@emnapi/runtime 2.0.0-beta.2

Source: https://github.com/toyobayashi/emnapi
Artifact scanned: runtime-2.0.0-beta.2.tgz (npm tarball · 60.6 KB · SHA-256 b2295c046d70…)
Compared with: runtime-2.0.0-beta.1.tgz (0 signals introduced since)
Files: 6 scanned, 2 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 2 info
Scan time: 3.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-24 00:30

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review dynamic-execution dist/emnapi.js:92:29

`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
```
        makeDynamicFunction: (supportNewFunction
            ? (...args) => (new Function(...args))
            : undefined),
        setFunctionName: (canSetFunctionName
```
likely benign LLM, confidence 0.82 A feature-gated helper in a bundled emnapi (Node-API for WebAssembly) library that creates functions via `new Function` with runtime-supplied arguments.
Reasoning
The flagged call is `new Function(...args)` inside a `makeDynamicFunction` helper that is only set when `supportNewFunction` is true, otherwise undefined. This matches emnapi's N-API bridge, which builds named JS wrapper functions at runtime for WebAssembly-exported functions. The file is a dist bundle of a known WebAssembly/Node-API library, and the snippet shows no network access, process spawning, decoding of a payload, or obfuscated string construction. The dynamic execution is a feature-detected runtime helper, not evidence of a dropper. Residual doubt: the body is non-literal and the surrounding code is not shown, so the call sites cannot be checked.

info long-line dist/emnapi.js:2630:1

line length 784 characters (raw pass, confidence 0.50)

export { ArrayStore, BaseArrayStore, Context, CountIdAllocator, CountIdReuseAllocator, Disposable, EmnapiError, Env, External, Finalizer, FunctionTemplate, HandleScope, HandleStore, Isolate, NAPI_VERSION_EXPERIMENTAL, NODE_API_DEFAULT_MODULE_API_VERSION, NODE_API_SUPPORTED_VERSION_MAX, NODE_API_SUPPORTED_VERSION_MIN, N

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o runtime-2.0.0-beta.2.tgz https://registry.npmjs.org/@emnapi/runtime/-/runtime-2.0.0-beta.2.tgz
printf '%s  %s\n' b2295c046d70bd46f85a906065b002443e3c9399bcd194fdf335fae9e9b700cb runtime-2.0.0-beta.2.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf runtime-2.0.0-beta.2.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg