registry / workerd / 1.20260704.1

workerd@1.20260704.1

👷 workerd, Cloudflare's JavaScript/Wasm Runtime

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 271 KB of source, external domains: registry.npmjs.org, www.apache.org, yarnpkg.com

Oversized source lightweight scan

worker.mjs4.53 MB file, sampled 256 KB

FilesystemNetworkChildProcessHighEntropyStringsMinifiedUrlStringswww.apache.org

Source & flagged code

5 flagged

package.jsonView file

Lines 1-25json

2 "name": "workerd",

3 "version": "1.20260704.1",

4 "description": "👷 workerd, Cloudflare's JavaScript/Wasm Runtime",

5 "repository": "https://github.com/cloudflare/workerd",

6 "scripts": {

7 "postinstall": "node install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L7

8 },

9 "main": "lib/main.js",

10 "engines": {

11 "node": ">=16"

12 },

13 "bin": {

14 "workerd": "bin/workerd"

15 },

16 "optionalDependencies": {

17 "@cloudflare/workerd-darwin-arm64": "1.20260704.1",

18 "@cloudflare/workerd-darwin-64": "1.20260704.1",

19 "@cloudflare/workerd-linux-arm64": "1.20260704.1",

20 "@cloudflare/workerd-linux-64": "1.20260704.1",

21 "@cloudflare/workerd-windows-64": "1.20260704.1"

22 },

23 "license": "Apache-2.0"

24}

install.jsView file

Lines 37-77javascript

37 let subpath;

38 let platformKey = `${process.platform} ${import_os.default.arch()} ${import_os.default.endianness()}`;

39 if (platformKey in knownPackages) {

40 pkg =

worker.mjsView file

•path = worker.mjs kind = oversized_source_file sizeBytes = 4747010 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

worker.mjsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.jsView file

57var import_https = __toESM(require("https")); L58: var import_child_process = __toESM(require("child_process")); L59: var toPath = import_path2.default.join(__dirname, "bin", "workerd");

High

Child Process

Package source references child process execution.

install.jsView on unpkg · L57

153import_fs.default.writeFileSync(import_path2.default.join(installDir, "package.json"), "{}"); L154: import_child_process.default.execSync( L155: `npm install --loglevel=error --prefer-offline --no-audit --progress=false ${pkg}@${"1.20260704.1"}`, L156: { cwd: installDir, stdio: "pipe", env }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

install.jsView on unpkg · L153

worker.mjsView file

•path = worker.mjs kind = oversized_source_file sizeBytes = 4747010 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

worker.mjsView on unpkg

Findings

4 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processinstall.js

HighRuntime Package Installinstall.js

HighOversized Source Fileworker.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

package.jsonView file

Lines 1-25json

2 "name": "workerd",

3 "version": "1.20260704.1",

4 "description": "👷 workerd, Cloudflare's JavaScript/Wasm Runtime",

5 "repository": "https://github.com/cloudflare/workerd",

6 "scripts": {

7 "postinstall": "node install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L7

8 },

9 "main": "lib/main.js",

10 "engines": {

11 "node": ">=16"

12 },

13 "bin": {

14 "workerd": "bin/workerd"

15 },

16 "optionalDependencies": {

17 "@cloudflare/workerd-darwin-arm64": "1.20260704.1",

18 "@cloudflare/workerd-darwin-64": "1.20260704.1",

19 "@cloudflare/workerd-linux-arm64": "1.20260704.1",

20 "@cloudflare/workerd-linux-64": "1.20260704.1",

21 "@cloudflare/workerd-windows-64": "1.20260704.1"

22 },

23 "license": "Apache-2.0"

24}

install.jsView file

Lines 37-77javascript

37 let subpath;

38 let platformKey = `${process.platform} ${import_os.default.arch()} ${import_os.default.endianness()}`;

39 if (platformKey in knownPackages) {

40 pkg =

worker.mjsView file

•path = worker.mjs kind = oversized_source_file sizeBytes = 4747010 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

worker.mjsView on unpkg

Lines 133-173javascript

133 let str = (i, n) => String.fromCharCode(...buffer.subarray(i, i + n)).replace(/\0.*$/, "");

134 let offset = 0;

135 subpath = `package/${subpath}`;

136 while (offset < buffer.length) {

137 let name = str(offset, 100);

138 let size = parseInt(str(offset + 124, 12), 8);

139 offset += 512;

140 if (!isNaN(size)) {

141 if (name === subpath) return buffer.subarray(offset, offset + size);

142 offset += size + 511 & ~511;

143 }

144 }

145 throw new Error(`Could not find ${JSON.stringify(subpath)} in archive`);

146}

147function installUsingNPM(pkg, subpath, binPath) {

148 const env = { ...process.env, npm_config_global: void 0 };

149 const libDir = import_path2.default.dirname(require.resolve("workerd"));

150 const installDir = import_path2.default.join(libDir, "npm-install");

151 import_fs.default.mkdirSync(installDir);

152 try {

153 import_fs.default.writeFileSync(import_path2.default.join(installDir, "package.json"), "{}");

154 import_child_process.default.execSync(

155 `npm install --loglevel=error --prefer-offline --no-audit --progress=false ${pkg}@${"1.20260704.1"}`,

156 { cwd: installDir, stdio: "pipe", env }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

install.jsView on unpkg · L153

157 );

158 const installedBinPath = import_path2.default.join(

159 installDir,

160 "node_modules",

161 pkg,

162 subpath

163 );

164 import_fs.default.renameSync(installedBinPath, binPath);

165 } finally {

166 try {

167 removeRecursive(installDir);

168 } catch {

169 }

170 }

171}

172function removeRecursive(dir) {

173 for (const entry of import_fs.default.readdirSync(dir)) {