# @emnapi/runtime@1.10.0 security report (npm) - Verdict: **Needs review** (risk level: medium) - Scanned: 2026-10-06T14:13:31.000Z - Files reviewed: 7 - Findings: 1 medium, 17 low severity findings - Report: https://security.togoder.click/npm/@emnapi/runtime@1.10.0 - Source: Togoder Security (https://security.togoder.click), AI source-code review ## Summary Togoder Security scanned the npm package @emnapi/runtime@1.10.0 on Oct 6, 2026. An AI review of 7 source files produced 1 medium, 17 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware. ## Findings ### [medium] Dynamic code execution Finding ID: `NPS-617AB6136326` File: `dist/emnapi.js` The code uses `new Function()` to dynamically evaluate code, both to detect if `new Function` is supported and to obtain the global object via `new Function('return this')()`. While this is a common pattern in UMD/IIFE wrappers and polyfills, it is a potential red flag for obfuscation or eval-like behavior. No malicious payload was observed, but dynamic code execution could be abused in principle. ### [low] dynamic code execution Finding ID: `NPS-A8D91037FFA1` File: `dist/emnapi.cjs.js:21` Uses `new Function()` and `new Function('return this')()` to obtain a global object reference. This is a common, well-established feature-detection pattern for cross-realm global access, not an obfuscated or injected payload. No user-controlled input is passed into `Function`. ### [low] dynamic module loading Finding ID: `NPS-775B2A16A33E` File: `dist/emnapi.cjs.js:131` Conditionally requires Node built-in modules ('worker_threads', 'buffer') via a wrapper around `require`/`__non_webpack_require__`. Only fixed literal module names are loaded, no computed or externally supplied module paths, so this is not a dynamic import abuse vector. ### [low] environment access Finding ID: `NPS-67B4DC6F6DD3` File: `dist/emnapi.cjs.js:750` Reads `process.execArgv` to check for the `--force-node-api-uncaught-exceptions-policy` flag, and checks `process._fatalException`. This is used for Node-API compatibility behavior, not for harvesting environment variables or credentials. ### [low] Global object access / sandbox escape Finding ID: `NPS-B44F0378A5F3` File: `dist/emnapi.esm-bundler.js:36` Constructs a reference to the global object using multiple techniques including `Function('return this')()` and `globalThis`, `global`, `window`, `self`. This is standard for cross-environment libraries but can facilitate sandbox escape in restricted execution contexts. ### [low] Dynamic code execution Finding ID: `NPS-EE4691B10EDE` File: `dist/emnapi.esm-bundler.js:46` Uses `new Function('return this')()` to obtain the global object. This is a form of dynamic code execution via the Function constructor, which can be a security concern in environments with strict CSP or when used to bypass restrictions. It is commonly used in legitimate polyfills but is still flagged by security scanners. ### [low] Dynamic module loading / require fallback Finding ID: `NPS-592DBE2FF8BD` File: `dist/emnapi.esm-bundler.js:178` Contains runtime fallback logic to access `__non_webpack_require__` and `require`, then dynamically loads 'worker_threads', 'buffer' modules. Conditional dynamic requires based on runtime environment can be abused, though here they are used for polyfilling Node.js APIs. This pattern is typical of Node-API bindings but represents dynamic module resolution with external influence. ### [low] Finalizer callbacks invoked from GC Finding ID: `NPS-3476BFF4A685` File: `dist/emnapi.esm-bundler.js:880` The library registers FinalizationRegistry callbacks and invokes webassembly/FFI function pointers (`_makeDynCall_vppp`) during garbage collection finalization. If untrusted native modules are loaded, finalizers could execute arbitrary native code pointers. This is an inherent risk of Node-API/emnapi bindings, not necessarily malicious. ### [low] Dynamic code execution via new Function Finding ID: `NPS-4BE4EE16086A` File: `dist/emnapi.iife.js` The code uses `new Function()` in two places: one for feature detection (supportNewFunction) and another for obtaining the global object (`new Function('return this')()`). While used in a common polyfill pattern, `new Function` is a form of dynamic code evaluation that can be exploited if the input is attacker-controlled. Here the input is static, but the presence of such constructs warrants caution. ### [low] Module loading using require Finding ID: `NPS-1D92453921F7` File: `dist/emnapi.iife.js` The code conditionally requires 'worker_threads', 'buffer', and other Node.js built-in modules via a dynamically resolved `_require` variable. While this is standard for cross-environment compatibility, it demonstrates dynamic module loading based on runtime detection. This is not malicious per se but could be abused if the module resolution path were influenced by external input. ### [low] Process termination and fatal error handling Finding ID: `NPS-EEED6993B42E` File: `dist/emnapi.iife.js` The NodeEnv.prototype.triggerFatalException method can call `process.exit(1)` on uncaught exceptions when not handled by the runtime. This is standard behavior for Node-API modules but represents a mechanism that could be abused to cause denial of service if an attacker can trigger an uncaught exception in a finalizer or callback. ### [low] Abort/terminate context functionality Finding ID: `NPS-0ABA2B527ED1` File: `dist/emnapi.iife.js` The Context class includes methods to enable/disable calling into JavaScript and to destroy the context, which stops execution. This is expected for emnapi's functionality but could be misused if an attacker gains control over the module's environment. ### [low] Dynamic require / module loading Finding ID: `NPS-6701D1BA267A` File: `dist/emnapi.js` The code conditionally accesses `require` (or `__non_webpack_require__`) to load `worker_threads` and `buffer` modules based on environment checks. This is not inherently malicious, but dynamic module loading with environment-dependent fallbacks can be a vector for dependency confusion or unexpected module resolution. The loaded modules (`worker_threads`, `buffer`) are standard Node.js core modules and the usage appears benign. ### [low] Environment-dependent behavior Finding ID: `NPS-5DEFC2101185` File: `dist/emnapi.js` The code inspects globals such as `process`, `__webpack_public_path__`, `global`, `window`, `self`, and `globalThis` to adapt to different runtimes. While this is typical for cross-platform libraries, such introspection could theoretically be used to conditionally execute different code paths. No malicious behavior was observed. ### [low] Dynamic code execution via new Function Finding ID: `NPS-29C786017C02` File: `dist/emnapi.min.mjs:3` The code uses new Function to detect globalThis fallback and to test configurability of Function.prototype.name. While common in polyfills, new Function is a potential vector for code execution if input is ever passed to it. Here, no external input controls the Function constructor arguments, so risk is limited. ### [low] Environment and module loading via require Finding ID: `NPS-7B2795FEAE7C` File: `dist/emnapi.min.mjs:3` The code dynamically resolves require/__non_webpack_require__ to load 'worker_threads', 'buffer', and potentially fallbacks. This is standard for Node.js compatibility layers (emnapi) but allows resolution of modules based on environment. No credential or env var harvesting observed. ### [low] Use of process._fatalException / process.exit Finding ID: `NPS-B4CDB5D164F1` File: `dist/emnapi.min.mjs:3` The code can call process._fatalException and process.exit(1) on uncaught exceptions in native callbacks. This is expected behavior for a Node-API implementation but could terminate the host process. Not malicious, but noteworthy for security review. ### [low] WeakRef and FinalizationRegistry usage Finding ID: `NPS-CE64FEFE0172` File: `dist/emnapi.min.mjs:3` The code uses WeakRef/FinalizationRegistry for reference tracking (standard for Node-API). No data exfiltration or persistence observed. ## Files reviewed - `dist/emnapi.esm-bundler.js` (medium): The file is an emnapi (Node-API for WebAssembly) runtime bundler with expected dynamic Function usage, conditional require fallbacks, and global object detection; no data exfiltration, credential harvesting, obfuscation, or backdoor patterns were found, but dynamic code/module loading primitives warrant a warning-level review. - `dist/emnapi.iife.js` (medium): The code is a legitimate Node-API implementation (emnapi) with some dynamic code execution and module loading patterns typical for cross-environment compatibility, but no obvious malicious behaviors such as data exfiltration, credential harvesting, or backdoors were detected. - `dist/emnapi.js` (medium): The code appears to be a legitimate Node-API (N-API) implementation library (emnapi) with no obvious malicious patterns, though it uses dynamic code execution and dynamic requires that warrant caution. - `dist/emnapi.min.mjs` (medium): The file is the minified emnapi runtime (Node-API for WebAssembly), containing standard polyfills and dynamic require/Function usage typical for its purpose; no malicious exfiltration, credential harvesting, backdoors, or mining code was detected. - `dist/emnapi.cjs.js` (safe): The file is a legitimate Node-API (emnapi) compatibility runtime library; the only notable patterns are standard `new Function` global detection and fixed-name built-in module requires, with no exfiltration, credential harvesting, mining, backdoors, or install-time execution detected. - `dist/emnapi.mjs` (safe): This is the legitimate emnapi (Node-API emscripten bindings) library; the 'new Function' and dynamic require usages are benign environment-detection and worker_threads/buffer polyfill fallbacks, with no data exfiltration, credential harvesting, obfuscation, or other malicious patterns detected. - `index.js` (safe): Standard conditional module export based on NODE_ENV; no malicious patterns detected ## Version ranges None of the 3 scanned versions of @emnapi/runtime are flagged high or critical. The latest scanned version, 1.11.3, is medium risk. Only versions we have scanned are listed; unscanned versions between them are not covered. - 2.0.0-alpha.3 (`2.0.0-alpha.3`): not scanned - 1.10.0 – 1.11.3 (`>=1.10.0 <=1.11.3`): medium (Dynamic code execution) - 1.4.5 – 1.7.1 (`>=1.4.5 <=1.7.1`): not scanned ## Scanned versions - [1.11.3](https://security.togoder.click/npm/@emnapi/runtime@1.11.3): medium, 2026-10-06T14:11:03.000Z - [1.11.1](https://security.togoder.click/npm/@emnapi/runtime@1.11.1): medium, 2026-10-06T14:12:37.000Z - [1.10.0](https://security.togoder.click/npm/@emnapi/runtime@1.10.0): medium, 2026-10-06T14:13:31.000Z AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology