CodeVetter · Repo Unpack · Risk map
rollup/rollup
The inspected security-sensitive boundaries are executable configuration/plugins, watch shell commands, filesystem access, native loading, and CI privilege transitions. These are source observations, not confirmed vulnerabilities. Filename validation provides a concrete output-path guard, while custom filesystem adapters determine actual I/O authority. Native/WASM parity and asynchronous watch ordering are broad correctness hotspots.
- CLI plugin arguments can execute new Function for inline plugin objects and argument expressions, then require/import packages; these inputs enter executable code paths.
- Configuration files execute through dynamic import; transpilation writes code beside the config and cleanup errors are logged rather than awaited or rethrown.
- CLI watch hooks execute user-supplied command strings with execSync; command failures are printed and suppressed.
- Fallback resolution accepts absolute paths and follows symlinks unless preserveSymlinks is set; loading and writing use configured filesystem methods without a repository-root confinement check in those functions.
- After generateBundle, Bundle validates bundle keys and differing entry filenames, rejecting normalized parent escapes, '.', and absolute paths before core writes.
- NAPI parseAsync accepts AbortSignal, but browser and Node-WASM adapters ignore it and call synchronous parse; lint-native-js checks export-name presence in only one direction.
- Hypothesis: changing watch running/rerun state or invalidation batching could lose changes or overlap asynchronous listeners; those exact boundaries have sequencing comments and dedicated regressions. (inferred)
- The performance workflow uses pull_request_target and executes PR-head code, including in a report job with pull-requests:write; REPL upload uses a separate workflow_run job with OIDC and resolves PR identity through GitHub API.