Close Open Privacy Scan

link https://github.com/pmndrs/zustand

bolt Snapshot: commit a1f685c

science engine v1

schedule 2026-06-26T13:06:44.598066+00:00

App Privacy Score

100 /100

Low privacy risk

Low risk · 282 finding(s)

Dependency score: 67 (Medium risk)

bar_chart Score Breakdown

No category deductions recorded.

list Scan Summary

0 high 2 medium 280 low

First-party packages: 0

Dependency packages: 18

Ecosystem: npm

swap_horiz Application data flows

No application data flows were found. See dependency data flows below.

hub Dependency data flows (2)

medium esbuild dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/[email protected]/install.js:29 → pkgs/npm/[email protected]/install.js:260

medium esbuild dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/[email protected]/lib/main.js:1889 → pkgs/npm/[email protected]/lib/main.js:1973

</> Dependencies

esbuild

npm dependency

medium pii_flow dependency Excluded from app score #fb54b93c76f07d2a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/[email protected]/install.js:260 · flow /tmp/closeopen-iw2lbn3l/pkgs/npm/[email protected]/install.js:29 → /tmp/closeopen-iw2lbn3l/pkgs/npm/[email protected]/install.js:260

      console.warn(`[esbuild] Ignoring bad configuration: ESBUILD_BINARY_PATH=${ESBUILD_BINARY_PATH}`);

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.

medium pii_flow dependency Excluded from app score #dd5283d8561c1202 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/[email protected]/lib/main.js:1973 · flow /tmp/closeopen-iw2lbn3l/pkgs/npm/[email protected]/lib/main.js:1889 → /tmp/closeopen-iw2lbn3l/pkgs/npm/[email protected]/lib/main.js:1973

      console.warn(`[esbuild] Ignoring bad configuration: ESBUILD_BINARY_PATH=${ESBUILD_BINARY_PATH}`);

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.

expand_more 26 low-confidence finding(s)

low env_fs dependency Excluded from app score #b4eaa642ba3e9981 — Filesystem access.

pkgs/npm/[email protected]/install.js:26

var fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b4eaa642ba3e9981 — Filesystem access.

pkgs/npm/[email protected]/install.js:26

var fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b7522dd33100f709 — Environment-variable access.

pkgs/npm/[email protected]/install.js:29

var ESBUILD_BINARY_PATH = process.env.ESBUILD_BINARY_PATH || ESBUILD_BINARY_PATH;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1d91bf1e83bfb611 — Filesystem access.

pkgs/npm/[email protected]/install.js:89

var fs2 = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1d91bf1e83bfb611 — Filesystem access.

pkgs/npm/[email protected]/install.js:89

var fs2 = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4b2dbafe3fd738d7 — Filesystem access.

pkgs/npm/[email protected]/install.js:186

    fs2.writeFileSync(path2.join(installDir, "package.json"), "{}");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf50daca0b71a2c1 — Filesystem access.

pkgs/npm/[email protected]/install.js:192

    binaryIntegrityCheck(pkg, subpath, fs2.readFileSync(installedBinPath));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5fc13556c33fa5c1 — Filesystem access.

pkgs/npm/[email protected]/install.js:217

  fs2.writeFileSync(toPath, `#!/usr/bin/env node
require('child_process').execFileSync(${pathString}, process.argv.slice(2), { stdio: 'inherit' });
`);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #652b9de7a1c2601f — Filesystem access.

pkgs/npm/[email protected]/install.js:221

  const code = fs2.readFileSync(libMain, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #68b48147383c5263 — Filesystem access.

pkgs/npm/[email protected]/install.js:222

  fs2.writeFileSync(libMain, `var ESBUILD_BINARY_PATH = ${pathString};
${code}`);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #73d69766e0e6aec7 — Filesystem access.

pkgs/npm/[email protected]/install.js:250

    fs2.writeFileSync(binPath, bytes);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0edb9f96c3c04c02 — Filesystem access.

pkgs/npm/[email protected]/lib/main.js:1020

            fs3.readFile(response.code, (err, contents) => {
              if (err !== null) {
                callback(err, null);
              } else {
                response.code = contents;
                next();
              }
            });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4a4c40928fc1fecf — Filesystem access.

pkgs/npm/[email protected]/lib/main.js:1031

            fs3.readFile(response.map, (err, contents) => {
              if (err !== null) {
                callback(err, null);
              } else {
                response.map = contents;
                next();
              }
            });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1f44cc4cd57e8596 — Filesystem access.

pkgs/npm/[email protected]/lib/main.js:1057

      start = () => fs3.writeFile(input, next);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #08c27439ad3cfe2d — Filesystem access.

pkgs/npm/[email protected]/lib/main.js:1714

            contents = streamIn.readFileSync(match[1], "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #48a0bffa56bcec87 — Filesystem access.

pkgs/npm/[email protected]/lib/main.js:1886

var fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #48a0bffa56bcec87 — Filesystem access.

pkgs/npm/[email protected]/lib/main.js:1886

var fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f2e62e6a6e167b16 — Environment-variable access.

pkgs/npm/[email protected]/lib/main.js:1889

var ESBUILD_BINARY_PATH = process.env.ESBUILD_BINARY_PATH || ESBUILD_BINARY_PATH;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #917b0ce21fd5ea40 — Filesystem access.

pkgs/npm/[email protected]/lib/main.js:2080

var fs2 = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #917b0ce21fd5ea40 — Filesystem access.

pkgs/npm/[email protected]/lib/main.js:2080

var fs2 = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #26987fdf253dd2d7 — Environment-variable access.

pkgs/npm/[email protected]/lib/main.js:2084

if (process.env.ESBUILD_WORKER_THREADS !== "0") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9949d58e53b4871c — Filesystem access.

pkgs/npm/[email protected]/lib/main.js:2122

      let contents = fs2.readFileSync(tempFile, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #15b63198424f9b4d — Filesystem access.

pkgs/npm/[email protected]/lib/main.js:2135

      fs2.writeFileSync(tempFile, contents);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #41a98d8c578f5807 — Filesystem access.

