CodeVetter · Repo Unpack · Risk map
mobxjs/mobx
These risks are source observations or explicitly labeled hypotheses, not confirmed vulnerabilities. The clearest sensitive boundaries are shell-enabled migration execution, build-time source evaluation, and application-controlled callbacks. Runtime changes have broad effects because global scheduling, dependency tracking, and React cleanup share tightly coupled state.
- Hypothesis: forwarding caller-controlled flags into cp.spawn with shell:true makes shell quoting and metacharacter handling a security-sensitive boundary; the inspected CLI quotes paths but supplies no general argument-escaping layer. (inferred)
- The codemod targets a path derived from the caller's cwd and directory/path arguments, delegating rewriting to jscodeshift; its CLI tests demonstrate actual file modification, rather than confinement to the package checkout.
- The documentation prebuild/prestart hook transpiles errors.ts and evaluates it with Module._compile, then writes docs/errors.md; inspecting or invoking this hook is therefore different from a passive source read.
- enforceActions is a development diagnostic rather than a security boundary: checkIfStateModificationsAreAllowed returns immediately in production and otherwise warns instead of rejecting the write.
- Shared global state and configurable schedulers affect all participating reactions; isolation is rejected during active batches or reaction processing, and disabling error boundaries is explicitly documented in code as preventing recovery.
- internal.ts explicitly warns that bundling order can expose uninitialized classes or variables; production minification also targets names ending in underscores, creating a concrete coupling between internal naming and bundle behavior.
- Observer cleanup depends on closure reachability and subscription timing: useObserver documents that capturing admRef prevents GC and that inlining its administration factory retains render trees; it also explicitly acknowledges remaining cross-component tearing.
- Legacy codemod output has compatibility limits: keepDecorators emits makeObservable(this) without annotations, and observer/inject rewriting remains present, while the MobX 7 migration guide removes legacy decorators and inject. Generated superclass constructors also carry an explicit argument-review warning.