Close Open Privacy Scan

link https://github.com/caolan/async

bolt Snapshot: commit 03fbed2

science engine v1

schedule 2026-06-27T15:04:27.274523+00:00

App Privacy Score

97 /100

Low privacy risk

Low risk · 201 finding(s)

Dependency score: 97 (Low risk)

bar_chart Score Breakdown

env_fs −3

list Scan Summary

0 high 0 medium 201 low

First-party packages: 1

Dependency packages: 20

Ecosystem: npm

swap_horiz Application data flows

No high- or medium-confidence application data-flow findings in this scan.

</> First-Party Code

first-party (npm)

npm first-party

expand_more 21 low-confidence finding(s)

low env_fs production #5ef88bd894ee6d14 — Filesystem access.

repo/perf/benchmark.js:6

var fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #5ef88bd894ee6d14 — Filesystem access.

repo/perf/benchmark.js:6

var fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #74e71bb381ada027 — Filesystem access.

repo/support/build.test.js:6

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #74e71bb381ada027 — Filesystem access.

repo/support/build.test.js:6

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #890de3259caa03fe — Filesystem access.

repo/support/generate-index.js:4

const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #890de3259caa03fe — Filesystem access.

repo/support/generate-index.js:4

const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8fac2bab27175ebd — Filesystem access.

repo/support/generate-index.js:17

        template: cb => fs.readFile(path.join(__dirname, './index-template.js'), 'utf8', cb),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #02080aa30b8972c4 — Filesystem access.

repo/support/generate-index.js:30

    fs.readFileSync(path.join(__dirname, 'aliases.txt'), 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a4d74cb1ece36316 — Filesystem access.

repo/support/jsdoc/jsdoc-fix-html.js:32

    fs.writeFile(filename, HTMLdata, callback);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ed60b6f2dc8cc292 — Filesystem access.

repo/support/jsdoc/jsdoc-fix-html.js:44

    fs.readFile(path.join(docsDir, mainModuleFile), 'utf8', (fileErr, mainModuleData) => {
        if (fileErr) return callback(fileErr);

        var $mainPage = $(mainModuleData);
        // each 'module' (category) has a separate page, with all of the
        // important information in a 'main' div. Combine all of these divs into
        // one on the actual module page (async)
        async.eachSeries(moduleFiles, (file, fileCallback) => {
            fs.readFile(path.join(docsDir, file), 'utf8', (err, moduleData) => {
                if (err) return fileCallback(err);
                var $modulePage = $(moduleData);
                var moduleName = $modulePage.find(sectionTitleClass).text();
                $modulePage.find(sectionTitleClass).attr('id', moduleName.toLowerCase());
                $mainPage.find(mainScrollableSection).append($modulePage.find(mainScrollableSection).html());
                return fileCallback();
            });
        }, (err) => {
            if (err) return callback(err);
            generateHTMLFile(path.join(docsDir, docFilename), $mainPage, callback);
        });
    });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e8ebde06761f697b — Filesystem access.

repo/support/jsdoc/jsdoc-fix-html.js:52

            fs.readFile(path.join(docsDir, file), 'utf8', (err, moduleData) => {
                if (err) return fileCallback(err);
                var $modulePage = $(moduleData);
                var moduleName = $modulePage.find(sectionTitleClass).text();
                $modulePage.find(sectionTitleClass).attr('id', moduleName.toLowerCase());
                $mainPage.find(mainScrollableSection).append($modulePage.find(mainScrollableSection).html());
                return fileCallback();
            });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #71f0ba4765f299e7 — Filesystem access.

repo/support/jsdoc/jsdoc-fix-html.js:155

        fs.readFile(filePath, 'utf8', (err, fileData) => {
            if (err) return fileCallback(err);
            var $file = $(applyPreCheerioFixes(fileData));

            var $vDropdown = $file.find('#version-dropdown');
            $vDropdown.find('.dropdown-toggle').contents().get(0).data = 'v'+VERSION+' ';
            $vDropdown.find('a[href="'+docFilename+'"]').text('v'+VERSION);

            fixToc(file, $file, moduleFiles);
            fixFooter($file);
            $file.find('[href="'+mainModuleFile+'"]').attr('href', docFilename);
            generateHTMLFile(filePath, $file, fileCallback);
        });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #06ce9c454737eacb — Filesystem access.

repo/support/jsdoc/theme/publish.js:224

    fs.writeFileSync(outpath, html, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #eded3c6c186fed96 — Filesystem access.

repo/support/jsdoc/theme/publish.js:240

                code: helper.htmlsafe( fs.readFileSync(sourceFiles[file].resolved, encoding) )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #fd95fbb84f3893af — Filesystem access.

repo/support/jsdoc/theme/publish.js:700

        fs.writeFileSync(tutorialPath, html, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #5df1a2ea919bad4e — Filesystem access.

repo/support/sync-cjs-package.js:3

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #5df1a2ea919bad4e — Filesystem access.

repo/support/sync-cjs-package.js:3

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2e56ebee0f9f427c — Filesystem access.

repo/support/sync-cjs-package.js:4

var json = JSON.parse(fs.readFileSync(__dirname + "/../package.json"), "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4228bac3c05f215d — Filesystem access.

repo/support/sync-es-package.js:3

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4228bac3c05f215d — Filesystem access.

repo/support/sync-es-package.js:3

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1061c5851b3c3df4 — Filesystem access.

repo/support/sync-es-package.js:4

var json = JSON.parse(fs.readFileSync(__dirname + "/../package.json"), "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

@babel/core

npm dependency

expand_more 17 low-confidence finding(s)

low env_fs dependency Excluded from app score #5d7861500f110253 — Filesystem access.

pkgs/npm/@[email protected]/lib/config/files/configuration.js:20

  const data = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5d7861500f110253 — Filesystem access.

pkgs/npm/@[email protected]/lib/config/files/configuration.js:20

  const data = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eb758995c268110c — Environment-variable access.

pkgs/npm/@[email protected]/lib/config/files/configuration.js:241

  const targetPath = process.env.BABEL_SHOW_CONFIG_FOR;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4986440ed44c64a4 — Filesystem access.

pkgs/npm/@[email protected]/lib/config/files/plugins.js:35

  const data = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4986440ed44c64a4 — Filesystem access.

pkgs/npm/@[email protected]/lib/config/files/plugins.js:35

  const data = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c935997e527f77e — Filesystem access.

pkgs/npm/@[email protected]/lib/config/files/utils.js:10

  const data = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c935997e527f77e — Filesystem access.

pkgs/npm/@[email protected]/lib/config/files/utils.js:10

  const data = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fa2fa44627d0b02c — Filesystem access.

pkgs/npm/@[email protected]/lib/config/files/utils.js:22

    return fn(filepath, yield* fs.readFile(filepath, "utf8"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e4197b45167e805 — Environment-variable access.

pkgs/npm/@[email protected]/lib/config/helpers/environment.js:8

  return process.env.BABEL_ENV || process.env.NODE_ENV || defaultValue;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e4197b45167e805 — Environment-variable access.

pkgs/npm/@[email protected]/lib/config/helpers/environment.js:8

  return process.env.BABEL_ENV || process.env.NODE_ENV || defaultValue;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2031e5208bde7a80 — Filesystem access.

pkgs/npm/@[email protected]/lib/gensync-utils/fs.js:8

  const data = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2031e5208bde7a80 — Filesystem access.

pkgs/npm/@[email protected]/lib/gensync-utils/fs.js:8

  const data = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fdadd388e4e44371 — Filesystem access.

pkgs/npm/@[email protected]/lib/transform-file.js:26

  const code = yield* fs.readFile(filename, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #099ede908ea35850 — Filesystem access.

pkgs/npm/@[email protected]/lib/transformation/normalize-file.js:8

  const data = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #099ede908ea35850 — Filesystem access.

pkgs/npm/@[email protected]/lib/transformation/normalize-file.js:8

  const data = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6dc73ab941d6bdb8 — Filesystem access.

pkgs/npm/@[email protected]/lib/transformation/normalize-file.js:88

          const inputMapContent = _fs().readFileSync(_path().resolve(_path().dirname(options.filename), match[1]), "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6e46dd5615a9b11b — Filesystem access.

pkgs/npm/@[email protected]/src/transform-file.ts:26

  const code = yield* fs.readFile(filename, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

babel-minify

npm dependency

expand_more 2 low-confidence finding(s)

low env_fs dependency Excluded from app score #03846f3c704891bd — Filesystem access.

pkgs/npm/[email protected]/lib/fs.js:13

const fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #03846f3c704891bd — Filesystem access.

pkgs/npm/[email protected]/lib/fs.js:13

const fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

babel-plugin-istanbul

npm dependency

expand_more 5 low-confidence finding(s)

low env_fs dependency Excluded from app score #b3f2d7f5560bcdf3 — Filesystem access.

pkgs/npm/[email protected]/lib/index.js:8

var _fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b3f2d7f5560bcdf3 — Filesystem access.

pkgs/npm/[email protected]/lib/index.js:8

var _fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9bfbe6ff1532207a — Environment-variable access.

pkgs/npm/[email protected]/lib/index.js:52

  const cwd = getRealpath(opts.cwd || process.env.NYC_CWD || /* istanbul ignore next */process.cwd());

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7badf46a86192cdd — Environment-variable access.

pkgs/npm/[email protected]/lib/index.js:64

  if (ignored.length === 0 && process.env.NYC_CONFIG) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7785bc14353324b1 — Environment-variable access.

pkgs/npm/[email protected]/lib/index.js:66

    return JSON.parse(process.env.NYC_CONFIG);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

babel-register

npm dependency

expand_more 10 low-confidence finding(s)

low env_fs dependency Excluded from app score #6ede656210a7c871 — Filesystem access.

pkgs/npm/[email protected]/lib/cache.js:17

var _fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6ede656210a7c871 — Filesystem access.