pkgs/npm/[email protected]/lib/main.js:2145

      fs2.readFile(tempFile, "utf8", (err, contents) => {
        try {
          fs2.unlink(tempFile, () => callback(err, contents));
        } catch {
          callback(err, contents);
        }
      });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7e7c8d97f2c158b2 — Filesystem access.

pkgs/npm/[email protected]/lib/main.js:2159

      fs2.writeFile(tempFile, contents, (err) => err !== null ? callback(null) : callback(tempFile));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e4f195fe8c3b5e23 — Environment-variable access.

pkgs/npm/[email protected]/lib/main.js:2380

    maxBuffer: +process.env.ESBUILD_MAX_BUFFER || 16 * 1024 * 1024

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@redux-devtools/extension

npm dependency

expand_more 8 low-confidence finding(s)

low env_fs dependency Excluded from app score #fe0240854b83e97c — Environment-variable access.

pkgs/npm/@[email protected]/lib/developmentOnly.js:9

export const composeWithDevTools = process.env.NODE_ENV !== 'production' &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #af284ec30f060bf1 — Environment-variable access.

pkgs/npm/@[email protected]/lib/developmentOnly.js:14

export const devToolsEnhancer = process.env.NODE_ENV !== 'production' &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f5561a4b3c2f5393 — Environment-variable access.

pkgs/npm/@[email protected]/lib/logOnlyInProduction.js:10

export const composeWithDevTools = process.env.NODE_ENV === 'production'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b5a3b6c97cd4ac7e — Environment-variable access.

pkgs/npm/@[email protected]/lib/logOnlyInProduction.js:16

export const devToolsEnhancer = process.env.NODE_ENV === 'production'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #15dd65d6a7195ec3 — Environment-variable access.

pkgs/npm/@[email protected]/src/developmentOnly.ts:31

  process.env.NODE_ENV !== 'production' &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #350e5119fcdb99de — Environment-variable access.

pkgs/npm/@[email protected]/src/developmentOnly.ts:38

  process.env.NODE_ENV !== 'production' &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cd5582c6767583ec — Environment-variable access.

pkgs/npm/@[email protected]/src/logOnlyInProduction.ts:32

  process.env.NODE_ENV === 'production'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e3feadfe70638443 — Environment-variable access.

pkgs/npm/@[email protected]/src/logOnlyInProduction.ts:40

  process.env.NODE_ENV === 'production'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@testing-library/react

npm dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #1a365ce7c705e7e8 — Environment-variable access.

pkgs/npm/@[email protected]/dont-cleanup-after-each.js:1

process.env.RTL_SKIP_AUTO_CLEANUP = true

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

eslint

npm dependency

expand_more 15 low-confidence finding(s)

low env_fs dependency Excluded from app score #9802f0e11f77ab56 — Filesystem access.

pkgs/npm/[email protected]/lib/cli-engine/cli-engine.js:732

				fs.writeFileSync(result.filePath, result.output);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e3b9b94c656a7b3a — Filesystem access.

pkgs/npm/[email protected]/lib/cli-engine/cli-engine.js:855

				text: fs.readFileSync(filePath, "utf8"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf7b14b442bc8ae2 — Filesystem access.

pkgs/npm/[email protected]/lib/cli-engine/lint-result-cache.js:129

			results.source = fs.readFileSync(filePath, "utf-8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e428a66177d412ec — Filesystem access.

pkgs/npm/[email protected]/lib/cli.js:138

			await writeFile(filePath, output);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8fdb0225a8859506 — Filesystem access.

pkgs/npm/[email protected]/lib/eslint/eslint-helpers.js:1306

		const text = await fsp.readFile(filePath, {
			encoding: "utf8",
			signal: controller?.signal,
		});

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ce690af84368f3e8 — Environment-variable access.

pkgs/npm/[email protected]/lib/eslint/eslint-helpers.js:1351

	if (!process.env.ESLINT_FLAGS) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #57b634b04d4917ae — Environment-variable access.

pkgs/npm/[email protected]/lib/eslint/eslint-helpers.js:1355

	const envFlags = process.env.ESLINT_FLAGS.trim().split(/\s*,\s*/gu);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ee63ee440f23025 — Filesystem access.

pkgs/npm/[email protected]/lib/eslint/eslint.js:813

					retrier.retry(() => fs.writeFile(r.filePath, r.output)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9006627cfbf11488 — Environment-variable access.

pkgs/npm/[email protected]/lib/eslint/eslint.js:1350

	return process.env.ESLINT_USE_FLAT_CONFIG !== "false";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #debc823ae8f62cfb — Environment-variable access.

pkgs/npm/[email protected]/lib/linter/timing.js:44

const enabled = !!process.env.TIMING;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #997e6d9e298e1516 — Environment-variable access.

pkgs/npm/[email protected]/lib/linter/timing.js:56

	if (typeof process.env.TIMING !== "string") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3f62566440c43099 — Environment-variable access.

pkgs/npm/[email protected]/lib/linter/timing.js:60

	if (process.env.TIMING.toLowerCase() === "all") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #728c8214978c8724 — Environment-variable access.

pkgs/npm/[email protected]/lib/linter/timing.js:64

	const TIMING_ENV_VAR_AS_INTEGER = Number.parseInt(process.env.TIMING, 10);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f22a55980904f4da — Filesystem access.

pkgs/npm/[email protected]/lib/services/suppressions-service.js:215

			const data = await fs.promises.readFile(this.filePath, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9e12d915e02db51f — Filesystem access.

pkgs/npm/[email protected]/lib/services/suppressions-service.js:238

		return fs.promises.writeFile(
			this.filePath,
			stringify(suppressions, { space: 2 }),
		);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

eslint-plugin-import

npm dependency

expand_more 9 low-confidence finding(s)

low env_fs dependency Excluded from app score #53e2164630bebce6 — Filesystem access.

pkgs/npm/[email protected]/lib/exportMap/builder.js:1

'use strict';Object.defineProperty(exports, "__esModule", { value: true });var _createClass = function () {function defineProperties(target, props) {for (var i = 0; i < props.length; i++) {var descriptor = props[i];descriptor.enumerable = descriptor.enumerable || false;descriptor.configurable = true;if ("value" in descriptor) descriptor.writable = true;Object.defineProperty(target, descriptor.key, descriptor);}}return function (Constructor, protoProps, staticProps) {if (protoProps) defineProperties(Constructor.prototype, protoProps);if (staticProps) defineProperties(Constructor, staticProps);return Constructor;};}();var _fs = require('fs');var _fs2 = _interopRequireDefault(_fs);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #53e2164630bebce6 — Filesystem access.

