Summary
Togoder Security scanned the npm package unrs-resolver@1.12.2 on Oct 6, 2026. An AI review of 3 source files produced 4 medium, 3 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 7
Dynamic module loading from environment variable
NPS-AAD3C718EB59
The code reads process.env.NAPI_RS_NATIVE_LIBRARY_PATH and passes it directly to require(), allowing arbitrary native module load paths controlled by an environment variable. An attacker who can set this env var (e.g., via a compromised CI pipeline or parent process) could load arbitrary native code (.node binaries). This is a well-known NAPI-RS pattern but still represents a code-loading risk if the environment is untrusted.
Install-time code execution via postinstall hook
NPS-AABF9FC02590
This file is named postinstall.js and is intended to run automatically during npm package installation. It invokes checkAndPreparePackage(packageJson, true) from the napi-postinstall dependency, which can execute arbitrary logic at install time (potentially downloading binaries, modifying files, or spawning processes) depending on the implementation of napi-postinstall.
Dynamic module loading with external package
NPS-DDB256843FB4
The script delegates control to the napi-postinstall module, which is designed to prepare native bindings and may perform network requests or filesystem operations outside the package scope. The second argument 'true' may enable additional behavior (e.g., force download) that is not visible in this file.
Top-level execution on install
NPS-4DDCADA0C500
The call to checkAndPreparePackage runs immediately at module load, meaning any side effects occur during npm install without user confirmation. This is a common vector for supply-chain attacks if the dependency is compromised or malicious.
Shell command execution
NPS-F91594FCBFC4
isMuslFromChildProcess() uses child_process.execSync('ldd --version') to detect the C library. While the command is hardcoded (no user input is interpolated), it is still a spawn of a shell process at import time on Linux, which is a supply-chain observable behavior and could be flagged in restricted/sandboxed environments.
Filesystem read outside package scope
NPS-FE9AA1A2C266
isMuslFromFilesystem() reads /usr/bin/ldd from the host filesystem at import time to detect musl vs glibc. This is a benign detection heuristic used by NAPI-RS bindings, but it does access host files outside the package directory.
Dynamic require of computed module name
NPS-4EC079BB33AE
Multiple require() calls use string-concatenated or package-relative paths (e.g. require('@unrs/resolver-binding-' + platform) and require('./resolver.' + platform + '.node')) resolved at runtime based on process.platform/process.arch. This is standard NAPI-RS multi-platform binding selection and is not evaluated as fully dynamic/obfuscated input, but it does load code based on runtime environment.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| index.js | medium | Auto-generated NAPI-RS native binding loader that performs platform detection, host filesystem reads, a hardcoded ldd shell call, and require() of environment-variable-specified and platform-derived native modules — standard Rust-to-Node binding boilerplate with no clear malicious intent, but with code-loading primitives that warrant review in a supply-chain context. |
| postinstall.js | medium | The postinstall script runs install-time code via napi-postinstall, which can perform network/filesystem operations and is a potential supply-chain risk, though no direct malicious patterns are visible in this snippet. |
| browser.js | safe | The file contains only a re-export of a WASM binding package, with no malicious patterns or suspicious behavior. |
Frequently asked questions
Is unrs-resolver safe to use?
No confirmed malware was found in unrs-resolver@1.12.2, but the review flagged 4 medium, 3 low severity findings for risky patterns worth checking before you rely on it.
Does unrs-resolver contain malware?
No malware was identified in unrs-resolver@1.12.2 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was unrs-resolver checked?
Togoder Security downloaded the published npm package and had an AI model read its 3 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan unrs-resolver together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in unrs-resolver@1.12.2, cost nothing.