pkgs/npm/[email protected]/lib/cache.js:17

var _fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e46415b4d3f30f2c — Environment-variable access.

pkgs/npm/[email protected]/lib/cache.js:29

var FILENAME = process.env.BABEL_CACHE_PATH || _path2.default.join(_homeOrTmp2.default, ".babel.json");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d3f0a8d163337780 — Filesystem access.

pkgs/npm/[email protected]/lib/cache.js:48

  _fs2.default.writeFileSync(FILENAME, serialised);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d1c208a234b20528 — Environment-variable access.

pkgs/npm/[email protected]/lib/cache.js:52

  if (process.env.BABEL_DISABLE_CACHE) return;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b13222e6fbfa0788 — Filesystem access.

pkgs/npm/[email protected]/lib/cache.js:60

    data = JSON.parse(_fs2.default.readFileSync(FILENAME));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0244369567a9899b — Filesystem access.

pkgs/npm/[email protected]/lib/node.js:51

var _fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0244369567a9899b — Filesystem access.

pkgs/npm/[email protected]/lib/node.js:51

var _fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #26b4f4b62577dbfe — Environment-variable access.

pkgs/npm/[email protected]/lib/node.js:107

  var env = process.env.BABEL_ENV || process.env.NODE_ENV;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #26b4f4b62577dbfe — Environment-variable access.

pkgs/npm/[email protected]/lib/node.js:107

  var env = process.env.BABEL_ENV || process.env.NODE_ENV;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

bluebird

npm dependency

expand_more 3 low-confidence finding(s)

low env_fs dependency Excluded from app score #f71f860d43868015 — Environment-variable access.

pkgs/npm/[email protected]/js/browser/bluebird.core.js:3812

    return hasEnvVariables ? process.env[key] : undefined;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #588e86157c62d6eb — Environment-variable access.

pkgs/npm/[email protected]/js/browser/bluebird.js:5676

    return hasEnvVariables ? process.env[key] : undefined;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4423ba96b63c77cd — Environment-variable access.

pkgs/npm/[email protected]/js/release/util.js:322

    return hasEnvVariables ? process.env[key] : undefined;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

browserify

npm dependency

expand_more 7 low-confidence finding(s)

low env_fs dependency Excluded from app score #593b2a32987fde37 — Environment-variable access.

pkgs/npm/[email protected]/bin/args.js:219

                    acc[key] = process.env[key];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #db5aea97aef3130b — Filesystem access.

pkgs/npm/[email protected]/bin/cmd.js:2

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #db5aea97aef3130b — Filesystem access.

pkgs/npm/[email protected]/bin/cmd.js:2

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #29e54cd3ace0cfea — Filesystem access.

pkgs/npm/[email protected]/example/source_maps/build.js:1

var browserify = require('../..'),
    path = require('path'),
    fs = require('fs'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #27601c1577f200da — Filesystem access.

pkgs/npm/[email protected]/example/source_maps/build.js:3

    fs = require('fs'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e63e4ff6a9974cbd — Filesystem access.

pkgs/npm/[email protected]/index.js:31

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e63e4ff6a9974cbd — Filesystem access.

pkgs/npm/[email protected]/index.js:31

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

eslint

npm dependency

expand_more 13 low-confidence finding(s)

low env_fs dependency Excluded from app score #c2526b8d1ab9f35f — Filesystem access.

pkgs/npm/[email protected]/lib/cli-engine/lint-result-cache.js:129

			results.source = fs.readFileSync(filePath, "utf-8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0d2b1ff1c55050ed — Filesystem access.

pkgs/npm/[email protected]/lib/cli.js:133

			await writeFile(filePath, output);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0f5279637e5d8459 — Filesystem access.

pkgs/npm/[email protected]/lib/eslint/eslint-helpers.js:1281

		const text = await fsp.readFile(filePath, {
			encoding: "utf8",
			signal: controller?.signal,
		});

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a2e3e231d58e1764 — Environment-variable access.

pkgs/npm/[email protected]/lib/eslint/eslint-helpers.js:1326

	if (!process.env.ESLINT_FLAGS) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2078ca26ff0cf270 — Environment-variable access.

pkgs/npm/[email protected]/lib/eslint/eslint-helpers.js:1330

	const envFlags = process.env.ESLINT_FLAGS.trim().split(/\s*,\s*/gu);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #14015367b428993d — Filesystem access.

pkgs/npm/[email protected]/lib/eslint/eslint.js:825

					retrier.retry(() => fs.writeFile(r.filePath, r.output)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9c56c9ccbea9f53e — Environment-variable access.

pkgs/npm/[email protected]/lib/linter/timing.js:44

const enabled = !!process.env.TIMING;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b6e8923d750d46cc — Environment-variable access.

pkgs/npm/[email protected]/lib/linter/timing.js:56

	if (typeof process.env.TIMING !== "string") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c51015333e50e9b7 — Environment-variable access.

pkgs/npm/[email protected]/lib/linter/timing.js:60

	if (process.env.TIMING.toLowerCase() === "all") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #400c055ec6462344 — Environment-variable access.

pkgs/npm/[email protected]/lib/linter/timing.js:64

	const TIMING_ENV_VAR_AS_INTEGER = Number.parseInt(process.env.TIMING, 10);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #05cc4ba9715dbec5 — Filesystem access.

pkgs/npm/[email protected]/lib/rule-tester/rule-tester.js:697

				let content = readFileSync(sourceFile, "utf8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #952279d8d67255a7 — Filesystem access.

pkgs/npm/[email protected]/lib/services/suppressions-service.js:217

			const data = await fs.promises.readFile(this.filePath, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe239c1ed8011269 — Filesystem access.

pkgs/npm/[email protected]/lib/services/suppressions-service.js:240

		return fs.promises.writeFile(
			this.filePath,
			stringify(suppressions, { space: 2 }),
		);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

fs-extra

npm dependency

expand_more 5 low-confidence finding(s)

low env_fs dependency Excluded from app score #765915c741daa4ab — Filesystem access.

pkgs/npm/[email protected]/lib/ensure/file.js:24

      await fs.writeFile(file, '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0bf556f10c1f5710 — Filesystem access.

pkgs/npm/[email protected]/lib/ensure/file.js:32

    await fs.writeFile(file, '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a337e8a7714c1776 — Filesystem access.

pkgs/npm/[email protected]/lib/ensure/file.js:60

  fs.writeFileSync(file, '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #558914a0dd4d8824 — Filesystem access.

pkgs/npm/[email protected]/lib/output-file/index.js:16

  return fs.writeFile(file, data, encoding)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #99c9d97ca54cfeec — Filesystem access.

pkgs/npm/[email protected]/lib/output-file/index.js:25

  fs.writeFileSync(file, ...args)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

jsdoc

npm dependency

expand_more 19 low-confidence finding(s)

low env_fs dependency Excluded from app score #a1f35f5a0b1aed17 — Filesystem access.

pkgs/npm/[email protected]/cli.js:33

        const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a1f35f5a0b1aed17 — Filesystem access.

pkgs/npm/[email protected]/cli.js:33

        const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c1e60c965b3989e1 — Filesystem access.

pkgs/npm/[email protected]/cli.js:37

        const info = JSON.parse( stripBom.strip(fs.readFileSync(path.join(env.dirname, 'package.json'),
            'utf8')) );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5cbf989181cb04d7 — Filesystem access.

pkgs/npm/[email protected]/cli.js:95

                    config = fs.readFileSync(confPath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #85015b25a86c3333 — Filesystem access.

pkgs/npm/[email protected]/cli.js:248

            return stripJsonComments( fs.readFileSync(filepath, 'utf8') );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #97120a8fcf8b7f6c — Filesystem access.

pkgs/npm/[email protected]/jsdoc.js:5

    const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #97120a8fcf8b7f6c — Filesystem access.

pkgs/npm/[email protected]/jsdoc.js:5

    const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ccd682ef1e0bf684 — Filesystem access.

pkgs/npm/[email protected]/lib/jsdoc/fs.js:5

const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ccd682ef1e0bf684 — Filesystem access.

pkgs/npm/[email protected]/lib/jsdoc/fs.js:5

const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #37721c5ae308ef16 — Filesystem access.

pkgs/npm/[email protected]/lib/jsdoc/path.js:6

const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #37721c5ae308ef16 — Filesystem access.

pkgs/npm/[email protected]/lib/jsdoc/path.js:6

const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7163d8474fd64edc — Filesystem access.

pkgs/npm/[email protected]/lib/jsdoc/readme.js:17

        const content = fs.readFileSync(path, env.opts.encoding);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d43b8c9513454a21 — Filesystem access.

pkgs/npm/[email protected]/lib/jsdoc/src/parser.js:194

                    sourceCode = fs.readFileSync(filename, encoding);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a46e635bb3b991aa — Filesystem access.

pkgs/npm/[email protected]/lib/jsdoc/template.js:34

        return _.template(fs.readFileSync(file, 'utf8'), null, this.settings);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6c3cfa361a3099ea — Filesystem access.

pkgs/npm/[email protected]/lib/jsdoc/tutorial/resolver.js:111

            content = fs.readFileSync(file, env.opts.encoding);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f5c10f716af1059e — Filesystem access.

pkgs/npm/[email protected]/plugins/partial.js:25

            const partialData = fs.readFileSync(fullPath, env.opts.encoding);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #92edc7994ab9a702 — Filesystem access.

pkgs/npm/[email protected]/templates/default/publish.js:237

    fs.writeFileSync(outpath, html, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b092ba024cd4889e — Filesystem access.

pkgs/npm/[email protected]/templates/default/publish.js:251

                code: helper.htmlsafe( fs.readFileSync(sourceFiles[file].resolved, encoding) )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3948f59d0f8ee87b — Filesystem access.

pkgs/npm/[email protected]/templates/default/publish.js:680

        fs.writeFileSync(tutorialPath, html, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

karma

npm dependency

expand_more 20 low-confidence finding(s)

low env_fs dependency Excluded from app score #e97e62a704de7002 — Environment-variable access.

