Is webpack (npm) safe to install?

Is webpack safe? npm package security — ShadowCanopy

Safe to use

Deep-scanned by ShadowCanopy — no threats found in its code, dependencies, or network behavior.

Scanned 9/19/2026

Approvedwebpack@5.111.1View on registry ↗latest: 5.111.1

All findings are false positives from legitimate webpack runtime code (template generation using runtimeTemplate.basicFunction/returningFunction, unicode escapes in parsers/grammars, base64/hex for source maps/WASM/data URLs, and eval comments for devtool). No credential theft, exfiltration, C2, or any malicious payload present. This is the real webpack package.

Protect your projects free

AI breakdown

Plain-English summary of what this package does and how it behaves.

Webpack is a module bundler that packs ECMAScript/CommonJS/AMD modules for the browser, supporting code splitting, loaders for preprocessing files like JSON/JSX/CSS, and custom plugins.

Capabilities

Bundles JavaScript modules for browser
Supports loaders and plugins
Provides CLI via bin/webpack.js
Runs prepare script with husky
Includes extensive build/test/lint scripts

Data access

Filesystem
Environment variables (via test scripts)

Network

No network access observed

Widely used legitimate bundler with many dev scripts; static findings note obfuscated files and execution patterns but these appear unrelated to core functionality.

Dependency & execution chain

Every package this one pulls in, colored by verdict. Expand to walk the tree.

77 packages18 directtruncated

webpack@5.111.1100 findings

events@3.3.0

mime-db@1.54.0

tapable@2.3.3

watchpack@2.5.2

graceful-fs@4.2.11

browserslist@4.29.02 findings

schema-utils@4.5.0

@types/estree@1.0.9

es-module-lexer@3.0.212 findings

webpack-sources@3.5.1

enhanced-resolve@5.25.1

@types/json-schema@7.0.15

@webassemblyjs/ast@1.14.1

chrome-trace-event@1.0.4

@webassemblyjs/wasm-edit@1.14.1

minimizer-webpack-plugin@5.11.02 findings

@webassemblyjs/wasm-parser@1.14.1

Security findings (100)

Static analysis rule matches, with the exact code that triggered them.

mediumObfuscated source fileATK-023lib/javascript/ArrayPushCallbackChunkFormatPlugin.js

Multiple obfuscation patterns in lib/javascript/ArrayPushCallbackChunkFormatPlugin.js

mediumObfuscated source fileATK-023package/lib/javascript/ArrayPushCallbackChunkFormatPlugin.js

Multiple obfuscation patterns in package/lib/javascript/ArrayPushCallbackChunkFormatPlugin.js

mediumObfuscated source fileATK-023lib/runtime/AsyncModuleRuntimeModule.js

Multiple obfuscation patterns in lib/runtime/AsyncModuleRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/runtime/AsyncModuleRuntimeModule.js

Multiple obfuscation patterns in package/lib/runtime/AsyncModuleRuntimeModule.js

mediumObfuscated source fileATK-023lib/wasm-async/AsyncWebAssemblyJavascriptGenerator.js

Multiple obfuscation patterns in lib/wasm-async/AsyncWebAssemblyJavascriptGenerator.js

mediumObfuscated source fileATK-023package/lib/wasm-async/AsyncWebAssemblyJavascriptGenerator.js

Multiple obfuscation patterns in package/lib/wasm-async/AsyncWebAssemblyJavascriptGenerator.js

mediumObfuscated source fileATK-023lib/ChunkGraph.js

Multiple obfuscation patterns in lib/ChunkGraph.js

mediumObfuscated source fileATK-023package/lib/ChunkGraph.js

Multiple obfuscation patterns in package/lib/ChunkGraph.js

mediumObfuscated source fileATK-023lib/optimize/ConcatenatedModule.js

Multiple obfuscation patterns in lib/optimize/ConcatenatedModule.js

mediumObfuscated source fileATK-023package/lib/optimize/ConcatenatedModule.js

Multiple obfuscation patterns in package/lib/optimize/ConcatenatedModule.js

mediumObfuscated source fileATK-023lib/sharing/ConsumeSharedRuntimeModule.js

Multiple obfuscation patterns in lib/sharing/ConsumeSharedRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/sharing/ConsumeSharedRuntimeModule.js

