registry / stormfetch / 1.11.0

stormfetch@1.11.0

A typed HTTP client for React, React Native, Expo, browsers, Node.js, and SSR.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireEvalNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 377 KB of source, external domains: api.example.com, evil.example.com, stormfetch.local

Source & flagged code

3 flagged

dist/esm/chunk-ZZR2TLI7.jsView file

Lines 53-93javascript

53var isReactNative = () => {

54 const runtime = globalThis;

55 return runtime.navigator?.product === "ReactNative" || !isBrowser() && (runtime.__fbBatchedBridge !== void 0 || runtime.nativeCallSyncHook !== void 0 || runtime.__turboModuleProxy !== void 0);

56};

57var isNodeLike = () => typeof process !== "undefined" && !!process?.versions?.node && !isBrowser() && !isReactNative();

58var isDeno = () => typeof globalThis.Deno !== "undefined" && !isBrowser() && !isReactNative();

59var isBun = () => typeof globalThis.Bun !== "undefined" && !isBrowser() && !isReactNative();

60var getRuntimeInfo = () => {

61 const browser = isBrowser();

62 const reactNative = isReactNative();

63 const deno = isDeno();

64 const bun = isBun();

65 const node = isNodeLike();

66 return {

67 runtime: reactNative ? "react-native" : browser ? "browser" : deno ? "deno" : bun ? "bun" : node ? "node" : "unknown",

68 isBrowser: browser,

69 isReactNative: reactNative,

70 isNode: node,

71 isDeno: deno,

72 isBun: bun,

73 hasFetch: typeof globalThis.fetch === "function",

74 hasXHR: typeof XMLHttpRequest !== "undefined",

75 hasFormData: typeof FormData !== "undefined",

76 hasBlob: typeof Blob !== "undefined"

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/esm/chunk-ZZR2TLI7.jsView on unpkg · L73

77 };

78};

79var readCookie = (name) => {

80 if (!isBrowser()) return void 0;

81 const encodedName = encodeURIComponent(name);

82 const pairs = document.cookie ? document.cookie.split("; ") : [];

83 for (const pair of pairs) {

84 const index = pair.indexOf("=");

85 const key = index >= 0 ? pair.slice(0, index) : pair;

86 if (key === encodedName || key === name) {

87 return decodeURIComponent(index >= 0 ? pair.slice(index + 1) : "");

88 }

89 }

90 return void 0;

91};

92var encodeBasicAuth = (username, password) => {

93 const value = `${username}:${password}`;

Lines 356-396javascript

356 const abort = !timeout && (signal.aborted || config.signal?.aborted || isAbortError(cause));

357 const known = cause && typeof cause === "object" && cause.name === "StormFetchError";

358 if (known) {

Source & flagged code

3 flagged · loading source

dist/esm/chunk-ZZR2TLI7.jsView file

73hasFetch: typeof globalThis.fetch === "function", L74: hasXHR: typeof XMLHttpRequest !== "undefined", L75: hasFormData: typeof FormData !== "undefined", L76: hasBlob: typeof Blob !== "undefined" ... L97: const BufferCtor = globalThis.Buffer; L98: return BufferCtor ? BufferCtor.from(value).toString("base64") : value; L99: }; ... L376: // [redacted].ts L377: var dynamicImport = (specifier) => new Function("specifier", "return import(specifier)")(specifier); L378: var toArrayBuffer = (buffer) => new Uint8Array(buffer).buffer; ... L2518: } L2519: if (security.allowPrivateNetwork !== true && this.isPrivateNetworkHost(parsed.hostname)) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/esm/chunk-ZZR2TLI7.jsView on unpkg · L73

376// [redacted].ts L377: var dynamicImport = (specifier) => new Function("specifier", "return import(specifier)")(specifier); L378: var toArrayBuffer = (buffer) => new Uint8Array(buffer).buffer;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/esm/chunk-ZZR2TLI7.jsView on unpkg · L376

376// [redacted].ts L377: var dynamicImport = (specifier) => new Function("specifier", "return import(specifier)")(specifier); L378: var toArrayBuffer = (buffer) => new Uint8Array(buffer).buffer;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/esm/chunk-ZZR2TLI7.jsView on unpkg · L376

Findings

1 High3 Medium5 Low

HighCloud Metadata Accessdist/esm/chunk-ZZR2TLI7.js

MediumDynamic Requiredist/esm/chunk-ZZR2TLI7.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/esm/chunk-ZZR2TLI7.js

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/esm/chunk-ZZR2TLI7.jsView file

Lines 53-93javascript

53var isReactNative = () => {

54 const runtime = globalThis;

55 return runtime.navigator?.product === "ReactNative" || !isBrowser() && (runtime.__fbBatchedBridge !== void 0 || runtime.nativeCallSyncHook !== void 0 || runtime.__turboModuleProxy !== void 0);

56};

57var isNodeLike = () => typeof process !== "undefined" && !!process?.versions?.node && !isBrowser() && !isReactNative();

58var isDeno = () => typeof globalThis.Deno !== "undefined" && !isBrowser() && !isReactNative();

59var isBun = () => typeof globalThis.Bun !== "undefined" && !isBrowser() && !isReactNative();

60var getRuntimeInfo = () => {

61 const browser = isBrowser();

62 const reactNative = isReactNative();

63 const deno = isDeno();

64 const bun = isBun();

65 const node = isNodeLike();

66 return {

67 runtime: reactNative ? "react-native" : browser ? "browser" : deno ? "deno" : bun ? "bun" : node ? "node" : "unknown",

68 isBrowser: browser,

69 isReactNative: reactNative,

70 isNode: node,

71 isDeno: deno,

72 isBun: bun,

73 hasFetch: typeof globalThis.fetch === "function",

74 hasXHR: typeof XMLHttpRequest !== "undefined",

75 hasFormData: typeof FormData !== "undefined",

76 hasBlob: typeof Blob !== "undefined"

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/esm/chunk-ZZR2TLI7.jsView on unpkg · L73

77 };

78};

79var readCookie = (name) => {

80 if (!isBrowser()) return void 0;

81 const encodedName = encodeURIComponent(name);

82 const pairs = document.cookie ? document.cookie.split("; ") : [];

83 for (const pair of pairs) {

84 const index = pair.indexOf("=");

85 const key = index >= 0 ? pair.slice(0, index) : pair;

86 if (key === encodedName || key === name) {

87 return decodeURIComponent(index >= 0 ? pair.slice(index + 1) : "");

88 }

89 }

90 return void 0;

91};

92var encodeBasicAuth = (username, password) => {

93 const value = `${username}:${password}`;

Lines 356-396javascript

356 const abort = !timeout && (signal.aborted || config.signal?.aborted || isAbortError(cause));

357 const known = cause && typeof cause === "object" && cause.name === "StormFetchError";

358 if (known) {