# Risk map — ReactiveX/rxjs

> Canonical page: https://codevetter.com/unpack/rxjs/risk-map

# Risk map — ReactiveX/rxjs

Scanned commit 54796b38a57e6309f9861e174737479bb3f63f61 (2026-08-05). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These risks are source observations or explicitly labeled hypotheses, not confirmed vulnerabilities. The broadest runtime effects come from realm patching, construction policy, and unbounded buffering. Security-sensitive tooling includes file writes, npm publication, privileged rebasing, and documentation HTML ingestion; static inspection also found a stale scheduled test command.
- Fallback initialization replaces AbortController.prototype.abort to emulate abort algorithms before public events, so installation has realm-wide effects beyond Observable itself. — [packages/observable-polyfill/src/index.ts#L60-L90](https://github.com/ReactiveX/rxjs/blob/54796b38a57e6309f9861e174737479bb3f63f61/packages/observable-polyfill/src/index.ts#L60-L90) [packages/observable-polyfill/src/index.ts#L1381-L1395](https://github.com/ReactiveX/rxjs/blob/54796b38a57e6309f9861e174737479bb3f63f61/packages/observable-polyfill/src/index.ts#L1381-L1395)
- Existing Observable values are preserved without conformance probing; public capability installation uses direct assignment with no common preflight or rollback, leaving hardened-realm initialization outside a transactional guarantee. — [docs/rxjs-next/DECISIONS.md#L24-L29](https://github.com/ReactiveX/rxjs/blob/54796b38a57e6309f9861e174737479bb3f63f61/docs/rxjs-next/DECISIONS.md#L24-L29) [docs/rxjs-next/OPEN_QUESTIONS.md#L34-L42](https://github.com/ReactiveX/rxjs/blob/54796b38a57e6309f9861e174737479bb3f63f61/docs/rxjs-next/OPEN_QUESTIONS.md#L34-L42) [packages/rxjs/src/map.ts#L26-L26](https://github.com/ReactiveX/rxjs/blob/54796b38a57e6309f9861e174737479bb3f63f61/packages/rxjs/src/map.ts#L26-L26)
- Buffered async iteration is explicitly unbounded, and replaySubject defaults both size and maxAge to Infinity; consumers must choose retention limits where producer volume requires them. — [packages/rxjs/src/iterate-buffered-values.ts#L8-L12](https://github.com/ReactiveX/rxjs/blob/54796b38a57e6309f9861e174737479bb3f63f61/packages/rxjs/src/iterate-buffered-values.ts#L8-L12) [packages/rxjs/src/replay-subject.ts#L18-L23](https://github.com/ReactiveX/rxjs/blob/54796b38a57e6309f9861e174737479bb3f63f61/packages/rxjs/src/replay-subject.ts#L18-L23)
- Hypothesis: migration application is vulnerable to partial output on an operational failure or filesystem change after preflight, because files are written sequentially without a batch rollback or atomic per-file replacement. (inferred) — [packages/migrate/src/node.ts#L125-L151](https://github.com/ReactiveX/rxjs/blob/54796b38a57e6309f9861e174737479bb3f63f61/packages/migrate/src/node.ts#L125-L151) [packages/migrate/src/node.ts#L155-L163](https://github.com/ReactiveX/rxjs/blob/54796b38a57e6309f9861e174737479bb3f63f61/packages/migrate/src/node.ts#L155-L163)
- DocViewer assigns generated contents directly to innerHTML under an explicit documentation-author trust assumption; this is a content trust boundary, not evidence of exploitable injection. — [apps/rxjs.dev/src/app/layout/doc-viewer/doc-viewer.component.ts#L141-L146](https://github.com/ReactiveX/rxjs/blob/54796b38a57e6309f9861e174737479bb3f63f61/apps/rxjs.dev/src/app/layout/doc-viewer/doc-viewer.component.ts#L141-L146) [apps/rxjs.dev/src/app/documents/document.service.ts#L55-L69](https://github.com/ReactiveX/rxjs/blob/54796b38a57e6309f9861e174737479bb3f63f61/apps/rxjs.dev/src/app/documents/document.service.ts#L55-L69)
- Publication executes npm against local tarballs and verifies integrity after publishing; guards reject CI, NPM_TOKEN/NODE_AUTH_TOKEN, and noninteractive terminals, but the architecture explicitly trusts the maintainer machine and npm account. — [scripts/release/beta.mjs#L79-L109](https://github.com/ReactiveX/rxjs/blob/54796b38a57e6309f9861e174737479bb3f63f61/scripts/release/beta.mjs#L79-L109) [scripts/release/beta.mjs#L164-L171](https://github.com/ReactiveX/rxjs/blob/54796b38a57e6309f9861e174737479bb3f63f61/scripts/release/beta.mjs#L164-L171) [docs/rxjs-next/ARCHITECTURE.md#L80-L87](https://github.com/ReactiveX/rxjs/blob/54796b38a57e6309f9861e174737479bb3f63f61/docs/rxjs-next/ARCHITECTURE.md#L80-L87)
- The scheduled fuzz workflow still invokes removed release-policy test filenames, while the project log records removal of those scripts; its current command is stale despite retaining the lifecycle fuzz step. — [.github/workflows/fuzz.yml#L22-L26](https://github.com/ReactiveX/rxjs/blob/54796b38a57e6309f9861e174737479bb3f63f61/.github/workflows/fuzz.yml#L22-L26) [docs/rxjs-next/PROJECT_PLAN.md#L3706-L3709](https://github.com/ReactiveX/rxjs/blob/54796b38a57e6309f9861e174737479bb3f63f61/docs/rxjs-next/PROJECT_PLAN.md#L3706-L3709)
- The rebase workflow grants contents:write for issue comments containing /rebase; separately, the documentation vulnerability backlog records time-limited exceptions, so automation authority and dependency exceptions need their own review. — [.github/workflows/rebase.yml#L8-L22](https://github.com/ReactiveX/rxjs/blob/54796b38a57e6309f9861e174737479bb3f63f61/.github/workflows/rebase.yml#L8-L22) [docs/security/LEGACY_DOCS_VULNERABILITIES.md#L3-L9](https://github.com/ReactiveX/rxjs/blob/54796b38a57e6309f9861e174737479bb3f63f61/docs/security/LEGACY_DOCS_VULNERABILITIES.md#L3-L9)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)