Multiple obfuscation patterns in package/lib/sharing/ConsumeSharedRuntimeModule.js

mediumObfuscated source fileATK-023lib/container/ContainerEntryModule.js

Multiple obfuscation patterns in lib/container/ContainerEntryModule.js

mediumObfuscated source fileATK-023package/lib/container/ContainerEntryModule.js

Multiple obfuscation patterns in package/lib/container/ContainerEntryModule.js

mediumObfuscated source fileATK-023lib/context/ContextModule.js

Multiple obfuscation patterns in lib/context/ContextModule.js

mediumObfuscated source fileATK-023package/lib/context/ContextModule.js

Multiple obfuscation patterns in package/lib/context/ContextModule.js

mediumObfuscated source fileATK-023lib/css/CssGenerator.js

Multiple obfuscation patterns in lib/css/CssGenerator.js

mediumObfuscated source fileATK-023package/lib/css/CssGenerator.js

Multiple obfuscation patterns in package/lib/css/CssGenerator.js

mediumObfuscated source fileATK-023lib/css/CssParser.js

Multiple obfuscation patterns in lib/css/CssParser.js

mediumObfuscated source fileATK-023package/lib/css/CssParser.js

Multiple obfuscation patterns in package/lib/css/CssParser.js

mediumObfuscated source fileATK-023lib/errors/EnvironmentNotSupportAsyncWarning.js

Multiple obfuscation patterns in lib/errors/EnvironmentNotSupportAsyncWarning.js

mediumObfuscated source fileATK-023package/lib/errors/EnvironmentNotSupportAsyncWarning.js

Multiple obfuscation patterns in package/lib/errors/EnvironmentNotSupportAsyncWarning.js

mediumObfuscated source fileATK-023lib/EvalSourceMapDevToolPlugin.js

Multiple obfuscation patterns in lib/EvalSourceMapDevToolPlugin.js

mediumObfuscated source fileATK-023package/lib/EvalSourceMapDevToolPlugin.js

Multiple obfuscation patterns in package/lib/EvalSourceMapDevToolPlugin.js

mediumObfuscated source fileATK-023lib/ExternalModule.js

Multiple obfuscation patterns in lib/ExternalModule.js

mediumObfuscated source fileATK-023package/lib/ExternalModule.js

Multiple obfuscation patterns in package/lib/ExternalModule.js

mediumObfuscated source fileATK-023lib/FileSystemInfo.js

Multiple obfuscation patterns in lib/FileSystemInfo.js

mediumObfuscated source fileATK-023package/lib/FileSystemInfo.js

Multiple obfuscation patterns in package/lib/FileSystemInfo.js

mediumObfuscated source fileATK-023lib/javascript/grammar.js

Multiple obfuscation patterns in lib/javascript/grammar.js

mediumObfuscated source fileATK-023package/lib/javascript/grammar.js

Multiple obfuscation patterns in package/lib/javascript/grammar.js

mediumObfuscated source fileATK-023lib/dependencies/HarmonyAcceptDependency.js

Multiple obfuscation patterns in lib/dependencies/HarmonyAcceptDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/HarmonyAcceptDependency.js

Multiple obfuscation patterns in package/lib/dependencies/HarmonyAcceptDependency.js

mediumObfuscated source fileATK-023lib/dependencies/HarmonyCompatibilityDependency.js

Multiple obfuscation patterns in lib/dependencies/HarmonyCompatibilityDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/HarmonyCompatibilityDependency.js

Multiple obfuscation patterns in package/lib/dependencies/HarmonyCompatibilityDependency.js

mediumObfuscated source fileATK-023lib/dependencies/HarmonyDetectionParserPlugin.js