pkgs/npm/[email protected]/lib/exportMap/builder.js:1

'use strict';Object.defineProperty(exports, "__esModule", { value: true });var _createClass = function () {function defineProperties(target, props) {for (var i = 0; i < props.length; i++) {var descriptor = props[i];descriptor.enumerable = descriptor.enumerable || false;descriptor.configurable = true;if ("value" in descriptor) descriptor.writable = true;Object.defineProperty(target, descriptor.key, descriptor);}}return function (Constructor, protoProps, staticProps) {if (protoProps) defineProperties(Constructor.prototype, protoProps);if (staticProps) defineProperties(Constructor, staticProps);return Constructor;};}();var _fs = require('fs');var _fs2 = _interopRequireDefault(_fs);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b740522aa4945479 — Filesystem access.

pkgs/npm/[email protected]/lib/exportMap/builder.js:74

        var content = _fs2['default'].readFileSync(path, { encoding: 'utf8' });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b28508dac3a0096c — Environment-variable access.

pkgs/npm/[email protected]/lib/exportMap/typescript.js:32

isEsModuleInterop = isEsModuleInterop;var _path = require('path');var _tsconfigLoader = require('tsconfig-paths/lib/tsconfig-loader');var _hash = require('eslint-module-utils/hash');var ts = void 0;var tsconfigCache = new Map();function readTsConfig(context) {var tsconfigInfo = (0, _tsconfigLoader.tsConfigLoader)({ cwd: context.parserOptions && context.parserOptions.tsconfigRootDir || process.cwd(), getEnv: function () {function getEnv(key) {return process.env[key];}return getEnv;}() });try {if (tsconfigInfo.tsConfigPath !== undefined) {// Projects not using TypeScript won't have `typescript` installed.

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #19da79f3b3c11fbf — Filesystem access.

pkgs/npm/[email protected]/lib/rules/no-extraneous-dependencies.js:2

var _fs = require('fs');var _fs2 = _interopRequireDefault(_fs);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #19da79f3b3c11fbf — Filesystem access.

pkgs/npm/[email protected]/lib/rules/no-extraneous-dependencies.js:2

var _fs = require('fs');var _fs2 = _interopRequireDefault(_fs);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #45b90e229896b38d — Filesystem access.

pkgs/npm/[email protected]/lib/rules/no-extraneous-dependencies.js:25

    return JSON.parse(_fs2['default'].readFileSync(jsonPath, 'utf8'));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a43ca4ba7838f46c — Environment-variable access.

pkgs/npm/[email protected]/lib/rules/no-unused-modules.js:63

  ESLINT_USE_FLAT_CONFIG = process.env.ESLINT_USE_FLAT_CONFIG;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ae473003340a2772 — Environment-variable access.

pkgs/npm/[email protected]/lib/rules/no-unused-modules.js:66

  var isUsingFlatConfig = ESLINT_USE_FLAT_CONFIG && process.env.ESLINT_USE_FLAT_CONFIG !== 'false';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

eslint-plugin-react

npm dependency

expand_more 2 low-confidence finding(s)

low env_fs dependency Excluded from app score #3777ea98e5679a85 — Filesystem access.

pkgs/npm/[email protected]/lib/util/version.js:8

const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3777ea98e5679a85 — Filesystem access.

pkgs/npm/[email protected]/lib/util/version.js:8

const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

eslint-plugin-react-hooks

npm dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #7b973ded0b5660bb — Environment-variable access.

pkgs/npm/[email protected]/index.js:12

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

immer

npm dependency

expand_more 5 low-confidence finding(s)

low env_fs dependency Excluded from app score #eb95fcea07631b85 — Environment-variable access.

pkgs/npm/[email protected]/src/core/proxy.ts:269

	if (process.env.NODE_ENV !== "production" && isNaN(parseInt(prop as any)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #84840330ed1714a6 — Environment-variable access.

pkgs/npm/[email protected]/src/core/proxy.ts:276

		process.env.NODE_ENV !== "production" &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7bc14462bbe2daf1 — Environment-variable access.

pkgs/npm/[email protected]/src/plugins/patches.ts:37

	if (process.env.NODE_ENV !== "production") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1c2b653b9f77806b — Environment-variable access.

pkgs/npm/[email protected]/src/utils/errors.ts:4

	process.env.NODE_ENV !== "production"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9431c71347e4fd0e — Environment-variable access.

pkgs/npm/[email protected]/src/utils/errors.ts:42

	if (process.env.NODE_ENV !== "production") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

jsdom

npm dependency

expand_more 5 low-confidence finding(s)

low env_fs dependency Excluded from app score #0557b7a322345689 — Filesystem access.

pkgs/npm/[email protected]/lib/api.js:4

const fs = require("fs").promises;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ba53e7373e8fcfe — Filesystem access.

pkgs/npm/[email protected]/lib/api.js:153

    const nodeBuffer = await fs.readFile(filename);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #be953671f32054bb — Filesystem access.

pkgs/npm/[email protected]/lib/jsdom/browser/resources/jsdom-dispatcher.js:2

const fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #be953671f32054bb — Filesystem access.

pkgs/npm/[email protected]/lib/jsdom/browser/resources/jsdom-dispatcher.js:2

const fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #17547a451e910c56 — Filesystem access.

pkgs/npm/[email protected]/lib/jsdom/living/css/helpers/computed-style.js:16

const defaultStyleSheet = fs.readFileSync(
  path.resolve(__dirname, "../../../browser/default-stylesheet.css"),
  { encoding: "utf-8" }
);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

json

npm dependency

expand_more 6 low-confidence finding(s)

low env_fs dependency Excluded from app score #de4abebf945032a0 — Filesystem access.

pkgs/npm/[email protected]/lib/json.js:18

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #de4abebf945032a0 — Filesystem access.

pkgs/npm/[email protected]/lib/json.js:18

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7179816dd6975658 — Filesystem access.

pkgs/npm/[email protected]/lib/json.js:733

                content = fs.readFileSync(file, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #84e608912a25ca9a — Filesystem access.

pkgs/npm/[email protected]/lib/json.js:747

                chunks.push(fs.readFileSync(opts.inputFiles[i], 'utf8'));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #69d3cffd918b5146 — Environment-variable access.

pkgs/npm/[email protected]/lib/json.js:1346

    var execVm = Boolean(process.env.JSON_EXEC &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #81ca0fdede3e8c7d — Environment-variable access.

pkgs/npm/[email protected]/lib/json.js:1347

        process.env.JSON_EXEC === 'vm');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

prettier

npm dependency

expand_more 57 low-confidence finding(s)

low env_fs dependency Excluded from app score #bd4c7f8fc4cb5ab2 — Environment-variable access.

pkgs/npm/[email protected]/bin/prettier.cjs:66

if (process.env.PRETTIER_EXPERIMENTAL_CLI || index !== -1) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #848c7285f6747291 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli-worker.mjs:10

import { createWriteStream } from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #55c401ea2b3dae90 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli-worker.mjs:15

import fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ab06960ac4fa4c98 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli-worker.mjs:371

  return dist_default.retry.readFile(retryOptions)(filePath, options);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff350cd892787dff — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli-worker.mjs:516

import { statSync, realpathSync } from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d32dbf0dd565de83 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli-worker.mjs:526

import fs2 from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0d874fc244b7430a — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli-worker.mjs:878

    string2 = fs2.readFileSync(path3.toNamespacedPath(jsonPath), "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f927d8476c3ee144 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli-worker.mjs:1878

import fs3 from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #62c794ce604f2e6e — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli-worker.mjs:1955

          const content = fs3.readFileSync(filePath, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5fab438aa0b84a9e — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli-worker.mjs:1961

          return fs3.writeFileSync(filePath, content);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #35fdf3137bf731f7 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:54

import fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2356f1b5e4c2bdd0 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:96

import fs2 from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b6bd33b3b06957a6 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:107

      const buffer2 = attempt(() => fs2.readFileSync(path18), Buffer2.alloc(0));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #288283e116fa8c57 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:116

import fs3 from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #156c6ff489e4889b — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:612

import fs4 from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #61066083609d625b — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:627

              const content = fs4.readFileSync(filePath, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f02feff8386ee96a — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:633

              return fs4.writeFileSync(filePath, content);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7e5e7993e932215e — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:2515

import fs5 from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #536bf57288003db0 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:2525

    string2 = fs5.readFileSync(path4.toNamespacedPath(jsonPath), "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ee165e44b5daaf25 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:2743

import { statSync, realpathSync } from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #04df5a3741b588c8 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:3607

import fs6 from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #839ff4a39cc80e9a — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:4855

import fs7 from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0a65c03cd11324b5 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:5794

import fs8 from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d8485c7b12340bc7 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:5820

          const store = JSON.parse(fs8.readFileSync(this.storePath, "utf8"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #35cfc07f1af3e30d — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:5835

          fs8.writeFileSync(this.storePath, store);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #602ce95c896cebf2 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:5850

          const content = fs8.readFileSync(filePath);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c9aec398f7afcf91 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:6238

import fs9 from "fs/promises";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #208f003464a506db — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:6252

        return fs9.readFile(filePath, "utf8").then(parse_default2).catch(noop2);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #be83b874cec5e718 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:6582

import fs10 from "fs/promises";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #67c7d7ce5a90b54d — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:6594

      return fs10.readFile(filePath, "utf8").catch(noop2);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da6d493771f35fcc — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:10466

import fs11 from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2acad3a6f14ef0b9 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:10488

        const fileContent = fs11.readFileSync(filePath, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0214be199ad70315 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:10493

        const fileContent = fs11.readFileSync(filePath, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #586442235fa5b7e4 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:10499

        const fileBuffer = fs11.readFileSync(filePath);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #09c249b6c880f72c — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:10515

        const fileContent = fs11.readFileSync(filePath, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2d2f2d53c0e2ab5c — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:10521

        const fileContent = fs11.readFileSync(filePath, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #15f40617a9bd11fe — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:11366

import fs12 from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #46f1f286c2d13ff9 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:11559

import { createWriteStream } from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ddf4b6b20550f1ea — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:11567

  return dist_default36.retry.readFile(retryOptions)(filePath, options);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #700e287b45038736 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:12330

import fs13 from "fs/promises";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b49d723ac153d489 — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:12395

  const ignoreManualFilesContents = await Promise.all(ignoreManualFilesPaths.map((filePath) => fs13.readFile(filePath, "utf8").catch(() => "")));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d8efba436a84d8ba — Filesystem access.

pkgs/npm/[email protected]/internal/experimental-cli.mjs:12400

  const prettierManualFilesContents = await Promise.all(prettierManualFilesPaths.map((filePath) => fs13.readFile(filePath, "utf8")));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e48899381898cc44 — Filesystem access.

pkgs/npm/[email protected]/internal/legacy-cli.mjs:1233

import fs from "fs/promises";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #412a782dc92670f5 — Filesystem access.

pkgs/npm/[email protected]/internal/legacy-cli.mjs:1554

import fs9 from "fs/promises";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6250f34eaf4962ff — Filesystem access.

pkgs/npm/[email protected]/internal/legacy-cli.mjs:1778

import fs4 from "fs/promises";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7ba55925741b974f — Filesystem access.

pkgs/npm/[email protected]/internal/legacy-cli.mjs:1786

import fs3 from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #538db1fc05cbe3ed — Filesystem access.

pkgs/npm/[email protected]/internal/legacy-cli.mjs:1794

import fs2 from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #daf3977ed14650c1 — Filesystem access.

pkgs/npm/[email protected]/internal/legacy-cli.mjs:1888

    const data = await fs4.readFile(cacheFile, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b6baeb32dec1f513 — Filesystem access.

pkgs/npm/[email protected]/internal/legacy-cli.mjs:1906

import fs7 from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c8fc9f7cac71cf4b — Filesystem access.

pkgs/npm/[email protected]/internal/legacy-cli.mjs:1910

import fs6 from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #14faa41a055b96d2 — Filesystem access.

