# Risk map — mobxjs/mobx

> Canonical page: https://codevetter.com/unpack/mobx/risk-map

# Risk map — mobxjs/mobx

Scanned commit 60be47cab0926d12f22449ec6c809fb5ec6601c4 (2026-09-30). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These risks are source observations or explicitly labeled hypotheses, not confirmed vulnerabilities. The clearest sensitive boundaries are shell-enabled migration execution, build-time source evaluation, and application-controlled callbacks. Runtime changes have broad effects because global scheduling, dependency tracking, and React cleanup share tightly coupled state.
- Hypothesis: forwarding caller-controlled flags into cp.spawn with shell:true makes shell quoting and metacharacter handling a security-sensitive boundary; the inspected CLI quotes paths but supplies no general argument-escaping layer. (inferred) — [packages/mobx-undecorate/cli.js#L44-L49](https://github.com/mobxjs/mobx/blob/60be47cab0926d12f22449ec6c809fb5ec6601c4/packages/mobx-undecorate/cli.js#L44-L49) [packages/mobx-undecorate/cli.js#L110-L117](https://github.com/mobxjs/mobx/blob/60be47cab0926d12f22449ec6c809fb5ec6601c4/packages/mobx-undecorate/cli.js#L110-L117)
- The codemod targets a path derived from the caller's cwd and directory/path arguments, delegating rewriting to jscodeshift; its CLI tests demonstrate actual file modification, rather than confinement to the package checkout. — [packages/mobx-undecorate/cli.js#L88-L117](https://github.com/mobxjs/mobx/blob/60be47cab0926d12f22449ec6c809fb5ec6601c4/packages/mobx-undecorate/cli.js#L88-L117) [packages/mobx-undecorate/__tests__/cli.spec.tsx#L8-L28](https://github.com/mobxjs/mobx/blob/60be47cab0926d12f22449ec6c809fb5ec6601c4/packages/mobx-undecorate/__tests__/cli.spec.tsx#L8-L28)
- The documentation prebuild/prestart hook transpiles errors.ts and evaluates it with Module._compile, then writes docs/errors.md; inspecting or invoking this hook is therefore different from a passive source read. — [website/package.json#L3-L7](https://github.com/mobxjs/mobx/blob/60be47cab0926d12f22449ec6c809fb5ec6601c4/website/package.json#L3-L7) [website/scripts/generate-error-docs.js#L8-L28](https://github.com/mobxjs/mobx/blob/60be47cab0926d12f22449ec6c809fb5ec6601c4/website/scripts/generate-error-docs.js#L8-L28) [website/scripts/generate-error-docs.js#L71-L72](https://github.com/mobxjs/mobx/blob/60be47cab0926d12f22449ec6c809fb5ec6601c4/website/scripts/generate-error-docs.js#L71-L72)
- enforceActions is a development diagnostic rather than a security boundary: checkIfStateModificationsAreAllowed returns immediately in production and otherwise warns instead of rejecting the write. — [packages/mobx/src/core/derivation.ts#L133-L150](https://github.com/mobxjs/mobx/blob/60be47cab0926d12f22449ec6c809fb5ec6601c4/packages/mobx/src/core/derivation.ts#L133-L150) [packages/mobx/src/api/configure.ts#L25-L29](https://github.com/mobxjs/mobx/blob/60be47cab0926d12f22449ec6c809fb5ec6601c4/packages/mobx/src/api/configure.ts#L25-L29)
- Shared global state and configurable schedulers affect all participating reactions; isolation is rejected during active batches or reaction processing, and disabling error boundaries is explicitly documented in code as preventing recovery. — [packages/mobx/src/core/globalstate.ts#L179-L205](https://github.com/mobxjs/mobx/blob/60be47cab0926d12f22449ec6c809fb5ec6601c4/packages/mobx/src/core/globalstate.ts#L179-L205) [packages/mobx/src/api/configure.ts#L42-L49](https://github.com/mobxjs/mobx/blob/60be47cab0926d12f22449ec6c809fb5ec6601c4/packages/mobx/src/api/configure.ts#L42-L49) [packages/mobx/src/core/reaction.ts#L308-L310](https://github.com/mobxjs/mobx/blob/60be47cab0926d12f22449ec6c809fb5ec6601c4/packages/mobx/src/core/reaction.ts#L308-L310)
- internal.ts explicitly warns that bundling order can expose uninitialized classes or variables; production minification also targets names ending in underscores, creating a concrete coupling between internal naming and bundle behavior. — [packages/mobx/src/internal.ts#L1-L7](https://github.com/mobxjs/mobx/blob/60be47cab0926d12f22449ec6c809fb5ec6601c4/packages/mobx/src/internal.ts#L1-L7) [scripts/create-rollup-config.mjs#L45-L58](https://github.com/mobxjs/mobx/blob/60be47cab0926d12f22449ec6c809fb5ec6601c4/scripts/create-rollup-config.mjs#L45-L58)
- Observer cleanup depends on closure reachability and subscription timing: useObserver documents that capturing admRef prevents GC and that inlining its administration factory retains render trees; it also explicitly acknowledges remaining cross-component tearing. — [packages/mobx-react-lite/src/useObserver.ts#L6-L14](https://github.com/mobxjs/mobx/blob/60be47cab0926d12f22449ec6c809fb5ec6601c4/packages/mobx-react-lite/src/useObserver.ts#L6-L14) [packages/mobx-react-lite/src/useObserver.ts#L33-L41](https://github.com/mobxjs/mobx/blob/60be47cab0926d12f22449ec6c809fb5ec6601c4/packages/mobx-react-lite/src/useObserver.ts#L33-L41) [packages/mobx-react-lite/src/useObserver.ts#L48-L66](https://github.com/mobxjs/mobx/blob/60be47cab0926d12f22449ec6c809fb5ec6601c4/packages/mobx-react-lite/src/useObserver.ts#L48-L66)
- Legacy codemod output has compatibility limits: keepDecorators emits makeObservable(this) without annotations, and observer/inject rewriting remains present, while the MobX 7 migration guide removes legacy decorators and inject. Generated superclass constructors also carry an explicit argument-review warning. — [packages/mobx-undecorate/src/undecorate.ts#L246-L248](https://github.com/mobxjs/mobx/blob/60be47cab0926d12f22449ec6c809fb5ec6601c4/packages/mobx-undecorate/src/undecorate.ts#L246-L248) [packages/mobx-undecorate/src/undecorate.ts#L433-L437](https://github.com/mobxjs/mobx/blob/60be47cab0926d12f22449ec6c809fb5ec6601c4/packages/mobx-undecorate/src/undecorate.ts#L433-L437) [packages/mobx-undecorate/src/undecorate.ts#L459-L465](https://github.com/mobxjs/mobx/blob/60be47cab0926d12f22449ec6c809fb5ec6601c4/packages/mobx-undecorate/src/undecorate.ts#L459-L465) [docs/migrating-from-6-to-7.md#L30-L47](https://github.com/mobxjs/mobx/blob/60be47cab0926d12f22449ec6c809fb5ec6601c4/docs/migrating-from-6-to-7.md#L30-L47)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)