registry / stormfetch / 1.10.0

stormfetch@1.10.0

A typed HTTP client for React, React Native, Expo, browsers, Node.js, and SSR.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireEvalNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 366 KB of source, external domains: api.example.com, evil.example.com, stormfetch.local

Source & flagged code

3 flagged

dist/esm/chunk-YN3G27XC.jsView file

Lines 49-89javascript

49var isReactNative = () => {

50 const runtime = globalThis;

51 return runtime.navigator?.product === "ReactNative" || !isBrowser() && (runtime.__fbBatchedBridge !== void 0 || runtime.nativeCallSyncHook !== void 0 || runtime.__turboModuleProxy !== void 0);

52};

53var isNodeLike = () => typeof process !== "undefined" && !!process?.versions?.node && !isBrowser() && !isReactNative();

54var isDeno = () => typeof globalThis.Deno !== "undefined" && !isBrowser() && !isReactNative();

55var isBun = () => typeof globalThis.Bun !== "undefined" && !isBrowser() && !isReactNative();

56var getRuntimeInfo = () => {

57 const browser = isBrowser();

58 const reactNative = isReactNative();

59 const deno = isDeno();

60 const bun = isBun();

61 const node = isNodeLike();

62 return {

63 runtime: reactNative ? "react-native" : browser ? "browser" : deno ? "deno" : bun ? "bun" : node ? "node" : "unknown",

64 isBrowser: browser,

65 isReactNative: reactNative,

66 isNode: node,

67 isDeno: deno,

68 isBun: bun,

69 hasFetch: typeof globalThis.fetch === "function",

70 hasXHR: typeof XMLHttpRequest !== "undefined",

71 hasFormData: typeof FormData !== "undefined",

72 hasBlob: typeof Blob !== "undefined"

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/esm/chunk-YN3G27XC.jsView on unpkg · L69

73 };

74};

75var readCookie = (name) => {

76 if (!isBrowser()) return void 0;

77 const encodedName = encodeURIComponent(name);

78 const pairs = document.cookie ? document.cookie.split("; ") : [];

79 for (const pair of pairs) {

80 const index = pair.indexOf("=");

81 const key = index >= 0 ? pair.slice(0, index) : pair;

82 if (key === encodedName || key === name) {

83 return decodeURIComponent(index >= 0 ? pair.slice(index + 1) : "");

84 }

85 }

86 return void 0;

87};

88var encodeBasicAuth = (username, password) => {

89 const value = `${username}:${password}`;

Lines 304-344javascript

304 const abort = isAbortError(cause);

305 const known = cause && typeof cause === "object" && cause.name === "StormFetchError";

306 if (known) {

307 throw cause;

308 }

Source & flagged code

3 flagged · loading source

dist/esm/chunk-YN3G27XC.jsView file

69hasFetch: typeof globalThis.fetch === "function", L70: hasXHR: typeof XMLHttpRequest !== "undefined", L71: hasFormData: typeof FormData !== "undefined", L72: hasBlob: typeof Blob !== "undefined" ... L93: const BufferCtor = globalThis.Buffer; L94: return BufferCtor ? BufferCtor.from(value).toString("base64") : value; L95: }; ... L324: // [redacted].ts L325: var dynamicImport = (specifier) => new Function("specifier", "return import(specifier)")(specifier); L326: var toArrayBuffer = (buffer) => new Uint8Array(buffer).buffer; ... L2419: } L2420: if (security.allowPrivateNetwork !== true && this.isPrivateNetworkHost(parsed.hostname)) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/esm/chunk-YN3G27XC.jsView on unpkg · L69

324// [redacted].ts L325: var dynamicImport = (specifier) => new Function("specifier", "return import(specifier)")(specifier); L326: var toArrayBuffer = (buffer) => new Uint8Array(buffer).buffer;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/esm/chunk-YN3G27XC.jsView on unpkg · L324

324// [redacted].ts L325: var dynamicImport = (specifier) => new Function("specifier", "return import(specifier)")(specifier); L326: var toArrayBuffer = (buffer) => new Uint8Array(buffer).buffer;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/esm/chunk-YN3G27XC.jsView on unpkg · L324

Findings

1 High3 Medium5 Low

HighCloud Metadata Accessdist/esm/chunk-YN3G27XC.js

MediumDynamic Requiredist/esm/chunk-YN3G27XC.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/esm/chunk-YN3G27XC.js

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/esm/chunk-YN3G27XC.jsView file

Lines 49-89javascript

49var isReactNative = () => {

50 const runtime = globalThis;

51 return runtime.navigator?.product === "ReactNative" || !isBrowser() && (runtime.__fbBatchedBridge !== void 0 || runtime.nativeCallSyncHook !== void 0 || runtime.__turboModuleProxy !== void 0);

52};

53var isNodeLike = () => typeof process !== "undefined" && !!process?.versions?.node && !isBrowser() && !isReactNative();

54var isDeno = () => typeof globalThis.Deno !== "undefined" && !isBrowser() && !isReactNative();

55var isBun = () => typeof globalThis.Bun !== "undefined" && !isBrowser() && !isReactNative();

56var getRuntimeInfo = () => {

57 const browser = isBrowser();

58 const reactNative = isReactNative();

59 const deno = isDeno();

60 const bun = isBun();

61 const node = isNodeLike();

62 return {

63 runtime: reactNative ? "react-native" : browser ? "browser" : deno ? "deno" : bun ? "bun" : node ? "node" : "unknown",

64 isBrowser: browser,

65 isReactNative: reactNative,

66 isNode: node,

67 isDeno: deno,

68 isBun: bun,

69 hasFetch: typeof globalThis.fetch === "function",

70 hasXHR: typeof XMLHttpRequest !== "undefined",

71 hasFormData: typeof FormData !== "undefined",

72 hasBlob: typeof Blob !== "undefined"

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/esm/chunk-YN3G27XC.jsView on unpkg · L69

73 };

74};

75var readCookie = (name) => {

76 if (!isBrowser()) return void 0;

77 const encodedName = encodeURIComponent(name);

78 const pairs = document.cookie ? document.cookie.split("; ") : [];

79 for (const pair of pairs) {

80 const index = pair.indexOf("=");

81 const key = index >= 0 ? pair.slice(0, index) : pair;

82 if (key === encodedName || key === name) {

83 return decodeURIComponent(index >= 0 ? pair.slice(index + 1) : "");

84 }

85 }

86 return void 0;

87};

88var encodeBasicAuth = (username, password) => {

89 const value = `${username}:${password}`;

Lines 304-344javascript

304 const abort = isAbortError(cause);

305 const known = cause && typeof cause === "object" && cause.name === "StormFetchError";

306 if (known) {

307 throw cause;

308 }