ShadowCanopy
Log inGet started

npm package intelligence

webpack — deep security report

ShadowCanopy's full breakdown of webpack on npm: verdict, AI analysis, dependency chain, network behavior, prebuilds, and obfuscated code.

Safe to use
Deep-scanned by ShadowCanopy — no threats found in its code, dependencies, or network behavior.
Scanned 8/7/2026
Approvedwebpack@5.109.2View on registry ↗latest: 5.109.2

All findings are false positives from legitimate webpack runtime code generation (runtimeTemplate.basicFunction, supportsArrowFunction, etc.) and normal hex/base64 handling for data URLs/module refs. No malicious behavior present.

Protect your projects free

AI breakdown

Plain-English summary of what this package does and how it behaves.

Webpack is a module bundler that packs ECMAScript/CommonJs/AMD modules for the browser, supporting code splitting, loaders, and custom preprocessing.

Capabilities

  • Packs modules into bundles
  • Provides CLI via bin/webpack.js
  • Runs prepare script (husky)
  • Runs setup script on demand
  • Extensive lint/test/build scripts for development

Data access

  • Filesystem

Network

  • No network access observed

Widely-used build tool with filesystem access for bundling; numerous static findings flag obfuscated files and decoded payloads that may require verification before use.

Dependency & execution chain

Every package this one pulls in, colored by verdict. Expand to walk the tree.

82 packages21 directtruncated
webpack@5.109.292 findings
acorn@8.18.04 findings
events@3.3.0
mime-db@1.54.0
tapable@2.3.3
neo-async@2.6.2
watchpack@2.5.2
browserslist@4.28.72 findings
eslint-scope@9.1.22 findings
es-module-lexer@2.3.114 findings

Security findings (92)

Static analysis rule matches, with the exact code that triggered them.

mediumObfuscated source fileATK-023lib/javascript/ArrayPushCallbackChunkFormatPlugin.js

Multiple obfuscation patterns in lib/javascript/ArrayPushCallbackChunkFormatPlugin.js

mediumObfuscated source fileATK-023package/lib/javascript/ArrayPushCallbackChunkFormatPlugin.js

Multiple obfuscation patterns in package/lib/javascript/ArrayPushCallbackChunkFormatPlugin.js

mediumObfuscated source fileATK-023lib/runtime/AsyncModuleRuntimeModule.js

Multiple obfuscation patterns in lib/runtime/AsyncModuleRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/runtime/AsyncModuleRuntimeModule.js

Multiple obfuscation patterns in package/lib/runtime/AsyncModuleRuntimeModule.js

mediumObfuscated source fileATK-023lib/wasm-async/AsyncWebAssemblyJavascriptGenerator.js

Multiple obfuscation patterns in lib/wasm-async/AsyncWebAssemblyJavascriptGenerator.js

mediumObfuscated source fileATK-023package/lib/wasm-async/AsyncWebAssemblyJavascriptGenerator.js

Multiple obfuscation patterns in package/lib/wasm-async/AsyncWebAssemblyJavascriptGenerator.js

mediumObfuscated source fileATK-023lib/ChunkGraph.js

Multiple obfuscation patterns in lib/ChunkGraph.js

mediumObfuscated source fileATK-023package/lib/ChunkGraph.js

Multiple obfuscation patterns in package/lib/ChunkGraph.js

mediumObfuscated source fileATK-023lib/optimize/ConcatenatedModule.js

Multiple obfuscation patterns in lib/optimize/ConcatenatedModule.js

mediumObfuscated source fileATK-023package/lib/optimize/ConcatenatedModule.js

Multiple obfuscation patterns in package/lib/optimize/ConcatenatedModule.js

mediumObfuscated source fileATK-023lib/sharing/ConsumeSharedRuntimeModule.js

Multiple obfuscation patterns in lib/sharing/ConsumeSharedRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/sharing/ConsumeSharedRuntimeModule.js