Multiple obfuscation patterns in lib/dependencies/HarmonyDetectionParserPlugin.js

mediumObfuscated source fileATK-023package/lib/dependencies/HarmonyDetectionParserPlugin.js

Multiple obfuscation patterns in package/lib/dependencies/HarmonyDetectionParserPlugin.js

mediumObfuscated source fileATK-023lib/dependencies/HarmonyExportImportedSpecifierDependency.js

Multiple obfuscation patterns in lib/dependencies/HarmonyExportImportedSpecifierDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/HarmonyExportImportedSpecifierDependency.js

Multiple obfuscation patterns in package/lib/dependencies/HarmonyExportImportedSpecifierDependency.js

mediumObfuscated source fileATK-023lib/util/hash/hash-digest.js

Multiple obfuscation patterns in lib/util/hash/hash-digest.js

mediumObfuscated source fileATK-023package/lib/util/hash/hash-digest.js

Multiple obfuscation patterns in package/lib/util/hash/hash-digest.js

mediumObfuscated source fileATK-023lib/html/HtmlParser.js

Multiple obfuscation patterns in lib/html/HtmlParser.js

mediumObfuscated source fileATK-023package/lib/html/HtmlParser.js

Multiple obfuscation patterns in package/lib/html/HtmlParser.js

mediumObfuscated source fileATK-023lib/dependencies/ImportDependency.js

Multiple obfuscation patterns in lib/dependencies/ImportDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/ImportDependency.js

Multiple obfuscation patterns in package/lib/dependencies/ImportDependency.js

mediumObfuscated source fileATK-023lib/webworker/ImportScriptsChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in lib/webworker/ImportScriptsChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/webworker/ImportScriptsChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in package/lib/webworker/ImportScriptsChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023lib/index.js

Multiple obfuscation patterns in lib/index.js

mediumObfuscated source fileATK-023package/lib/index.js

Multiple obfuscation patterns in package/lib/index.js

mediumObfuscated source fileATK-023lib/javascript/JavascriptModulesPlugin.js

Multiple obfuscation patterns in lib/javascript/JavascriptModulesPlugin.js

mediumObfuscated source fileATK-023package/lib/javascript/JavascriptModulesPlugin.js

Multiple obfuscation patterns in package/lib/javascript/JavascriptModulesPlugin.js

mediumObfuscated source fileATK-023lib/javascript/JavascriptParser.js

Multiple obfuscation patterns in lib/javascript/JavascriptParser.js

mediumObfuscated source fileATK-023package/lib/javascript/JavascriptParser.js

Multiple obfuscation patterns in package/lib/javascript/JavascriptParser.js

mediumObfuscated source fileATK-023lib/web/JsonpChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in lib/web/JsonpChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/web/JsonpChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in package/lib/web/JsonpChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023lib/runtime/MakeDeferredNamespaceObjectRuntime.js

Multiple obfuscation patterns in lib/runtime/MakeDeferredNamespaceObjectRuntime.js

mediumObfuscated source fileATK-023package/lib/runtime/MakeDeferredNamespaceObjectRuntime.js

Multiple obfuscation patterns in package/lib/runtime/MakeDeferredNamespaceObjectRuntime.js

mediumObfuscated source fileATK-023lib/esm/ModuleChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in lib/esm/ModuleChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/esm/ModuleChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in package/lib/esm/ModuleChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023lib/node/nodeConsole.js

Multiple obfuscation patterns in lib/node/nodeConsole.js

mediumObfuscated source fileATK-023package/lib/node/nodeConsole.js

Multiple obfuscation patterns in package/lib/node/nodeConsole.js

mediumObfuscated source fileATK-023lib/NodeStuffPlugin.js

Multiple obfuscation patterns in lib/NodeStuffPlugin.js

mediumObfuscated source fileATK-023package/lib/NodeStuffPlugin.js

Multiple obfuscation patterns in package/lib/NodeStuffPlugin.js

mediumObfuscated source fileATK-023lib/javascript/parser.js

Multiple obfuscation patterns in lib/javascript/parser.js

mediumObfuscated source fileATK-023package/lib/javascript/parser.js

Multiple obfuscation patterns in package/lib/javascript/parser.js

mediumObfuscated source fileATK-023lib/node/ReadFileChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in lib/node/ReadFileChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/node/ReadFileChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in package/lib/node/ReadFileChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023lib/container/RemoteRuntimeModule.js

