CodeVetter · Repo Unpack · Risk map
ReactiveX/rxjs
These risks are source observations or explicitly labeled hypotheses, not confirmed vulnerabilities. The broadest runtime effects come from realm patching, construction policy, and unbounded buffering. Security-sensitive tooling includes file writes, npm publication, privileged rebasing, and documentation HTML ingestion; static inspection also found a stale scheduled test command.
- Fallback initialization replaces AbortController.prototype.abort to emulate abort algorithms before public events, so installation has realm-wide effects beyond Observable itself.
- Existing Observable values are preserved without conformance probing; public capability installation uses direct assignment with no common preflight or rollback, leaving hardened-realm initialization outside a transactional guarantee.
- Buffered async iteration is explicitly unbounded, and replaySubject defaults both size and maxAge to Infinity; consumers must choose retention limits where producer volume requires them.
- Hypothesis: migration application is vulnerable to partial output on an operational failure or filesystem change after preflight, because files are written sequentially without a batch rollback or atomic per-file replacement. (inferred)
- DocViewer assigns generated contents directly to innerHTML under an explicit documentation-author trust assumption; this is a content trust boundary, not evidence of exploitable injection.
- Publication executes npm against local tarballs and verifies integrity after publishing; guards reject CI, NPM_TOKEN/NODE_AUTH_TOKEN, and noninteractive terminals, but the architecture explicitly trusts the maintainer machine and npm account.
- The scheduled fuzz workflow still invokes removed release-policy test filenames, while the project log records removal of those scripts; its current command is stale despite retaining the lifecycle fuzz step.
- The rebase workflow grants contents:write for issue comments containing /rebase; separately, the documentation vulnerability backlog records time-limited exceptions, so automation authority and dependency exceptions need their own review.