeof init === "function") {

19 await init();

20 }

21 return mod;

22};

24/**

25 * Instantiate the engine from a loaded module and the compiled schema. The

26 * manifest/openapi are passed as JSON strings — the same `schema.rad.json` /

27 * `openapi.json` the Rust server reads.

28 */

29export function createEngine(

30 mod: RadWasmModule,

31 manifest: object | string,

32 openapi?: object | string,

dist/rad-wasm-build.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2"use strict";

3/**

4 * `rad wasm` — compile the Rust API to WebAssembly for in-browser local dev.

5 *

6 * Pipeline:

7 * 1. cargo build -p rad-wasm --release --target wasm32-unknown-unknown

8 * 2. wasm-bindgen --target web → stack/wasm/rad_wasm.js + rad_wasm_bg.wasm

9 * 3. wasm-opt -Oz (if available) to shrink the binary

10 *

11 * The generated bundle is what `<RAStackProvider mode="local">` loads. Prereqs:

Source & flagged code

2 flagged · loading source

provider/wasm.tsView file

12// eslint-disable-next-line no-new-func L13: new Function("s", "return import(s)") as any; L14:

Low

Eval

Package source references a known benign dynamic code generation pattern.

provider/wasm.tsView on unpkg · L12

dist/rad-wasm-build.jsView file

18Object.defineProperty(exports, "__esModule", { value: true }); L19: const child_process_1 = require("child_process"); L20: const fs_1 = __importDefault(require("fs"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/rad-wasm-build.jsView on unpkg · L18

Findings

3 Medium4 Low

MediumDynamic Requiredist/rad-wasm-build.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvalprovider/wasm.ts

LowFilesystem

LowUrl Strings

Source & flagged code

2 flagged

provider/wasm.tsView file

Lines 1-32typescript

1import { AxiosAdapter, AxiosError, AxiosResponse } from "axios";

2import { RadEngine, RadEngineLoader, RadWasmModule } from "./types";

4/**

5 * Default WASM loader: import the bundle `rad wasm` generates

6 * (`rastack/wasm/rad_wasm.js`) and run its init. The indirection through

7 * `new Function` keeps a genuine dynamic `import()` at runtime even when the

8 * package is transpiled to CommonJS, so the consumer's bundler resolves and

9 * code-splits the `.wasm`.

10 */

11const runtimeImport: (specifier: string) => Promise<any> =

12 // eslint-disable-next-line no-new-func

13 new Function("s", "return import(s)") as any;

Low

Eval

Package source references a known benign dynamic code generation pattern.

provider/wasm.tsView on unpkg · L12

15export const defaultEngineLoader: RadEngineLoader = async () => {

16 const mod: RadWasmModule = await runtimeImport("rastack/wasm/rad_wasm.js");

17 const init = mod.default || mod.init;

18 if (typeof init === "function") {

19 await init();

20 }

21 return mod;

22};

24/**

25 * Instantiate the engine from a loaded module and the compiled schema. The

26 * manifest/openapi are passed as JSON strings — the same `schema.rad.json` /

27 * `openapi.json` the Rust server reads.

28 */

29export function createEngine(

30 mod: RadWasmModule,

31 manifest: object | string,

32 openapi?: object | string,

dist/rad-wasm-build.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2"use strict";

3/**

4 * `rad wasm` — compile the Rust API to WebAssembly for in-browser local dev.

5 *

6 * Pipeline:

7 * 1. cargo build -p rad-wasm --release --target wasm32-unknown-unknown

8 * 2. wasm-bindgen --target web → stack/wasm/rad_wasm.js + rad_wasm_bg.wasm

9 * 3. wasm-opt -Oz (if available) to shrink the binary

10 *

11 * The generated bundle is what `<RAStackProvider mode="local">` loads. Prereqs: