# unrs-resolver@1.12.2 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-06T14:24:55.000Z
- Files reviewed: 3
- Findings: 4 medium, 3 low severity findings
- Report: https://security.togoder.click/npm/unrs-resolver
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package unrs-resolver@1.12.2 on Oct 6, 2026. An AI review of 3 source files produced 4 medium, 3 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [medium] Dynamic module loading from environment variable

Finding ID: `NPS-AAD3C718EB59`

File: `index.js`

The code reads process.env.NAPI_RS_NATIVE_LIBRARY_PATH and passes it directly to require(), allowing arbitrary native module load paths controlled by an environment variable. An attacker who can set this env var (e.g., via a compromised CI pipeline or parent process) could load arbitrary native code (.node binaries). This is a well-known NAPI-RS pattern but still represents a code-loading risk if the environment is untrusted.

### [medium] Install-time code execution via postinstall hook

Finding ID: `NPS-AABF9FC02590`

File: `postinstall.js:1`

This file is named postinstall.js and is intended to run automatically during npm package installation. It invokes checkAndPreparePackage(packageJson, true) from the napi-postinstall dependency, which can execute arbitrary logic at install time (potentially downloading binaries, modifying files, or spawning processes) depending on the implementation of napi-postinstall.

### [medium] Dynamic module loading with external package

Finding ID: `NPS-DDB256843FB4`

File: `postinstall.js:3`

The script delegates control to the napi-postinstall module, which is designed to prepare native bindings and may perform network requests or filesystem operations outside the package scope. The second argument 'true' may enable additional behavior (e.g., force download) that is not visible in this file.

### [medium] Top-level execution on install

Finding ID: `NPS-4DDCADA0C500`

File: `postinstall.js:3`

The call to checkAndPreparePackage runs immediately at module load, meaning any side effects occur during npm install without user confirmation. This is a common vector for supply-chain attacks if the dependency is compromised or malicious.

### [low] Shell command execution

Finding ID: `NPS-F91594FCBFC4`

File: `index.js`

isMuslFromChildProcess() uses child_process.execSync('ldd --version') to detect the C library. While the command is hardcoded (no user input is interpolated), it is still a spawn of a shell process at import time on Linux, which is a supply-chain observable behavior and could be flagged in restricted/sandboxed environments.

### [low] Filesystem read outside package scope

Finding ID: `NPS-FE9AA1A2C266`

File: `index.js`

isMuslFromFilesystem() reads /usr/bin/ldd from the host filesystem at import time to detect musl vs glibc. This is a benign detection heuristic used by NAPI-RS bindings, but it does access host files outside the package directory.

### [low] Dynamic require of computed module name

Finding ID: `NPS-4EC079BB33AE`

File: `index.js`

Multiple require() calls use string-concatenated or package-relative paths (e.g. require('@unrs/resolver-binding-' + platform) and require('./resolver.' + platform + '.node')) resolved at runtime based on process.platform/process.arch. This is standard NAPI-RS multi-platform binding selection and is not evaluated as fully dynamic/obfuscated input, but it does load code based on runtime environment.

## Files reviewed

- `index.js` (medium): Auto-generated NAPI-RS native binding loader that performs platform detection, host filesystem reads, a hardcoded ldd shell call, and require() of environment-variable-specified and platform-derived native modules — standard Rust-to-Node binding boilerplate with no clear malicious intent, but with code-loading primitives that warrant review in a supply-chain context.
- `postinstall.js` (medium): The postinstall script runs install-time code via napi-postinstall, which can perform network/filesystem operations and is a potential supply-chain risk, though no direct malicious patterns are visible in this snippet.
- `browser.js` (safe): The file contains only a re-export of a WASM binding package, with no malicious patterns or suspicious behavior.

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology