npm / @emnapi/runtime / 2.0.0-beta.2

@emnapi/runtime 2.0.0-beta.2

Source

https://github.com/toyobayashi/emnapi

Tag scanned

v2.0.0-beta.2

Directory

packages/runtime (only this part of the repository was scanned)

Compared with

v2.0.0-beta.1 (0 signals introduced since)

Files

32 scanned, 3 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

3.1 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 21:18

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review dynamic-execution packages/runtime/src/util.ts:124:30

   `Function(...)` called with a non-literal body (ast pass, confidence 0.75)

       makeDynamicFunction: (supportNewFunction
         ? (...args: any[]) => (new Function(...args))
         : undefined),
       setFunctionName: (canSetFunctionName

   likely benign LLM, confidence 0.80 A feature-gated wrapper that exposes new Function(...args) as makeDynamicFunction in a utility module.

   Reasoning

   The snippet shows new Function(...args) gated behind a feature check (supportNewFunction), a pattern common in libraries like lodash/ajv-style code that generate functions for performance when CSP allows. It is a real dynamic-execution sink, but the code is a conditional capability shim rather than hidden payload delivery, and the args are caller-supplied rather than decoded from an obfuscated blob.

2. info warn → info by review dynamic-import packages/runtime/test/index.js:31:23

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

   assert.match(cjsEntry.pathname, /index\.cjs$/, 'require condition must resolve to index.cjs')
   const nsOfCjs = await import(cjsEntry)
   // 'default' and 'module.exports' are Node's own CJS-ESM interop keys added to
   // import()ed CJS namespaces (not exports of the facade); drop them before the

   dismissed LLM, confidence 0.90 A test that dynamically imports the CJS entry to verify ESM interop namespace keys.

   Reasoning

   This is a test file checking that a package's CJS and ESM entry points resolve correctly. The dynamic import of cjsEntry is a test fixture pattern for verifying module interop, and the comments explain Node's CJS-ESM namespace keys. No obfuscation or malicious behavior is present.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/toyobayashi/emnapi emnapi && cd emnapi
git checkout v2.0.0-beta.2
disclude scan --severity info --diff v2.0.0-beta.1 packages/runtime