pkgs/npm/[email protected]/internal/legacy-cli.mjs:1914

import fs5 from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b684c99d4214f142 — Filesystem access.

pkgs/npm/[email protected]/internal/legacy-cli.mjs:4302

      const data = fs5.readFileSync(pathToFile, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e1a63c81cc9a6547 — Filesystem access.

pkgs/npm/[email protected]/internal/legacy-cli.mjs:4506

        fs5.writeFileSync(filePath, data);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b1c65582067b975a — Filesystem access.

pkgs/npm/[email protected]/internal/legacy-cli.mjs:4894

        const buffer = fs6.readFileSync(absolutePath);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2d307c9d6df75c57 — Filesystem access.

pkgs/npm/[email protected]/internal/legacy-cli.mjs:5188

import fs8 from "fs/promises";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d452755d928b4931 — Filesystem access.

pkgs/npm/[email protected]/internal/legacy-cli.mjs:5449

  writeFormattedFile: (file, data) => fs8.writeFile(file, data)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2d168f01920444d7 — Filesystem access.

pkgs/npm/[email protected]/internal/legacy-cli.mjs:5805

      input = await fs9.readFile(filename, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

react

npm dependency

expand_more 14 low-confidence finding(s)

low env_fs dependency Excluded from app score #7d303d43937c96ee — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-compiler-runtime.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4cb1d628a52d1b87 — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-jsx-dev-runtime.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aee1704f331c9551 — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-jsx-dev-runtime.react-server.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #331b925b6373156c — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-jsx-runtime.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7a0a90e656e9acc6 — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-jsx-runtime.react-server.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c164ed8669bb32e3 — Environment-variable access.

pkgs/npm/[email protected]/cjs/react.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b02947d128929e6 — Environment-variable access.

pkgs/npm/[email protected]/cjs/react.react-server.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a5d74154c74c334a — Environment-variable access.

pkgs/npm/[email protected]/compiler-runtime.js:10

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #07bd5c943134fa0b — Environment-variable access.

pkgs/npm/[email protected]/index.js:3

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #33bcc28a7b892141 — Environment-variable access.

pkgs/npm/[email protected]/jsx-dev-runtime.js:3

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #26b8f71e3fc9ea4a — Environment-variable access.

pkgs/npm/[email protected]/jsx-dev-runtime.react-server.js:3

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #563ec4c6e11c0d43 — Environment-variable access.

pkgs/npm/[email protected]/jsx-runtime.js:3

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b4a429fe449333c — Environment-variable access.

pkgs/npm/[email protected]/jsx-runtime.react-server.js:3

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5abd377f95f04c4f — Environment-variable access.

pkgs/npm/[email protected]/react.react-server.js:3

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

react-dom

npm dependency

expand_more 23 low-confidence finding(s)

low env_fs dependency Excluded from app score #79a9fcbe3d3a7dbb — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-dom-server-legacy.browser.development.js:36

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #80873ff30c86ee0f — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-dom-server-legacy.node.development.js:36

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ca26a557f1c12613 — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-dom-server.browser.development.js:36

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b74e58b8491d352b — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-dom-server.edge.development.js:36

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0703cdbf902cffa0 — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-dom-server.node.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ab0994b12eb667b8 — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-dom-test-utils.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b782ba014f67e4eb — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-dom.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #153f1d63f27b1e00 — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-dom.react-server.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #09c0212d20d87803 — Environment-variable access.

pkgs/npm/[email protected]/client.js:11

  if (process.env.NODE_ENV !== 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1b30591ed2bd2c0f — Environment-variable access.

pkgs/npm/[email protected]/client.js:31

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #33820115dd62f888 — Environment-variable access.

pkgs/npm/[email protected]/index.js:11

  if (process.env.NODE_ENV !== 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #11d859aa5e991530 — Environment-variable access.

pkgs/npm/[email protected]/index.js:31

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #71b3fe37aabc82a2 — Environment-variable access.

pkgs/npm/[email protected]/profiling.js:11

  if (process.env.NODE_ENV !== 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #31707fdee998033b — Environment-variable access.

pkgs/npm/[email protected]/profiling.js:31

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a5c27915c59900df — Environment-variable access.

pkgs/npm/[email protected]/react-dom.react-server.js:3

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #145a6cab603e4d22 — Environment-variable access.

pkgs/npm/[email protected]/server.browser.js:4

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #afe6912c3cf7a5ff — Environment-variable access.

pkgs/npm/[email protected]/server.bun.js:5

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7fd4cbc43f539693 — Environment-variable access.

pkgs/npm/[email protected]/server.edge.js:5

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #36695b4d60a3391a — Environment-variable access.

pkgs/npm/[email protected]/server.node.js:4

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0154f4bde532d61f — Environment-variable access.

pkgs/npm/[email protected]/static.browser.js:4

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e2a8711d9b5405d — Environment-variable access.

pkgs/npm/[email protected]/static.edge.js:4

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4618649c51d4488c — Environment-variable access.

pkgs/npm/[email protected]/static.node.js:4

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8bd3e1e7d7772dca — Environment-variable access.

pkgs/npm/[email protected]/test-utils.js:3

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

redux

npm dependency

expand_more 4 low-confidence finding(s)

low env_fs dependency Excluded from app score #ef9c10518a50b2f9 — Environment-variable access.

pkgs/npm/[email protected]/src/combineReducers.ts:131

    if (process.env.NODE_ENV !== 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #47c88bfad59f86ee — Environment-variable access.

pkgs/npm/[email protected]/src/combineReducers.ts:146

  if (process.env.NODE_ENV !== 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #019f1faa89aa46ba — Environment-variable access.

pkgs/npm/[email protected]/src/combineReducers.ts:165

    if (process.env.NODE_ENV !== 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a368b4cfb2bfaf6 — Environment-variable access.

pkgs/npm/[email protected]/src/utils/kindOf.ts:65

  if (process.env.NODE_ENV !== 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

shelljs

npm dependency

expand_more 72 low-confidence finding(s)

low env_fs dependency Excluded from app score #0ca3993d8cf24d75 — Filesystem access.

pkgs/npm/[email protected]/src/cat.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0ca3993d8cf24d75 — Filesystem access.

pkgs/npm/[email protected]/src/cat.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #367f12aa470c57de — Filesystem access.