pkgs/npm/[email protected]/lib/completion.js:88

      count: parseInt(process.env.COMP_CWORD, 10),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a0863c2249577349 — Filesystem access.

pkgs/npm/[email protected]/lib/completion.js:98

  fs.readFile(path.resolve(__dirname, '../scripts/karma-completion.sh'), 'utf8', function (err, data) {
    if (err) return console.error(err)

    process.stdout.write(data)
    process.stdout.on('error', function (error) {
      // Darwin is a real dick sometimes.
      //
      // This is necessary because the "source" or "." program in
      // bash on OS X closes its file argument before reading
      // from it, meaning that you get exactly 1 write, which will
      // work most of the time, and will always raise an EPIPE.
      //
      // Really, one should not be tossing away EPIPE errors, or any
      // errors, so casually.  But, without this, `. <(karma completion)`
      // can never ever work on OS X.
      if (error.errno === 'EPIPE') {
        error = null
      }
    })
  })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #86f08a02bf023364 — Filesystem access.

pkgs/npm/[email protected]/lib/constants.js:6

const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '/../package.json')).toString())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #02b8012872a6a6f2 — Environment-variable access.

pkgs/npm/[email protected]/lib/constants.js:10

exports.DEFAULT_PORT = process.env.PORT || 9876

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #00c5d6cfaf3eae9d — Environment-variable access.

pkgs/npm/[email protected]/lib/constants.js:11

exports.DEFAULT_HOSTNAME = process.env.IP || 'localhost'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4513d9338c489b4b — Environment-variable access.

pkgs/npm/[email protected]/lib/constants.js:12

exports.DEFAULT_LISTEN_ADDR = process.env.LISTEN_ADDR || '0.0.0.0'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ce69b16847e3a8d4 — Filesystem access.

pkgs/npm/[email protected]/lib/detached.js:3

const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ce69b16847e3a8d4 — Filesystem access.

pkgs/npm/[email protected]/lib/detached.js:3

const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1285b09b6cd7c56f — Filesystem access.

pkgs/npm/[email protected]/lib/detached.js:7

const fileContents = fs.readFileSync(configurationFile, 'utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #341296cc91f5ee5e — Filesystem access.

pkgs/npm/[email protected]/lib/init/formatters.js:48

    return FileUtils
      .readFile(this.TEMPLATE_FILE_PATH)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #25d82e0a9723a33b — Filesystem access.

pkgs/npm/[email protected]/lib/middleware/common.js:66

    return fs.readFile(filepath, function (error, data) {
      if (error) {
        return serve404(response, filepath)
      }

      if (!doNotCache) {
        cache[filepath] = data.toString()
      }

      log.debug('serving: ' + filepath)
      response.setHeader('Content-Type', mime.getType(filepath, 'text/plain'))
      responseData = (transform && transform(data.toString())) || data
      response.writeHead(rangeHeader ? convertForRangeRequest() : 200)

      return response.end(responseData)
    })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da5930fcc5a2b5d1 — Filesystem access.

pkgs/npm/[email protected]/lib/server.js:8

const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da5930fcc5a2b5d1 — Filesystem access.

pkgs/npm/[email protected]/lib/server.js:8

const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6c664cc0f43bed6c — Filesystem access.

pkgs/npm/[email protected]/lib/server.js:417

      fs.writeFileSync(tmpFile.name, JSON.stringify(config), 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #273350c8fd742258 — Filesystem access.

pkgs/npm/[email protected]/lib/utils/file-utils.js:7

    return fs.readFileSync(path).toString()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d343b96937488e03 — Filesystem access.

pkgs/npm/[email protected]/lib/utils/file-utils.js:11

    fs.writeFileSync(path, content)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f2373b6310696a36 — Filesystem access.

pkgs/npm/[email protected]/lib/utils/file-utils.js:15

    FileUtils.saveFile(dest, FileUtils.readFile(src))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #1caa88264abd3172 — Filesystem access.

pkgs/npm/[email protected]/scripts/client.js:3

const { createWriteStream } = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #1caa88264abd3172 — Filesystem access.

pkgs/npm/[email protected]/scripts/client.js:3

const { createWriteStream } = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #c6de569e32e78147 — Filesystem access.

pkgs/npm/[email protected]/scripts/client.js:4

const { readFile } = require('fs').promises

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

karma-browserify

npm dependency

expand_more 5 low-confidence finding(s)

low env_fs dependency Excluded from app score #117319d980e18e79 — Filesystem access.

pkgs/npm/[email protected]/lib/bro.js:20

var path = require('path'),
    fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #993db9559996c275 — Filesystem access.

pkgs/npm/[email protected]/lib/bro.js:21

    fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #226689fb75604683 — Filesystem access.

pkgs/npm/[email protected]/lib/bundle-file.js:3

var fs = require('fs'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #226689fb75604683 — Filesystem access.

pkgs/npm/[email protected]/lib/bundle-file.js:3

var fs = require('fs'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9590e80bb613ccf1 — Filesystem access.

