registry / rollup-runtime-polyfill-core / 0.14.0

rollup-runtime-polyfill-core@0.14.0

rollup-runtime-polyfill-core ===

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 1.00 MB of source, external domains: bevry.me, bit.ly, blog.axqd.net, blog.izs.me, bugzilla.mozilla.org, code.google.com, codereview.chromium.org, developer.mozilla.org, dominictarr.com, dustindiaz.com, en.wikipedia.org, example.com, feross.org, foo.com, github.com, goo.gl, jensarps.de, jryans.mit-license.org, juliangruber.com, macinn.es, mathiasbynens.be, msdn.microsoft.com, mths.be, n8.io, narwhaljs.org, nodejs.org, onirame.com, paul.vorba.ch, spdx.org, stackoverflow.com, stagas.com, substack.net, tools.ietf.org, twitter.com, wiki.commonjs.org, www.blakeminer.com, www.example.com, www.w3.org, www.whatwg.org, yabfog.com

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-22javascript

1'use strict';

3const inject = require('@rollup/plugin-inject');

4const modules = require('./modules.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L2

5const path = require('path');

6const crypto = require('crypto');

7const polyfills = require('./polyfills.js');

9// Node import paths use POSIX separators

10const { dirname, relative, join } = path.posix;

11const PREFIX = `\0polyfill-node.`;

12const PREFIX_LENGTH = PREFIX.length;

13function index (opts = {}) {

14 const mods = modules.getModules();

15 const injectPlugin = inject({

16 include: opts.include === undefined ? ['node_modules/**/*.js'] : opts.include,

17 exclude: opts.exclude,

18 sourceMap: opts.sourceMap,

19 modules: {

20 process: PREFIX + "process",

21 Buffer: [PREFIX + "buffer", "Buffer"],

22 global: PREFIX + 'global',

Lines 63-103javascript

63 }

64 if (id.startsWith(PREFIX)) {

65 const importee = id.substr(PREFIX_LENGTH).replace('.js', '');

66 return mods.get(importee) || polyfills[importee + '.js'];

67 }

dist/polyfills.jsView file

Lines 1-6javascript

1'use strict';

3const POLYFILLS = { "__http-lib/capability.js": "export var hasFetch = isFunction(global.fetch) && isFunction(global.ReadableStream)\n\nvar _blobConstructor;\nexport function blobConstructor() {\n if (typeof _blobConstructor !== 'undefined') {\n return _blobConstructor;\n }\n try {\n new global.Blob([new ArrayBuffer(1)])\n _blobConstructor = true\n } catch (e) {\n _blobConstructor = false\n

Source & flagged code

4 flagged · loading source

dist/index.jsView file

83L84: const { spawn } = require('child_process'); L85:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L83

2L3: const inject = require('@rollup/plugin-inject'); L4: const modules = require('./modules.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L2

dist/polyfills.jsView file

2L3: const POLYFILLS = { "__http-lib/capability.js": "export var hasFetch = isFunction(global.fetch) && isFunction(global.ReadableStream)\n\nvar _blobConstructor;\nexport function blobC... L4:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/polyfills.jsView on unpkg · L2

2L3: const POLYFILLS = { "__http-lib/capability.js": "export var hasFetch = isFunction(global.fetch) && isFunction(global.ReadableStream)\n\nvar _blobConstructor;\nexport function blobC... L4:

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/polyfills.jsView on unpkg · L2

Findings

2 High5 Medium5 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/polyfills.js

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/polyfills.js

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-22javascript

1'use strict';

3const inject = require('@rollup/plugin-inject');

4const modules = require('./modules.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L2

5const path = require('path');

6const crypto = require('crypto');

7const polyfills = require('./polyfills.js');

9// Node import paths use POSIX separators

10const { dirname, relative, join } = path.posix;

11const PREFIX = `\0polyfill-node.`;

12const PREFIX_LENGTH = PREFIX.length;

13function index (opts = {}) {

14 const mods = modules.getModules();

15 const injectPlugin = inject({

16 include: opts.include === undefined ? ['node_modules/**/*.js'] : opts.include,

17 exclude: opts.exclude,

18 sourceMap: opts.sourceMap,

19 modules: {

20 process: PREFIX + "process",

21 Buffer: [PREFIX + "buffer", "Buffer"],

22 global: PREFIX + 'global',

Lines 63-103javascript

63 }

64 if (id.startsWith(PREFIX)) {

65 const importee = id.substr(PREFIX_LENGTH).replace('.js', '');

66 return mods.get(importee) || polyfills[importee + '.js'];

67 }

dist/polyfills.jsView file

Lines 1-6javascript

1'use strict';