Multiple obfuscation patterns in package/lib/sharing/ConsumeSharedRuntimeModule.js

mediumObfuscated source fileATK-023lib/container/ContainerEntryModule.js

Multiple obfuscation patterns in lib/container/ContainerEntryModule.js

mediumObfuscated source fileATK-023package/lib/container/ContainerEntryModule.js

Multiple obfuscation patterns in package/lib/container/ContainerEntryModule.js

mediumObfuscated source fileATK-023lib/ContextModule.js

Multiple obfuscation patterns in lib/ContextModule.js

mediumObfuscated source fileATK-023package/lib/ContextModule.js

Multiple obfuscation patterns in package/lib/ContextModule.js

mediumObfuscated source fileATK-023lib/css/CssGenerator.js

Multiple obfuscation patterns in lib/css/CssGenerator.js

mediumObfuscated source fileATK-023package/lib/css/CssGenerator.js

Multiple obfuscation patterns in package/lib/css/CssGenerator.js

mediumObfuscated source fileATK-023lib/css/CssParser.js

Multiple obfuscation patterns in lib/css/CssParser.js

mediumObfuscated source fileATK-023package/lib/css/CssParser.js

Multiple obfuscation patterns in package/lib/css/CssParser.js

mediumObfuscated source fileATK-023lib/errors/EnvironmentNotSupportAsyncWarning.js

Multiple obfuscation patterns in lib/errors/EnvironmentNotSupportAsyncWarning.js

mediumObfuscated source fileATK-023package/lib/errors/EnvironmentNotSupportAsyncWarning.js

Multiple obfuscation patterns in package/lib/errors/EnvironmentNotSupportAsyncWarning.js

mediumObfuscated source fileATK-023lib/EvalSourceMapDevToolPlugin.js

Multiple obfuscation patterns in lib/EvalSourceMapDevToolPlugin.js

mediumObfuscated source fileATK-023package/lib/EvalSourceMapDevToolPlugin.js

Multiple obfuscation patterns in package/lib/EvalSourceMapDevToolPlugin.js

mediumObfuscated source fileATK-023lib/ExternalModule.js

Multiple obfuscation patterns in lib/ExternalModule.js

mediumObfuscated source fileATK-023package/lib/ExternalModule.js

Multiple obfuscation patterns in package/lib/ExternalModule.js

mediumObfuscated source fileATK-023lib/FileSystemInfo.js

Multiple obfuscation patterns in lib/FileSystemInfo.js

mediumObfuscated source fileATK-023package/lib/FileSystemInfo.js

Multiple obfuscation patterns in package/lib/FileSystemInfo.js

mediumObfuscated source fileATK-023lib/dependencies/HarmonyAcceptDependency.js

Multiple obfuscation patterns in lib/dependencies/HarmonyAcceptDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/HarmonyAcceptDependency.js

Multiple obfuscation patterns in package/lib/dependencies/HarmonyAcceptDependency.js

mediumObfuscated source fileATK-023lib/dependencies/HarmonyCompatibilityDependency.js

Multiple obfuscation patterns in lib/dependencies/HarmonyCompatibilityDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/HarmonyCompatibilityDependency.js

Multiple obfuscation patterns in package/lib/dependencies/HarmonyCompatibilityDependency.js

mediumObfuscated source fileATK-023lib/dependencies/HarmonyDetectionParserPlugin.js

Multiple obfuscation patterns in lib/dependencies/HarmonyDetectionParserPlugin.js

mediumObfuscated source fileATK-023package/lib/dependencies/HarmonyDetectionParserPlugin.js

Multiple obfuscation patterns in package/lib/dependencies/HarmonyDetectionParserPlugin.js

mediumObfuscated source fileATK-023lib/dependencies/HarmonyExportImportedSpecifierDependency.js

Multiple obfuscation patterns in lib/dependencies/HarmonyExportImportedSpecifierDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/HarmonyExportImportedSpecifierDependency.js

Multiple obfuscation patterns in package/lib/dependencies/HarmonyExportImportedSpecifierDependency.js

mediumObfuscated source fileATK-023lib/util/hash/hash-digest.js

Multiple obfuscation patterns in lib/util/hash/hash-digest.js

mediumObfuscated source fileATK-023package/lib/util/hash/hash-digest.js

Multiple obfuscation patterns in package/lib/util/hash/hash-digest.js

mediumObfuscated source fileATK-023lib/html/HtmlParser.js

Multiple obfuscation patterns in lib/html/HtmlParser.js

mediumObfuscated source fileATK-023package/lib/html/HtmlParser.js

Multiple obfuscation patterns in package/lib/html/HtmlParser.js

mediumObfuscated source fileATK-023lib/dependencies/ImportDependency.js

Multiple obfuscation patterns in lib/dependencies/ImportDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/ImportDependency.js

Multiple obfuscation patterns in package/lib/dependencies/ImportDependency.js

mediumObfuscated source fileATK-023lib/webworker/ImportScriptsChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in lib/webworker/ImportScriptsChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/webworker/ImportScriptsChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in package/lib/webworker/ImportScriptsChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023lib/index.js