pkgs/npm/[email protected]/lib/bundle-file.js:23

    fs.writeFileSync(location, content);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

karma-firefox-launcher

npm dependency

expand_more 11 low-confidence finding(s)

low env_fs dependency Excluded from app score #803f254133908fe3 — Filesystem access.

pkgs/npm/[email protected]/index.js:3

const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #803f254133908fe3 — Filesystem access.

pkgs/npm/[email protected]/index.js:3

const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #64c0333924cb7d04 — Environment-variable access.

pkgs/npm/[email protected]/index.js:65

  const paden = process.env.Path.split(';')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #401d8215319b6f3f — Environment-variable access.

pkgs/npm/[email protected]/index.js:76

  const prefixes = [process.env.PROGRAMFILES, process.env['PROGRAMFILES(X86)']]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #401d8215319b6f3f — Environment-variable access.

pkgs/npm/[email protected]/index.js:76

  const prefixes = [process.env.PROGRAMFILES, process.env['PROGRAMFILES(X86)']]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3dc66f485c308698 — Environment-variable access.

pkgs/npm/[email protected]/index.js:121

  for (const pathElem of process.env.PATH.split(':')) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #32a5f04e2fac2d64 — Environment-variable access.

pkgs/npm/[email protected]/index.js:182

      homeBin = path.join(process.env.HOME, bin)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #51555178e5630524 — Filesystem access.

pkgs/npm/[email protected]/index.js:244

        const extBuffer = fs.readFileSync(ext)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c11d4b94002e52d3 — Filesystem access.

pkgs/npm/[email protected]/index.js:246

        fs.writeFileSync(copyDestination, extBuffer)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #44138322a5b32213 — Filesystem access.

pkgs/npm/[email protected]/index.js:250

    fs.writeFileSync(path.join(profilePath, 'prefs.js'), this._getPrefs(args.prefs))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a0b58287eb5811da — Environment-variable access.

pkgs/npm/[email protected]/index.js:266

    process.env.MOZ_DEBUG_BROWSER_PAUSE = 0

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

karma-mocha

npm dependency

expand_more 3 low-confidence finding(s)

low env_fs dependency Excluded from app score #62be6bb9f024b1d5 — Filesystem access.

pkgs/npm/[email protected]/lib/index.js:45

  var fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #62be6bb9f024b1d5 — Filesystem access.

pkgs/npm/[email protected]/lib/index.js:45

  var fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9d0fafee6807b169 — Filesystem access.

pkgs/npm/[email protected]/lib/index.js:50

  return extend(normalizeOpts(minimist(fs.readFileSync(optsPath, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

karma-safari-launcher

npm dependency

expand_more 5 low-confidence finding(s)

low env_fs dependency Excluded from app score #9f7dcb7000be6420 — Filesystem access.

pkgs/npm/[email protected]/index.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9f7dcb7000be6420 — Filesystem access.

pkgs/npm/[email protected]/index.js:1

var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #44622f5e0329bcf0 — Filesystem access.

pkgs/npm/[email protected]/index.js:12

    fs.readFile(HTML_TPL, function(err, data) {
      var content = data.toString().replace('%URL%', url);
      var staticHtmlPath = self._tempDir + '/redirect.html';

      fs.writeFile(staticHtmlPath, content, function(err) {
        self._execCommand(self._getCommand(), [staticHtmlPath]);
      });
    });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a084c2d74445f60b — Filesystem access.

pkgs/npm/[email protected]/index.js:16

      fs.writeFile(staticHtmlPath, content, function(err) {
        self._execCommand(self._getCommand(), [staticHtmlPath]);
      });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1f71c29ea00ea985 — Environment-variable access.

pkgs/npm/[email protected]/index.js:28

    win32: process.env['ProgramFiles(x86)'] + '\\Safari\\Safari.exe'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

mocha

npm dependency

expand_more 16 low-confidence finding(s)

low env_fs dependency Excluded from app score #2cdb87c92554dfd6 — Filesystem access.

pkgs/npm/[email protected]/lib/cli/config.js:39

    require("js-yaml").load(fs.readFileSync(filepath, "utf8")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4b4017ee7bd11293 — Filesystem access.

pkgs/npm/[email protected]/lib/cli/config.js:55

      require("strip-json-comments")(fs.readFileSync(filepath, "utf8")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c7dc394447f9fc2b — Filesystem access.

pkgs/npm/[email protected]/lib/cli/init.js:27

  const css = fs.readFileSync(path.join(srcdir, "mocha.css"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #19c8a91bf9b778d1 — Filesystem access.

pkgs/npm/[email protected]/lib/cli/init.js:28

  const js = fs.readFileSync(path.join(srcdir, "mocha.js"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c1c9c079578ec1eb — Filesystem access.

pkgs/npm/[email protected]/lib/cli/init.js:29

  const tmpl = fs.readFileSync(
    path.join(srcdir, "lib", "browser", "template.html"),
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9f217591265518b1 — Filesystem access.

