@emnapi/runtime@1.11.1 security report

The code probes for global objects (globalThis, window, self, global), Node.js-specific built-ins (process, Buffer, MessageChannel, setImmediate), and various capabilities (Reflect, FinalizationRegistry, WeakRef, BigInt). This is typical for cross-environment compatibility, but it also gathers information about the runtime.

The code uses new Function() in two places: to test for support of the Function constructor and to obtain the global object (new Function('return this')()). While this is a known pattern in libraries to detect environment features, dynamic code generation can be abused if an attacker can control the input. Here, no external input is passed, so the immediate risk is low, but the pattern is worth noting.

The code contains a helper _require that conditionally obtains require or __non_webpack_require__ and uses it to load 'worker_threads' and 'buffer'. This is not inherently malicious, but combined with dynamic module loading it could be used to load arbitrary modules if the environment variable or global were controlled. However, the modules loaded are hardcoded and standard Node.js built-ins.

The code uses new Function() to detect the global object (return this). This is a known and common pattern for environment detection, not malicious obfuscation. It is wrapped in try/catch and only used to obtain a reference to the global scope.

The code conditionally requires Node.js built-in modules worker_threads and buffer as fallbacks for MessageChannel and Buffer. This is standard feature detection, not arbitrary module loading from external input.

The code uses new Function() in the supportNewFunction detection block and in the _global fallback to obtain a reference to the global object. While this appears to be a feature-detection and polyfill mechanism common in bundlers, dynamic function construction is a potential risk if inputs were attacker-controlled (they are not here).

The code conditionally calls _require('worker_threads') and _require('buffer') to obtain Node.js built-in modules when running in a Node environment. This is standard behavior for cross-runtime compatibility layers (emnapi is a Node-API emulation layer). No external or computed module paths are used, so the risk is minimal.

The code checks process.execArgv, emits warnings via process.emitWarning, calls process._fatalException and process.exit(1) in error paths, and registers a process.once('beforeExit', ...) handler. These are normal Node.js runtime interactions for exception policy handling and cleanup, not backdoor behavior.

The code uses new Function in several places (feature detection for supportNewFunction and a fallback to obtain the global object). While these usages appear benign and are common patterns in polyfills/bundlers, new Function is a dynamic code execution primitive that can be a red flag if the input is not strictly controlled. In this file the constructed functions are empty or return this, so no user input is evaluated.

The code defines d which attempts to load worker_threads and buffer modules via __non_webpack_require__ or require when needed. This is a dynamic module loading pattern. Although the module names are hardcoded strings and only used for feature detection/polyfilling, dynamic requires are often flagged in supply‑chain analysis. No external or user‑controlled input is used.

The code probes for globalThis, window, self, global, process, Buffer, MessageChannel, etc. to determine the runtime environment. This is standard for cross‑platform libraries (this is a Node‑API/emnapi runtime shim). It does not harvest environment variables or credentials.

The code contains logic that may call process.exit(1) or process._fatalException when a fatal exception is triggered. This is part of error‑handling in the Node‑API shim and is not a backdoor, but it can terminate the host process under certain conditions.

Uses new Function('return this')() as a fallback to obtain the global object. This is dynamic code evaluation, though it is a common pattern in polyfills and libraries. It is guarded by try/catch and only used if globalThis and direct this access fail.

The _require function dynamically obtains a require implementation, potentially using __non_webpack_require__ or the native require. This is used to load optional built-in modules like 'worker_threads' and 'buffer'. This could be abused if the module name were attacker-controlled, but here the names are hardcoded and the loading is for compatibility.

The code accesses process.execArgv to check for the '--force-node-api-uncaught-exceptions-policy' flag. This is a legitimate use for Node.js API behavior, not credential harvesting.