Multiple obfuscation patterns in lib/container/RemoteRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/container/RemoteRuntimeModule.js

Multiple obfuscation patterns in package/lib/container/RemoteRuntimeModule.js

mediumObfuscated source fileATK-023lib/node/RequireChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in lib/node/RequireChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/node/RequireChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in package/lib/node/RequireChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023lib/RuntimeTemplate.js

Multiple obfuscation patterns in lib/RuntimeTemplate.js

mediumObfuscated source fileATK-023package/lib/RuntimeTemplate.js

Multiple obfuscation patterns in package/lib/RuntimeTemplate.js

mediumObfuscated source fileATK-023lib/sharing/ShareRuntimeModule.js

Multiple obfuscation patterns in lib/sharing/ShareRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/sharing/ShareRuntimeModule.js

Multiple obfuscation patterns in package/lib/sharing/ShareRuntimeModule.js

mediumObfuscated source fileATK-023lib/util/SourceProcessor.js

Multiple obfuscation patterns in lib/util/SourceProcessor.js

mediumObfuscated source fileATK-023package/lib/util/SourceProcessor.js

Multiple obfuscation patterns in package/lib/util/SourceProcessor.js

mediumObfuscated source fileATK-023lib/javascript/StartupHelpers.js

Multiple obfuscation patterns in lib/javascript/StartupHelpers.js

mediumObfuscated source fileATK-023package/lib/javascript/StartupHelpers.js

Multiple obfuscation patterns in package/lib/javascript/StartupHelpers.js

mediumObfuscated source fileATK-023lib/javascript/syntax.js

Multiple obfuscation patterns in lib/javascript/syntax.js

mediumObfuscated source fileATK-023package/lib/javascript/syntax.js

Multiple obfuscation patterns in package/lib/javascript/syntax.js

mediumObfuscated source fileATK-023lib/Template.js

Multiple obfuscation patterns in lib/Template.js

mediumObfuscated source fileATK-023package/lib/Template.js

Multiple obfuscation patterns in package/lib/Template.js

mediumObfuscated source fileATK-023lib/runtime/ToBinaryRuntimeModule.js

Multiple obfuscation patterns in lib/runtime/ToBinaryRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/runtime/ToBinaryRuntimeModule.js

Multiple obfuscation patterns in package/lib/runtime/ToBinaryRuntimeModule.js

mediumObfuscated source fileATK-023lib/wasm-sync/WebAssemblyGenerator.js

Multiple obfuscation patterns in lib/wasm-sync/WebAssemblyGenerator.js

mediumObfuscated source fileATK-023package/lib/wasm-sync/WebAssemblyGenerator.js

Multiple obfuscation patterns in package/lib/wasm-sync/WebAssemblyGenerator.js

mediumObfuscated source fileATK-023lib/wasm-sync/WebAssemblyParser.js

Multiple obfuscation patterns in lib/wasm-sync/WebAssemblyParser.js

mediumObfuscated source fileATK-023package/lib/wasm-sync/WebAssemblyParser.js

Multiple obfuscation patterns in package/lib/wasm-sync/WebAssemblyParser.js

mediumObfuscated source fileATK-023lib/dependencies/WorkletDependency.js

Multiple obfuscation patterns in lib/dependencies/WorkletDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/WorkletDependency.js

Multiple obfuscation patterns in package/lib/dependencies/WorkletDependency.js

highDecoded payload executedATK-026lib/ConcatenationScope.js

File lib/ConcatenationScope.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highDecoded payload executedATK-026package/lib/ConcatenationScope.js