Multiple obfuscation patterns in lib/index.js

mediumObfuscated source fileATK-023package/lib/index.js

Multiple obfuscation patterns in package/lib/index.js

mediumObfuscated source fileATK-023lib/javascript/JavascriptModulesPlugin.js

Multiple obfuscation patterns in lib/javascript/JavascriptModulesPlugin.js

mediumObfuscated source fileATK-023package/lib/javascript/JavascriptModulesPlugin.js

Multiple obfuscation patterns in package/lib/javascript/JavascriptModulesPlugin.js

mediumObfuscated source fileATK-023lib/javascript/JavascriptParser.js

Multiple obfuscation patterns in lib/javascript/JavascriptParser.js

mediumObfuscated source fileATK-023package/lib/javascript/JavascriptParser.js

Multiple obfuscation patterns in package/lib/javascript/JavascriptParser.js

mediumObfuscated source fileATK-023lib/web/JsonpChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in lib/web/JsonpChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/web/JsonpChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in package/lib/web/JsonpChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023lib/runtime/MakeDeferredNamespaceObjectRuntime.js

Multiple obfuscation patterns in lib/runtime/MakeDeferredNamespaceObjectRuntime.js

mediumObfuscated source fileATK-023package/lib/runtime/MakeDeferredNamespaceObjectRuntime.js

Multiple obfuscation patterns in package/lib/runtime/MakeDeferredNamespaceObjectRuntime.js

mediumObfuscated source fileATK-023lib/esm/ModuleChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in lib/esm/ModuleChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/esm/ModuleChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in package/lib/esm/ModuleChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023lib/node/nodeConsole.js

Multiple obfuscation patterns in lib/node/nodeConsole.js

mediumObfuscated source fileATK-023package/lib/node/nodeConsole.js

Multiple obfuscation patterns in package/lib/node/nodeConsole.js

mediumObfuscated source fileATK-023lib/NodeStuffPlugin.js

Multiple obfuscation patterns in lib/NodeStuffPlugin.js

mediumObfuscated source fileATK-023package/lib/NodeStuffPlugin.js

Multiple obfuscation patterns in package/lib/NodeStuffPlugin.js

mediumObfuscated source fileATK-023lib/node/ReadFileChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in lib/node/ReadFileChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/node/ReadFileChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in package/lib/node/ReadFileChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023lib/node/RequireChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in lib/node/RequireChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/node/RequireChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in package/lib/node/RequireChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023lib/RuntimeTemplate.js

Multiple obfuscation patterns in lib/RuntimeTemplate.js

mediumObfuscated source fileATK-023package/lib/RuntimeTemplate.js

Multiple obfuscation patterns in package/lib/RuntimeTemplate.js

mediumObfuscated source fileATK-023lib/sharing/ShareRuntimeModule.js

Multiple obfuscation patterns in lib/sharing/ShareRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/sharing/ShareRuntimeModule.js

Multiple obfuscation patterns in package/lib/sharing/ShareRuntimeModule.js

mediumObfuscated source fileATK-023lib/css/syntax.js

Multiple obfuscation patterns in lib/css/syntax.js

mediumObfuscated source fileATK-023package/lib/css/syntax.js

Multiple obfuscation patterns in package/lib/css/syntax.js

mediumObfuscated source fileATK-023lib/javascript/syntax.js

Multiple obfuscation patterns in lib/javascript/syntax.js

mediumObfuscated source fileATK-023package/lib/javascript/syntax.js

Multiple obfuscation patterns in package/lib/javascript/syntax.js

mediumObfuscated source fileATK-023lib/Template.js

Multiple obfuscation patterns in lib/Template.js

mediumObfuscated source fileATK-023package/lib/Template.js

Multiple obfuscation patterns in package/lib/Template.js

mediumObfuscated source fileATK-023lib/runtime/ToBinaryRuntimeModule.js

Multiple obfuscation patterns in lib/runtime/ToBinaryRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/runtime/ToBinaryRuntimeModule.js

Multiple obfuscation patterns in package/lib/runtime/ToBinaryRuntimeModule.js

mediumObfuscated source fileATK-023lib/wasm-sync/WebAssemblyGenerator.js

Multiple obfuscation patterns in lib/wasm-sync/WebAssemblyGenerator.js

mediumObfuscated source fileATK-023package/lib/wasm-sync/WebAssemblyGenerator.js

Multiple obfuscation patterns in package/lib/wasm-sync/WebAssemblyGenerator.js

mediumObfuscated source fileATK-023lib/wasm-sync/WebAssemblyParser.js

Multiple obfuscation patterns in lib/wasm-sync/WebAssemblyParser.js

mediumObfuscated source fileATK-023package/lib/wasm-sync/WebAssemblyParser.js

Multiple obfuscation patterns in package/lib/wasm-sync/WebAssemblyParser.js

mediumObfuscated source fileATK-023lib/dependencies/WorkletDependency.js

Multiple obfuscation patterns in lib/dependencies/WorkletDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/WorkletDependency.js