pkgs/npm/[email protected]/src/cat.js:44

    cat += fs.readFileSync(file, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3c64242e05911416 — Environment-variable access.

pkgs/npm/[email protected]/src/cd.js:16

    if (!process.env.OLDPWD) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4e3b7522bcaabb9b — Environment-variable access.

pkgs/npm/[email protected]/src/cd.js:19

      dir = process.env.OLDPWD;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #348f38abdd3b7a30 — Environment-variable access.

pkgs/npm/[email protected]/src/cd.js:26

    process.env.OLDPWD = curDir;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #afb3d2f9c7d79059 — Filesystem access.

pkgs/npm/[email protected]/src/chmod.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #afb3d2f9c7d79059 — Filesystem access.

pkgs/npm/[email protected]/src/chmod.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7efd00a239b4bd2c — Filesystem access.

pkgs/npm/[email protected]/src/common.js:8

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7efd00a239b4bd2c — Filesystem access.

pkgs/npm/[email protected]/src/common.js:8

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6424bb88c3d61ba0 — Environment-variable access.

pkgs/npm/[email protected]/src/common.js:57

delete process.env.OLDPWD; // initially, there's no previous directory

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #76f636b0eefe5456 — Filesystem access.

pkgs/npm/[email protected]/src/cp.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #76f636b0eefe5456 — Filesystem access.

pkgs/npm/[email protected]/src/cp.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #75e4e0d3c5f8c855 — Filesystem access.

pkgs/npm/[email protected]/src/exec-child.js:2

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #75e4e0d3c5f8c855 — Filesystem access.

pkgs/npm/[email protected]/src/exec-child.js:2

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7d582e61339f766c — Filesystem access.

pkgs/npm/[email protected]/src/exec-child.js:7

  var serializedParams = fs.readFileSync(paramFilePath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d820885a7e71f6fe — Filesystem access.

pkgs/npm/[email protected]/src/exec.js:2

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d820885a7e71f6fe — Filesystem access.

pkgs/npm/[email protected]/src/exec.js:2

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #05a8e373da47a3aa — Filesystem access.

pkgs/npm/[email protected]/src/exec.js:71

    fs.writeFileSync(filePath, data, {
      encoding: 'utf8',
      mode: parseInt('600', 8),
    });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #811894e90f9d9ad2 — Filesystem access.

pkgs/npm/[email protected]/src/exec.js:113

    stdout = fs.readFileSync(stdoutFile);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #17bcf9a13722834b — Filesystem access.

pkgs/npm/[email protected]/src/exec.js:114

    stderr = fs.readFileSync(stderrFile);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5e1f4b4b83365133 — Filesystem access.

pkgs/npm/[email protected]/src/exec.js:116

    stdout = fs.readFileSync(stdoutFile, opts.encoding);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1bcb2a16b3c0560d — Filesystem access.

pkgs/npm/[email protected]/src/exec.js:117

    stderr = fs.readFileSync(stderrFile, opts.encoding);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #821d9e0f120966f6 — Filesystem access.

pkgs/npm/[email protected]/src/grep.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #821d9e0f120966f6 — Filesystem access.

pkgs/npm/[email protected]/src/grep.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4b8c8a15a5913b90 — Filesystem access.

pkgs/npm/[email protected]/src/grep.js:101

    var contents = file === '-' ? pipe : fs.readFileSync(file, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0af698d1e9db63e8 — Filesystem access.

pkgs/npm/[email protected]/src/head.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0af698d1e9db63e8 — Filesystem access.

pkgs/npm/[email protected]/src/head.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bb7e25857cd49996 — Filesystem access.

pkgs/npm/[email protected]/src/head.js:87

      contents = fs.readFileSync(file, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b64aa7fa180a8a10 — Filesystem access.

pkgs/npm/[email protected]/src/ln.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b64aa7fa180a8a10 — Filesystem access.

pkgs/npm/[email protected]/src/ln.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f0f71746ac156570 — Filesystem access.

pkgs/npm/[email protected]/src/ls.js:2

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f0f71746ac156570 — Filesystem access.

pkgs/npm/[email protected]/src/ls.js:2

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f2f72eaab6d830b3 — Filesystem access.

pkgs/npm/[email protected]/src/mkdir.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f2f72eaab6d830b3 — Filesystem access.

pkgs/npm/[email protected]/src/mkdir.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c377ee3c8157dbed — Filesystem access.

pkgs/npm/[email protected]/src/mv.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c377ee3c8157dbed — Filesystem access.

pkgs/npm/[email protected]/src/mv.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #baae0d2d5c25c6d0 — Filesystem access.

pkgs/npm/[email protected]/src/rm.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #baae0d2d5c25c6d0 — Filesystem access.

pkgs/npm/[email protected]/src/rm.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #80ff0da98ba6ac6a — Filesystem access.

pkgs/npm/[email protected]/src/sed.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #80ff0da98ba6ac6a — Filesystem access.

pkgs/npm/[email protected]/src/sed.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f50a35f3b577bc82 — Filesystem access.

pkgs/npm/[email protected]/src/sed.js:76

    var contents = file === '-' ? pipe : fs.readFileSync(file, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0a25d4ced2f7122f — Filesystem access.

pkgs/npm/[email protected]/src/sed.js:85

      fs.writeFileSync(file, result, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #087a852f649d9b42 — Filesystem access.

pkgs/npm/[email protected]/src/sort.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #087a852f649d9b42 — Filesystem access.

pkgs/npm/[email protected]/src/sort.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1fa8bfa3919ebeec — Filesystem access.

pkgs/npm/[email protected]/src/sort.js:85

    var contents = file === '-' ? pipe : fs.readFileSync(file, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c9279ced64a68c5 — Filesystem access.

pkgs/npm/[email protected]/src/tail.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c9279ced64a68c5 — Filesystem access.

pkgs/npm/[email protected]/src/tail.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eaa06e1565d04a20 — Filesystem access.

pkgs/npm/[email protected]/src/tail.js:70

    var contents = file === '-' ? pipe : fs.readFileSync(file, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #756b9a6b21b6f338 — Filesystem access.

pkgs/npm/[email protected]/src/tempdir.js:2

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #756b9a6b21b6f338 — Filesystem access.

