# @emnapi/runtime@1.11.1 security report (npm) - Verdict: **Needs review** (risk level: medium) - Scanned: 2026-10-06T14:12:37.000Z - Files reviewed: 7 - Findings: 15 low severity findings - Report: https://security.togoder.click/npm/@emnapi/runtime@1.11.1 - Source: Togoder Security (https://security.togoder.click), AI source-code review ## Summary Togoder Security scanned the npm package @emnapi/runtime@1.11.1 on Oct 6, 2026. An AI review of 7 source files produced 15 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware. ## Findings ### [low] Environment probing Finding ID: `NPS-5791BDD2E2FA` File: `dist/emnapi.cjs.js` The code probes for global objects (`globalThis`, `window`, `self`, `global`), Node.js-specific built-ins (`process`, `Buffer`, `MessageChannel`, `setImmediate`), and various capabilities (`Reflect`, `FinalizationRegistry`, `WeakRef`, `BigInt`). This is typical for cross-environment compatibility, but it also gathers information about the runtime. ### [low] Dynamic code execution Finding ID: `NPS-84BCAE0CACA5` File: `dist/emnapi.cjs.js:22` The code uses `new Function()` in two places: to test for support of the Function constructor and to obtain the global object (`new Function('return this')()`). While this is a known pattern in libraries to detect environment features, dynamic code generation can be abused if an attacker can control the input. Here, no external input is passed, so the immediate risk is low, but the pattern is worth noting. ### [low] Dynamic require / module loading Finding ID: `NPS-467E6E52DE1C` File: `dist/emnapi.cjs.js:89` The code contains a helper `_require` that conditionally obtains `require` or `__non_webpack_require__` and uses it to load `'worker_threads'` and `'buffer'`. This is not inherently malicious, but combined with dynamic module loading it could be used to load arbitrary modules if the environment variable or global were controlled. However, the modules loaded are hardcoded and standard Node.js built-ins. ### [low] Dynamic code execution (new Function) Finding ID: `NPS-BFA68163C4A0` File: `dist/emnapi.esm-bundler.js` The code uses `new Function()` to detect the global object (`return this`). This is a known and common pattern for environment detection, not malicious obfuscation. It is wrapped in try/catch and only used to obtain a reference to the global scope. ### [low] Dynamic module loading (require) Finding ID: `NPS-953C8416D50E` File: `dist/emnapi.esm-bundler.js` The code conditionally requires Node.js built-in modules `worker_threads` and `buffer` as fallbacks for `MessageChannel` and `Buffer`. This is standard feature detection, not arbitrary module loading from external input. ### [low] dynamic code execution Finding ID: `NPS-A5B4347364D9` File: `dist/emnapi.iife.js` The code uses `new Function()` in the `supportNewFunction` detection block and in the `_global` fallback to obtain a reference to the global object. While this appears to be a feature-detection and polyfill mechanism common in bundlers, dynamic function construction is a potential risk if inputs were attacker-controlled (they are not here). ### [low] dynamic module loading Finding ID: `NPS-6F38856DD29C` File: `dist/emnapi.iife.js` The code conditionally calls `_require('worker_threads')` and `_require('buffer')` to obtain Node.js built-in modules when running in a Node environment. This is standard behavior for cross-runtime compatibility layers (emnapi is a Node-API emulation layer). No external or computed module paths are used, so the risk is minimal. ### [low] process interaction Finding ID: `NPS-32039924700E` File: `dist/emnapi.iife.js` The code checks `process.execArgv`, emits warnings via `process.emitWarning`, calls `process._fatalException` and `process.exit(1)` in error paths, and registers a `process.once('beforeExit', ...)` handler. These are normal Node.js runtime interactions for exception policy handling and cleanup, not backdoor behavior. ### [low] Dynamic code execution via new Function Finding ID: `NPS-745A97FB9F95` File: `dist/emnapi.min.mjs` The code uses `new Function` in several places (feature detection for `supportNewFunction` and a fallback to obtain the global object). While these usages appear benign and are common patterns in polyfills/bundlers, `new Function` is a dynamic code execution primitive that can be a red flag if the input is not strictly controlled. In this file the constructed functions are empty or return `this`, so no user input is evaluated. ### [low] Dynamic module loading with computed input Finding ID: `NPS-2831DA93A881` File: `dist/emnapi.min.mjs` The code defines `d` which attempts to load `worker_threads` and `buffer` modules via `__non_webpack_require__` or `require` when needed. This is a dynamic module loading pattern. Although the module names are hardcoded strings and only used for feature detection/polyfilling, dynamic requires are often flagged in supply‑chain analysis. No external or user‑controlled input is used. ### [low] Environment probing / global object fallback Finding ID: `NPS-9354EF795BC2` File: `dist/emnapi.min.mjs` The code probes for `globalThis`, `window`, `self`, `global`, `process`, `Buffer`, `MessageChannel`, etc. to determine the runtime environment. This is standard for cross‑platform libraries (this is a Node‑API/emnapi runtime shim). It does not harvest environment variables or credentials. ### [low] Potential process termination / fatal exception handling Finding ID: `NPS-B3D7B3EE31F9` File: `dist/emnapi.min.mjs` The code contains logic that may call `process.exit(1)` or `process._fatalException` when a fatal exception is triggered. This is part of error‑handling in the Node‑API shim and is not a backdoor, but it can terminate the host process under certain conditions. ### [low] Dynamic code execution Finding ID: `NPS-ADDCE73B5726` File: `dist/emnapi.mjs` Uses new Function('return this')() as a fallback to obtain the global object. This is dynamic code evaluation, though it is a common pattern in polyfills and libraries. It is guarded by try/catch and only used if globalThis and direct this access fail. ### [low] Dynamic module loading Finding ID: `NPS-A90E0FE876D7` File: `dist/emnapi.mjs` The _require function dynamically obtains a require implementation, potentially using __non_webpack_require__ or the native require. This is used to load optional built-in modules like 'worker_threads' and 'buffer'. This could be abused if the module name were attacker-controlled, but here the names are hardcoded and the loading is for compatibility. ### [low] Environment access Finding ID: `NPS-2AC552A1C9EE` File: `dist/emnapi.mjs` The code accesses process.execArgv to check for the '--force-node-api-uncaught-exceptions-policy' flag. This is a legitimate use for Node.js API behavior, not credential harvesting. ## Files reviewed - `dist/emnapi.cjs.js` (medium): The code is a Node-API compatibility layer (emnapi) with standard environment detection and dynamic code patterns, but no clear malicious behavior such as data exfiltration, credential harvesting, or backdoors. - `dist/emnapi.iife.js` (medium): The file is the official emnapi Node-API emulation library; it contains only conventional runtime feature detection (including benign `new Function` usage and Node built-in requires) and no malicious patterns such as exfiltration, credential harvesting, obfuscated payloads, or backdoors. - `dist/emnapi.min.mjs` (medium): The file is a minified JavaScript runtime shim (likely for Node-API/emnapi) that uses common feature-detection patterns including `new Function` and dynamic `require`; no malicious exfiltration, credential harvesting, obfuscated payloads, or backdoors were detected. - `dist/emnapi.mjs` (medium): The code contains benign dynamic code execution and dynamic module loading patterns typical of a Node-API polyfill, with no evidence of data exfiltration, credential harvesting, or malicious behavior. - `dist/emnapi.esm-bundler.js` (safe): The code is a legitimate Node-API/emnapi bundler wrapper using standard feature detection; no malicious patterns such as exfiltration, credential harvesting, obfuscated payloads, or backdoors were found. - `dist/emnapi.js` (safe): No malicious patterns detected; the code is a legitimate Node-API implementation for WebAssembly with standard runtime feature detection and no data exfiltration, credential harvesting, or backdoor behavior. - `index.js` (safe): Standard conditional module export based on NODE_ENV; no malicious patterns detected ## Version ranges None of the 3 scanned versions of @emnapi/runtime are flagged high or critical. The latest scanned version, 1.11.3, is medium risk. Only versions we have scanned are listed; unscanned versions between them are not covered. - 2.0.0-alpha.3 (`2.0.0-alpha.3`): not scanned - 1.10.0 – 1.11.3 (`>=1.10.0 <=1.11.3`): medium (Dynamic code execution) - 1.4.5 – 1.7.1 (`>=1.4.5 <=1.7.1`): not scanned ## Scanned versions - [1.11.3](https://security.togoder.click/npm/@emnapi/runtime@1.11.3): medium, 2026-10-06T14:11:03.000Z - [1.11.1](https://security.togoder.click/npm/@emnapi/runtime@1.11.1): medium, 2026-10-06T14:12:37.000Z - [1.10.0](https://security.togoder.click/npm/@emnapi/runtime@1.10.0): medium, 2026-10-06T14:13:31.000Z AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology