npm / @emnapi/runtime / 2.0.0-beta.2

@emnapi/runtime 2.0.0-beta.2

Source

https://github.com/toyobayashi/emnapi

Tag scanned

v2.0.0-beta.2

Directory

packages/runtime (only this part of the repository was scanned)

Compared with

v2.0.0-beta.1 (0 signals introduced since)

Files

32 scanned, 3 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

3.0 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-15 03:42

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review dynamic-execution packages/runtime/src/util.ts:124:30

   `Function(...)` called with a non-literal body (ast pass, confidence 0.75)

       makeDynamicFunction: (supportNewFunction
         ? (...args: any[]) => (new Function(...args))
         : undefined),
       setFunctionName: (canSetFunctionName

   likely benign LLM, confidence 0.80 A feature-gated factory that wraps the Function constructor for dynamic function creation.

   Reasoning

   The snippet shows a feature-detected factory: new Function(...args) is only exposed when supportNewFunction is true, otherwise undefined. This is a known pattern in libraries like the expression/evaluation helper ecosystem (e.g., jsep/mathjs-style or ajv-style code generation) where dynamic function construction is a deliberate, opt-in capability. It is still dynamic code execution, so it warrants review, but the snippet shows no obfuscation, encoding, or hidden payload, and the caller controls the body.

2. info warn → info by review dynamic-import packages/runtime/test/index.js:31:23

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

   assert.match(cjsEntry.pathname, /index\.cjs$/, 'require condition must resolve to index.cjs')
   const nsOfCjs = await import(cjsEntry)
   // 'default' and 'module.exports' are Node's own CJS-ESM interop keys added to
   // import()ed CJS namespaces (not exports of the facade); drop them before the

   likely benign LLM, confidence 0.85 A test importing the package's own CJS entry point via dynamic import to inspect the interop namespace.

   Reasoning

   This is a test file checking dual CJS/ESM packaging. The dynamic import of cjsEntry is used to verify how Node's CJS-ESM interop exposes the namespace, and the comments explain the 'default' and 'module.exports' keys. The specifier is a locally computed URL/path to the package's own entry point, not attacker-controlled input, and there is no encoding or hidden behavior.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/toyobayashi/emnapi emnapi && cd emnapi
git checkout v2.0.0-beta.2
disclude scan --severity info --diff v2.0.0-beta.1 packages/runtime