registry / stormfetch / 1.13.0

stormfetch@1.13.0

A typed HTTP client for React, React Native, Expo, browsers, Node.js, and SSR.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireEvalNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 450 KB of source, external domains: 127.0.0.1, api.example.com, evil.example.com, stormfetch.local

Source & flagged code

3 flagged

dist/esm/chunk-3XRNVBXY.jsView file

Lines 63-103javascript

63 isNetworkError,

64 isTimeoutError,

65 isAbortError: isAbortError2

66}) => {

67 if (isAbortError2) return "ERR_CANCELED";

68 if (isTimeoutError) return "ERR_TIMEOUT";

69 if (isNetworkError) return "ERR_NETWORK";

70 if (status !== void 0) return status >= 400 ? "ERR_BAD_RESPONSE" : void 0;

71 return void 0;

72};

73var redactHeaders = (headers) => {

74 if (!headers) return void 0;

75 const output = {};

76 const source = headers instanceof Headers ? Array.from(headers.entries()) : Object.entries(headers);

77 source.forEach(([key, value]) => {

79 });

80 return output;

81};

82var redactUrl = (value) => {

83 try {

84 const url = new URL(value, "http://stormfetch.local");

85 url.username = url.username ? "[redacted]" : "";

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/esm/chunk-3XRNVBXY.jsView on unpkg · L83

86 url.password = url.password ? "[redacted]" : "";

87 for (const key of Array.from(url.searchParams.keys())) {

89 }

90 return url.hostname === "stormfetch.local" ? `${url.pathname}${url.search}${url.hash}` : url.toString();

91 } catch {

92 return value.replace(/(token|secret|password|key|auth)=([^&\s]+)/gi, "$1=[redacted]");

93 }

94};

95var isStormFetchError = (error) => Boolean(error && typeof error === "object" && error.isStormFetchError === true);

96var isAbortError = (error) => {

97 if (!error || typeof error !== "object") return false;

98 const record = error;

99 return record.name === "AbortError" || record.code === "ABORT_ERR" || record.message === "Request aborted" || record.message === "This operation was aborted";

100};

101

102// src/lib/stormfetch/core/utils.ts

103var DEFAULT_TIMEOUT = 3e4;

Lines 514-554javascript

514 if (known) {

515 throw cause;

516 }

517 throw createStormFetchError({

518 message: timeout ? config.timeoutErrorMessage ?? "Request timed out" : abort ? "Request aborted" : "Network request failed",

519 code: timeout ? "ERR_TIMEOUT"

Source & flagged code

3 flagged · loading source

dist/esm/chunk-3XRNVBXY.jsView file

83try { L84: const url = new URL(value, "http://stormfetch.local"); L85: url.username = url.username ? "[redacted]" : ""; ... L136: hasXHR: typeof XMLHttpRequest !== "undefined", L137: hasFormData: typeof FormData !== "undefined", L138: hasBlob: typeof Blob !== "undefined" ... L159: const BufferCtor = globalThis.Buffer; L160: return BufferCtor ? BufferCtor.from(value).toString("base64") : value; L161: }; ... L534: // [redacted].ts L535: var dynamicImport = (specifier) => new Function("specifier", "return import(specifier)")(specifier); L536: var toArrayBuffer = (buffer) => new Uint8Array(buffer).buffer;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/esm/chunk-3XRNVBXY.jsView on unpkg · L83

534// [redacted].ts L535: var dynamicImport = (specifier) => new Function("specifier", "return import(specifier)")(specifier); L536: var toArrayBuffer = (buffer) => new Uint8Array(buffer).buffer;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/esm/chunk-3XRNVBXY.jsView on unpkg · L534

534// [redacted].ts L535: var dynamicImport = (specifier) => new Function("specifier", "return import(specifier)")(specifier); L536: var toArrayBuffer = (buffer) => new Uint8Array(buffer).buffer;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/esm/chunk-3XRNVBXY.jsView on unpkg · L534

Findings

1 High3 Medium5 Low

HighCloud Metadata Accessdist/esm/chunk-3XRNVBXY.js

MediumDynamic Requiredist/esm/chunk-3XRNVBXY.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/esm/chunk-3XRNVBXY.js

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/esm/chunk-3XRNVBXY.jsView file

Lines 63-103javascript

63 isNetworkError,

64 isTimeoutError,

65 isAbortError: isAbortError2

66}) => {

67 if (isAbortError2) return "ERR_CANCELED";

68 if (isTimeoutError) return "ERR_TIMEOUT";

69 if (isNetworkError) return "ERR_NETWORK";

70 if (status !== void 0) return status >= 400 ? "ERR_BAD_RESPONSE" : void 0;

71 return void 0;

72};

73var redactHeaders = (headers) => {

74 if (!headers) return void 0;

75 const output = {};

76 const source = headers instanceof Headers ? Array.from(headers.entries()) : Object.entries(headers);

77 source.forEach(([key, value]) => {

79 });

80 return output;

81};

82var redactUrl = (value) => {

83 try {

84 const url = new URL(value, "http://stormfetch.local");

85 url.username = url.username ? "[redacted]" : "";

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/esm/chunk-3XRNVBXY.jsView on unpkg · L83

86 url.password = url.password ? "[redacted]" : "";

87 for (const key of Array.from(url.searchParams.keys())) {

89 }

90 return url.hostname === "stormfetch.local" ? `${url.pathname}${url.search}${url.hash}` : url.toString();

91 } catch {

92 return value.replace(/(token|secret|password|key|auth)=([^&\s]+)/gi, "$1=[redacted]");

93 }

94};

95var isStormFetchError = (error) => Boolean(error && typeof error === "object" && error.isStormFetchError === true);

96var isAbortError = (error) => {

97 if (!error || typeof error !== "object") return false;

98 const record = error;

99 return record.name === "AbortError" || record.code === "ABORT_ERR" || record.message === "Request aborted" || record.message === "This operation was aborted";

100};

101

102// src/lib/stormfetch/core/utils.ts

103var DEFAULT_TIMEOUT = 3e4;

Lines 514-554javascript

514 if (known) {

515 throw cause;

516 }

517 throw createStormFetchError({

518 message: timeout ? config.timeoutErrorMessage ?? "Request timed out" : abort ? "Request aborted" : "Network request failed",

519 code: timeout ? "ERR_TIMEOUT"