File package/lib/ConcatenationScope.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highDecoded payload executedATK-026lib/util/dataURL.js

File lib/util/dataURL.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highDecoded payload executedATK-026package/lib/util/dataURL.js

File package/lib/util/dataURL.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highRemote fetch with process executionATK-024lib/dependencies/HtmlEntryDependency.js

File lib/dependencies/HtmlEntryDependency.js combines network access with process execution

highRemote fetch with process executionATK-024package/lib/dependencies/HtmlEntryDependency.js

File package/lib/dependencies/HtmlEntryDependency.js combines network access with process execution

highDecoded payload executedATK-026lib/html/HtmlGenerator.js

File lib/html/HtmlGenerator.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highDecoded payload executedATK-026package/lib/html/HtmlGenerator.js

File package/lib/html/HtmlGenerator.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highRemote fetch with process executionATK-024lib/config/target.js

File lib/config/target.js combines network access with process execution

highRemote fetch with process executionATK-024package/lib/config/target.js

File package/lib/config/target.js combines network access with process execution

Package metadata

LicenseMIT

Packs ECMAScript/CommonJs/AMD modules for the browser. Allows you to split your codebase into multiple bundles, which can be loaded on demand. Supports loaders to preprocess files, i.e. json, jsx, es7, css, less, ... and your custom stuff.

Homepage ↗Repository ↗

Files in package (500)

LICENSEpackage/LICENSElib/library/AbstractLibraryPlugin.jspackage/lib/library/AbstractLibraryPlugin.jslib/errors/AbstractMethodError.jspackage/lib/errors/AbstractMethodError.jslib/cache/AddBuildDependenciesPlugin.jspackage/lib/cache/AddBuildDependenciesPlugin.jslib/cache/AddManagedPathsPlugin.jspackage/lib/cache/AddManagedPathsPlugin.jslib/serialization/AggregateErrorSerializer.jspackage/lib/serialization/AggregateErrorSerializer.jslib/optimize/AggressiveMergingPlugin.jspackage/lib/optimize/AggressiveMergingPlugin.jsschemas/plugins/optimize/AggressiveSplittingPlugin.check.jspackage/schemas/plugins/optimize/AggressiveSplittingPlugin.check.jslib/optimize/AggressiveSplittingPlugin.jspackage/lib/optimize/AggressiveSplittingPlugin.jslib/dependencies/AMDDefineDependency.jspackage/lib/dependencies/AMDDefineDependency.jslib/dependencies/AMDDefineDependencyParserPlugin.jspackage/lib/dependencies/AMDDefineDependencyParserPlugin.jslib/library/AmdLibraryPlugin.jspackage/lib/library/AmdLibraryPlugin.jslib/dependencies/AMDPlugin.jspackage/lib/dependencies/AMDPlugin.jslib/dependencies/AMDRequireArrayDependency.jspackage/lib/dependencies/AMDRequireArrayDependency.jslib/dependencies/AMDRequireContextDependency.jspackage/lib/dependencies/AMDRequireContextDependency.jslib/dependencies/AMDRequireDependenciesBlock.jspackage/lib/dependencies/AMDRequireDependenciesBlock.jslib/dependencies/AMDRequireDependenciesBlockParserPlugin.jspackage/lib/dependencies/AMDRequireDependenciesBlockParserPlugin.jslib/dependencies/AMDRequireDependency.jspackage/lib/dependencies/AMDRequireDependency.jslib/dependencies/AMDRequireItemDependency.jspackage/lib/dependencies/AMDRequireItemDependency.jslib/dependencies/AMDRuntimeModules.jspackage/lib/dependencies/AMDRuntimeModules.js

How ShadowCanopy checks npm packages

ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.

Protect your projects free See what's being blocked

Other npm packages

express react react-dom lodash axios chalk commander next typescript vite eslint prettier

This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/webpack

webpack — deep security report