pkgs/npm/[email protected]/lib/cli/init.js:32

  fs.writeFileSync(path.join(destdir, "mocha.css"), css);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ad4c7107ce160a04 — Filesystem access.

pkgs/npm/[email protected]/lib/cli/init.js:33

  fs.writeFileSync(path.join(destdir, "mocha.js"), js);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b9c86c225db08ac3 — Filesystem access.

pkgs/npm/[email protected]/lib/cli/init.js:34

  fs.writeFileSync(path.join(destdir, "tests.spec.js"), "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7463cc627f560a4c — Filesystem access.

pkgs/npm/[email protected]/lib/cli/init.js:35

  fs.writeFileSync(path.join(destdir, "index.html"), tmpl);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e5091491fbe0d657 — Filesystem access.

pkgs/npm/[email protected]/lib/cli/options.js:240

      configData = fs.readFileSync(filepath, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ad0df563549ecb4b — Environment-variable access.

pkgs/npm/[email protected]/lib/cli/options.js:302

  const envConfig = parse(process.env.MOCHA_OPTIONS || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3cb36b43457daeb3 — Environment-variable access.

pkgs/npm/[email protected]/lib/reporters/base.js:58

  (supportsColor.stdout || process.env.MOCHA_COLORS !== undefined);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b52db5701c5383c4 — Filesystem access.

pkgs/npm/[email protected]/lib/reporters/json.js:90

        fs.writeFileSync(output, json);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f056deb172388d80 — Environment-variable access.

pkgs/npm/[email protected]/mocha.js:13123

  		r = process.env.DEBUG;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #44875fd91c8596e4 — Environment-variable access.

pkgs/npm/[email protected]/mocha.js:16339

    (supportsColor.stdout || process.env.MOCHA_COLORS !== undefined);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c93ea4d1a7e02516 — Filesystem access.

pkgs/npm/[email protected]/mocha.js:17472

          fs.writeFileSync(output, json);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

native-promise-only

npm dependency

expand_more 3 low-confidence finding(s)

low env_fs dependency Excluded from app score #ed49f9b11c8dec8f — Filesystem access.

pkgs/npm/[email protected]/build.js:3

var fs = require("fs"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ed49f9b11c8dec8f — Filesystem access.

pkgs/npm/[email protected]/build.js:3

var fs = require("fs"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eb73bbf1ae9ce820 — Filesystem access.

pkgs/npm/[email protected]/build.js:23

	fs.writeFileSync(
		path.join(__dirname,"npo.js"),
		result.code + "\n",
		{ encoding: "utf8" }
	);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

nyc

npm dependency

expand_more 31 low-confidence finding(s)

low env_fs dependency Excluded from app score #92747013710338b0 — Filesystem access.

pkgs/npm/[email protected]/bin/nyc.js:10

const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #92747013710338b0 — Filesystem access.

pkgs/npm/[email protected]/bin/nyc.js:10

const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8cd4c43ad5eb7a41 — Environment-variable access.

pkgs/npm/[email protected]/bin/nyc.js:53

    env.BABEL_DISABLE_CACHE = process.env.BABEL_DISABLE_CACHE = '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cc1e28be510454cd — Environment-variable access.

pkgs/npm/[email protected]/bin/nyc.js:81

    env.SPAWN_WRAP_SHIM_ROOT = process.env.SPAWN_WRAP_SHIM_ROOT || process.env.XDG_CACHE_HOME || require('os').homedir()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cc1e28be510454cd — Environment-variable access.

pkgs/npm/[email protected]/bin/nyc.js:81

    env.SPAWN_WRAP_SHIM_ROOT = process.env.SPAWN_WRAP_SHIM_ROOT || process.env.XDG_CACHE_HOME || require('os').homedir()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #042552b1b100ff9c — Filesystem access.

pkgs/npm/[email protected]/index.js:190

        const source = await fs.readFile(filename, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d84e757860723678 — Filesystem access.

pkgs/npm/[email protected]/index.js:218

      const inCode = await fs.readFile(inFile, 'utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #82a24eddcfe62389 — Filesystem access.

pkgs/npm/[email protected]/index.js:226

        await fs.writeFile(outFile, outCode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9dae98147ec2eb6c — Environment-variable access.

pkgs/npm/[email protected]/index.js:353

    if (!process.env.NYC_CWD) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2a4b5bca899d80f1 — Environment-variable access.

pkgs/npm/[email protected]/index.js:375

    process.env.NYC_PROCESS_ID = this.processInfo.uuid

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d8763bb7e36e8660 — Filesystem access.

pkgs/npm/[email protected]/index.js:409

    fs.writeFileSync(
      coverageFilename,
      JSON.stringify(coverage),
      'utf-8'
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ef16395034ea91ec — Filesystem access.

pkgs/npm/[email protected]/index.js:514

      const report = JSON.parse(await fs.readFile(path.resolve(baseDirectory, filename)), 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #79de824cb9f91bc3 — Environment-variable access.

pkgs/npm/[email protected]/lib/commands/check-coverage.js:19

  process.env.NYC_CWD = process.cwd()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f925f45b06a87299 — Environment-variable access.