Multiple obfuscation patterns in package/lib/dependencies/WorkletDependency.js

highDecoded payload executedATK-026lib/ConcatenationScope.js

File lib/ConcatenationScope.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highDecoded payload executedATK-026package/lib/ConcatenationScope.js

File package/lib/ConcatenationScope.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highDecoded payload executedATK-026lib/util/dataURL.js

File lib/util/dataURL.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highDecoded payload executedATK-026package/lib/util/dataURL.js

File package/lib/util/dataURL.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highRemote fetch with process executionATK-024lib/dependencies/HtmlEntryDependency.js

File lib/dependencies/HtmlEntryDependency.js combines network access with process execution

highRemote fetch with process executionATK-024package/lib/dependencies/HtmlEntryDependency.js

File package/lib/dependencies/HtmlEntryDependency.js combines network access with process execution

highDecoded payload executedATK-026lib/html/HtmlGenerator.js

File lib/html/HtmlGenerator.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highDecoded payload executedATK-026package/lib/html/HtmlGenerator.js

File package/lib/html/HtmlGenerator.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highRemote fetch with process executionATK-024lib/config/target.js

File lib/config/target.js combines network access with process execution

highRemote fetch with process executionATK-024package/lib/config/target.js

File package/lib/config/target.js combines network access with process execution

Package metadata

LicenseMIT

Packs ECMAScript/CommonJs/AMD modules for the browser. Allows you to split your codebase into multiple bundles, which can be loaded on demand. Supports loaders to preprocess files, i.e. json, jsx, es7, css, less, ... and your custom stuff.

Homepage ↗Repository ↗

Files in package (500)

LICENSEpackage/LICENSElib/library/AbstractLibraryPlugin.jspackage/lib/library/AbstractLibraryPlugin.jslib/errors/AbstractMethodError.jspackage/lib/errors/AbstractMethodError.jslib/cache/AddBuildDependenciesPlugin.jspackage/lib/cache/AddBuildDependenciesPlugin.jslib/cache/AddManagedPathsPlugin.jspackage/lib/cache/AddManagedPathsPlugin.jslib/serialization/AggregateErrorSerializer.jspackage/lib/serialization/AggregateErrorSerializer.jslib/optimize/AggressiveMergingPlugin.jspackage/lib/optimize/AggressiveMergingPlugin.jsschemas/plugins/optimize/AggressiveSplittingPlugin.check.jspackage/schemas/plugins/optimize/AggressiveSplittingPlugin.check.jslib/optimize/AggressiveSplittingPlugin.jspackage/lib/optimize/AggressiveSplittingPlugin.jslib/dependencies/AMDDefineDependency.jspackage/lib/dependencies/AMDDefineDependency.jslib/dependencies/AMDDefineDependencyParserPlugin.jspackage/lib/dependencies/AMDDefineDependencyParserPlugin.jslib/library/AmdLibraryPlugin.jspackage/lib/library/AmdLibraryPlugin.jslib/dependencies/AMDPlugin.jspackage/lib/dependencies/AMDPlugin.jslib/dependencies/AMDRequireArrayDependency.jspackage/lib/dependencies/AMDRequireArrayDependency.jslib/dependencies/AMDRequireContextDependency.jspackage/lib/dependencies/AMDRequireContextDependency.jslib/dependencies/AMDRequireDependenciesBlock.jspackage/lib/dependencies/AMDRequireDependenciesBlock.jslib/dependencies/AMDRequireDependenciesBlockParserPlugin.jspackage/lib/dependencies/AMDRequireDependenciesBlockParserPlugin.jslib/dependencies/AMDRequireDependency.jspackage/lib/dependencies/AMDRequireDependency.jslib/dependencies/AMDRequireItemDependency.jspackage/lib/dependencies/AMDRequireItemDependency.jslib/dependencies/AMDRuntimeModules.jspackage/lib/dependencies/AMDRuntimeModules.js

How ShadowCanopy checks npm packages

ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.

Protect your projects freeSee what's being blocked

Other npm packages

expressreactreact-domlodashaxioschalkcommandernexttypescriptviteeslintprettier

This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/webpack