pkgs/npm/[email protected]/src/tempdir.js:2

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9b165e747885480b — Filesystem access.

pkgs/npm/[email protected]/src/tempdir.js:18

    fs.writeFileSync(testFile, ' ');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ea5c8d4278b32eee — Environment-variable access.

pkgs/npm/[email protected]/src/tempdir.js:45

                  writeableDir(process.env.TMPDIR) ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e9dbda5f116c7cc5 — Environment-variable access.

pkgs/npm/[email protected]/src/tempdir.js:46

                  writeableDir(process.env.TEMP) ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #871c42f257ceabc3 — Environment-variable access.

pkgs/npm/[email protected]/src/tempdir.js:47

                  writeableDir(process.env.TMP) ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #766831fd756b18c0 — Environment-variable access.

pkgs/npm/[email protected]/src/tempdir.js:48

                  writeableDir(process.env.Wimp$ScrapDir) || // RiscOS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a5b2caf453ce22e9 — Filesystem access.

pkgs/npm/[email protected]/src/test.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a5b2caf453ce22e9 — Filesystem access.

pkgs/npm/[email protected]/src/test.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #986272d953ff4932 — Filesystem access.

pkgs/npm/[email protected]/src/to.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #986272d953ff4932 — Filesystem access.

pkgs/npm/[email protected]/src/to.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e1acea3a9e96e18b — Filesystem access.

pkgs/npm/[email protected]/src/to.js:31

    fs.writeFileSync(file, this.stdout || this.toString(), 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5a480af729b14aa6 — Filesystem access.

pkgs/npm/[email protected]/src/toEnd.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5a480af729b14aa6 — Filesystem access.

pkgs/npm/[email protected]/src/toEnd.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b8e0040f22df6147 — Filesystem access.

pkgs/npm/[email protected]/src/touch.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b8e0040f22df6147 — Filesystem access.

pkgs/npm/[email protected]/src/touch.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #96e0c1e17b49c3a7 — Filesystem access.

pkgs/npm/[email protected]/src/uniq.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #96e0c1e17b49c3a7 — Filesystem access.

pkgs/npm/[email protected]/src/uniq.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #384f2ee49bc5274a — Filesystem access.

pkgs/npm/[email protected]/src/uniq.js:58

  var lines = (input ? fs.readFileSync(input, 'utf8') : pipe)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b37c1f698cb1f14 — Filesystem access.

pkgs/npm/[email protected]/src/which.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b37c1f698cb1f14 — Filesystem access.

pkgs/npm/[email protected]/src/which.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2261897e2e134a8b — Environment-variable access.

pkgs/npm/[email protected]/src/which.js:62

  var pathArray = splitPath(process.env.PATH);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d438f7dfda3a445d — Environment-variable access.

pkgs/npm/[email protected]/src/which.js:74

      var pathExtEnv = process.env.PATHEXT || XP_DEFAULT_PATHEXT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

shx

npm dependency

expand_more 2 low-confidence finding(s)

low env_fs dependency Excluded from app score #050945570884006e — Filesystem access.

pkgs/npm/[email protected]/lib/shx.js:12

var _fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #050945570884006e — Filesystem access.

pkgs/npm/[email protected]/lib/shx.js:12

var _fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

typescript

npm dependency

expand_more 20 low-confidence finding(s)

low env_fs dependency Excluded from app score #558e9b12a36cf403 — Filesystem access.

pkgs/npm/[email protected]/lib/_tsserver.js:51

var import_fs = __toESM(require("fs"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1062c27e14cdabc7 — Environment-variable access.

pkgs/npm/[email protected]/lib/_tsserver.js:309

    const envLogOptions = parseLoggingEnvironmentString(process.env.TSS_LOG);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #005f5b90c52772b6 — Environment-variable access.

pkgs/npm/[email protected]/lib/_tsserver.js:535

  const traceDir = commandLineTraceDir ? (0, typescript_exports.stripQuotes)(commandLineTraceDir) : process.env.TSS_TRACE;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4c61011a840b2346 — Environment-variable access.

pkgs/npm/[email protected]/lib/_tsserver.js:548

        const basePath = process.env.LOCALAPPDATA || process.env.APPDATA || import_os.default.homedir && import_os.default.homedir() || process.env.USERPROFILE || process.env.HOMEDRIVE && process.env.HOMEPATH && (0, typescript_exports.normalizeSlashes)(process.env.HOMEDRIVE + process.env.HOMEPATH) || import_os.default.tmpdir();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4c61011a840b2346 — Environment-variable access.

pkgs/npm/[email protected]/lib/_tsserver.js:548

        const basePath = process.env.LOCALAPPDATA || process.env.APPDATA || import_os.default.homedir && import_os.default.homedir() || process.env.USERPROFILE || process.env.HOMEDRIVE && process.env.HOMEPATH && (0, typescript_exports.normalizeSlashes)(process.env.HOMEDRIVE + process.env.HOMEPATH) || import_os.default.tmpdir();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4c61011a840b2346 — Environment-variable access.

pkgs/npm/[email protected]/lib/_tsserver.js:548

        const basePath = process.env.LOCALAPPDATA || process.env.APPDATA || import_os.default.homedir && import_os.default.homedir() || process.env.USERPROFILE || process.env.HOMEDRIVE && process.env.HOMEPATH && (0, typescript_exports.normalizeSlashes)(process.env.HOMEDRIVE + process.env.HOMEPATH) || import_os.default.tmpdir();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4c61011a840b2346 — Environment-variable access.

pkgs/npm/[email protected]/lib/_tsserver.js:548

        const basePath = process.env.LOCALAPPDATA || process.env.APPDATA || import_os.default.homedir && import_os.default.homedir() || process.env.USERPROFILE || process.env.HOMEDRIVE && process.env.HOMEPATH && (0, typescript_exports.normalizeSlashes)(process.env.HOMEDRIVE + process.env.HOMEPATH) || import_os.default.tmpdir();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4c61011a840b2346 — Environment-variable access.

