CodeVetter · Repo Unpack · Risk map
babel/babel
The principal trust boundaries are executable configuration/plugins, filesystem output, browser script execution, and synchronous worker IPC. Source-map loading includes a lexical root/package restriction, while register cache location is configurable outside the checkout. Two potential failure modes below are explicitly labeled hypotheses and were not reproduced. These observations do not establish confirmed vulnerabilities or whole-repository security coverage.
- Loading JavaScript/TypeScript configs and plugins executes modules through require or dynamic import, and config factories are invoked directly; these paths inherit host-process capabilities.
- CLI --delete-dir-on-start reaches recursive force deletion of the requested outDir; normal compilation also creates directories and overwrites code/map files at derived destinations.
- Automatic external source-map loading rejects upward paths outside the nearest package/root using path.relative checks, then reads the accepted path synchronously; this code does not perform realpath-based containment.
- Register cache IO may target BABEL_CACHE_PATH, a discovered package cache, or temporary/home storage; enabling the cache also removes entries older than one day.
- Hypothesis: register can reuse stale compilation if source content changes without changing mtime, because cacheLookup hashes resolved options/version/environment and validates mtime rather than input text. (inferred)
- Hypothesis: worker startup failure or failure before notification could leave a require hook blocked, because WorkerClient calls Atomics.wait without a timeout; normal worker response handling notifies in finally. (inferred)
- Standalone fetches script src URLs with XHR and appends generated script text to the document, preserving nonce; babel-node separately runs transformed eval text through vm.runInThisContext.
- Release automation has npm OIDC and Git write paths and explicitly avoids cached release builds; compiler correctness also assumes built-ins and their standard contracts have not been redefined.