pkgs/npm/[email protected]/lib/commands/merge.js:33

  process.env.NYC_CWD = process.cwd()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #75cedda4966e1113 — Filesystem access.

pkgs/npm/[email protected]/lib/commands/merge.js:44

  await fs.writeFile(argv.outputFile, JSON.stringify(map), 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #85c407e545242b77 — Environment-variable access.

pkgs/npm/[email protected]/lib/commands/report.js:19

  process.env.NYC_CWD = process.cwd()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8a5c7f3519320ef0 — Environment-variable access.

pkgs/npm/[email protected]/lib/config-util.js:12

  cwd = cwd || process.env.NYC_CWD || process.cwd()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1368c8f07489c6b1 — Filesystem access.

pkgs/npm/[email protected]/lib/fs-promises.js:3

const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1368c8f07489c6b1 — Filesystem access.

pkgs/npm/[email protected]/lib/fs-promises.js:3

const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #90eb5f1ae2f1960c — Environment-variable access.

pkgs/npm/[email protected]/lib/register-env.js:21

    envToCopy[env] = process.env[env]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1131c25a0f3f40b5 — Environment-variable access.

pkgs/npm/[email protected]/lib/register-env.js:26

  envToCopy[envName] = process.env[envName]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4d958c76a2e1d4d8 — Filesystem access.

pkgs/npm/[email protected]/lib/source-maps.js:43

      fs.writeFileSync(mapPath, JSON.stringify(sourceMap))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c8bc4267bfc46cbb — Filesystem access.

pkgs/npm/[email protected]/lib/source-maps.js:68

            this.loadedMaps[hash] = JSON.parse(await fs.readFile(mapPath, 'utf8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e29d5e419b6cd14e — Environment-variable access.

pkgs/npm/[email protected]/lib/wrap.js:6

  process.env.NYC_CONFIG ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bbd6da6893a3bc44 — Environment-variable access.

pkgs/npm/[email protected]/lib/wrap.js:15

  parent: process.env.NYC_PROCESS_ID || null

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #71ae6acbd9121a16 — Environment-variable access.

pkgs/npm/[email protected]/lib/wrap.js:18

if (process.env.NYC_PROCESSINFO_EXTERNAL_ID) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ef4c07294cdb0ac6 — Environment-variable access.

pkgs/npm/[email protected]/lib/wrap.js:19

  config._processInfo.externalId = process.env.NYC_PROCESSINFO_EXTERNAL_ID

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c134a44f7decebdd — Environment-variable access.

pkgs/npm/[email protected]/lib/wrap.js:20

  delete process.env.NYC_PROCESSINFO_EXTERNAL_ID

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b916ceec4e178671 — Environment-variable access.

pkgs/npm/[email protected]/lib/wrap.js:23

if (process.env.NYC_CONFIG_OVERRIDE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c49fb3f7e3c8a100 — Environment-variable access.

pkgs/npm/[email protected]/lib/wrap.js:24

  Object.assign(config, JSON.parse(process.env.NYC_CONFIG_OVERRIDE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a09ea0a6c4db3f9f — Environment-variable access.

pkgs/npm/[email protected]/lib/wrap.js:25

  process.env.NYC_CONFIG = JSON.stringify(config)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

rollup-plugin-node-resolve

npm dependency

expand_more 2 low-confidence finding(s)

low env_fs dependency Excluded from app score #59f168b6b579a878 — Filesystem access.

pkgs/npm/[email protected]/src/index.js:5

import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #949881c175c80432 — Filesystem access.

pkgs/npm/[email protected]/src/index.js:18

const readFileAsync = file => new Promise((fulfil, reject) => fs.readFile(file, (err, contents) => err ? reject(err) : fulfil(contents)));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

semver

npm dependency

expand_more 2 low-confidence finding(s)

low env_fs dependency Excluded from app score #507edf79a037ad99 — Environment-variable access.

pkgs/npm/[email protected]/internal/debug.js:6

  process.env.NODE_DEBUG &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fc7f503a6775ce51 — Environment-variable access.

pkgs/npm/[email protected]/internal/debug.js:7

  /\bsemver\b/i.test(process.env.NODE_DEBUG)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

yargs

npm dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #3783b96fa0028187 — Environment-variable access.

pkgs/npm/[email protected]/lib/platform-shims/esm.mjs:29

    return process.env[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Development

rollup dev — dist-only: no readable source
rollup-plugin-npm dev — no javascript source

verified_user No application data leak found

App Privacy Score

bar_chart Score Breakdown

list Scan Summary

swap_horiz Application data flows

</> First-Party Code

first-party (npm)

</> Dependencies

@babel/core

babel-minify

babel-plugin-istanbul

babel-register

bluebird

browserify

eslint

fs-extra

jsdoc

karma

karma-browserify

karma-firefox-launcher

karma-mocha

karma-safari-launcher

mocha

native-promise-only

nyc

rollup-plugin-node-resolve

semver

yargs

Skipped dependencies