pkgs/npm/[email protected]/lib/_tsserver.js:548

        const basePath = process.env.LOCALAPPDATA || process.env.APPDATA || import_os.default.homedir && import_os.default.homedir() || process.env.USERPROFILE || process.env.HOMEDRIVE && process.env.HOMEPATH && (0, typescript_exports.normalizeSlashes)(process.env.HOMEDRIVE + process.env.HOMEPATH) || import_os.default.tmpdir();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4c61011a840b2346 — Environment-variable access.

pkgs/npm/[email protected]/lib/_tsserver.js:548

        const basePath = process.env.LOCALAPPDATA || process.env.APPDATA || import_os.default.homedir && import_os.default.homedir() || process.env.USERPROFILE || process.env.HOMEDRIVE && process.env.HOMEPATH && (0, typescript_exports.normalizeSlashes)(process.env.HOMEDRIVE + process.env.HOMEPATH) || import_os.default.tmpdir();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4c61011a840b2346 — Environment-variable access.

pkgs/npm/[email protected]/lib/_tsserver.js:548

        const basePath = process.env.LOCALAPPDATA || process.env.APPDATA || import_os.default.homedir && import_os.default.homedir() || process.env.USERPROFILE || process.env.HOMEDRIVE && process.env.HOMEPATH && (0, typescript_exports.normalizeSlashes)(process.env.HOMEDRIVE + process.env.HOMEPATH) || import_os.default.tmpdir();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e4e47171d2585d6f — Environment-variable access.

pkgs/npm/[email protected]/lib/_tsserver.js:565

    if (process.env.XDG_CACHE_HOME) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b6d2fdfab31b8b0 — Environment-variable access.

pkgs/npm/[email protected]/lib/_tsserver.js:566

      return process.env.XDG_CACHE_HOME;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #be3100aa555204ac — Environment-variable access.

pkgs/npm/[email protected]/lib/_tsserver.js:569

    const homePath = import_os.default.homedir && import_os.default.homedir() || process.env.HOME || (process.env.LOGNAME || process.env.USER) && `/${usersDir}/${process.env.LOGNAME || process.env.USER}` || import_os.default.tmpdir();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #be3100aa555204ac — Environment-variable access.

pkgs/npm/[email protected]/lib/_tsserver.js:569

    const homePath = import_os.default.homedir && import_os.default.homedir() || process.env.HOME || (process.env.LOGNAME || process.env.USER) && `/${usersDir}/${process.env.LOGNAME || process.env.USER}` || import_os.default.tmpdir();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #be3100aa555204ac — Environment-variable access.

pkgs/npm/[email protected]/lib/_tsserver.js:569

    const homePath = import_os.default.homedir && import_os.default.homedir() || process.env.HOME || (process.env.LOGNAME || process.env.USER) && `/${usersDir}/${process.env.LOGNAME || process.env.USER}` || import_os.default.tmpdir();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #be3100aa555204ac — Environment-variable access.

pkgs/npm/[email protected]/lib/_tsserver.js:569

    const homePath = import_os.default.homedir && import_os.default.homedir() || process.env.HOME || (process.env.LOGNAME || process.env.USER) && `/${usersDir}/${process.env.LOGNAME || process.env.USER}` || import_os.default.tmpdir();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #be3100aa555204ac — Environment-variable access.

pkgs/npm/[email protected]/lib/_tsserver.js:569

    const homePath = import_os.default.homedir && import_os.default.homedir() || process.env.HOME || (process.env.LOGNAME || process.env.USER) && `/${usersDir}/${process.env.LOGNAME || process.env.USER}` || import_os.default.tmpdir();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c93e3eab439cb32 — Filesystem access.

pkgs/npm/[email protected]/lib/_typingsInstaller.js:44

var fs = __toESM(require("fs"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #74fb6e93a443eabf — Filesystem access.

pkgs/npm/[email protected]/lib/_typingsInstaller.js:88

    const content = JSON.parse(host.readFile(typesRegistryFilePath));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d4cb76b9c669bf10 — Filesystem access.

pkgs/npm/[email protected]/lib/watchGuard.js:42

var fs = __toESM(require("fs"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

use-sync-external-store

npm dependency

expand_more 10 low-confidence finding(s)

low env_fs dependency Excluded from app score #d73f36039b060f6e — Environment-variable access.

pkgs/npm/[email protected]/cjs/use-sync-external-store-shim.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #29b18065d50edaee — Environment-variable access.

pkgs/npm/[email protected]/cjs/use-sync-external-store-shim.native.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aa2afc5f8807df99 — Environment-variable access.

pkgs/npm/[email protected]/cjs/use-sync-external-store-shim/with-selector.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1107f591d24243e1 — Environment-variable access.

pkgs/npm/[email protected]/cjs/use-sync-external-store-with-selector.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c652f2508a4a4dff — Environment-variable access.

pkgs/npm/[email protected]/cjs/use-sync-external-store.development.js:12

if ("production" !== process.env.NODE_ENV) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4b0558736cf4c63c — Environment-variable access.

pkgs/npm/[email protected]/index.js:3

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #40aa593cf10f9ea0 — Environment-variable access.

pkgs/npm/[email protected]/shim/index.js:3

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #925d18616e7812ba — Environment-variable access.

pkgs/npm/[email protected]/shim/index.native.js:3

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1fa68a12564f94f8 — Environment-variable access.

pkgs/npm/[email protected]/shim/with-selector.js:3

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ddb5e5c668b69b79 — Environment-variable access.

pkgs/npm/[email protected]/with-selector.js:3

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Development

@rollup/plugin-alias dev — dist-only: no readable source
@vitest/coverage-v8 dev — dist-only: no readable source
@vitest/eslint-plugin dev — dist-only: no readable source
eslint-plugin-testing-library dev — dist-only: no readable source
rollup dev — dist-only: no readable source
rollup-plugin-esbuild dev — dist-only: no readable source
typescript-eslint dev — dist-only: no readable source

verified_user No application data leak found

App Privacy Score

bar_chart Score Breakdown

list Scan Summary

swap_horiz Application data flows

</> Dependencies

esbuild

@redux-devtools/extension

@testing-library/react

eslint

eslint-plugin-import

eslint-plugin-react

eslint-plugin-react-hooks

immer

jsdom

json

prettier

react

react-dom

redux

shelljs

shx

typescript

use-sync-external-store

Skipped dependencies