Is webpack (npm) safe to install?

Is webpack safe? npm package security — ShadowCanopy

Safe to use

Deep-scanned by ShadowCanopy — no threats found in its code, dependencies, or network behavior.

Scanned 9/5/2026

Approvedwebpack@5.110.3View on registry ↗latest: 5.110.3

webpack@5.110.3 is the legitimate, well-known bundler. All flagged patterns (Function( matches, long method names, base64/hex handling, unicode escapes, template-generated code) are from its normal runtime code emission, WASM/scope-hoisting/async module support, data-URL/HTML chunk handling, and hash utilities. No malicious behavior in the provided sources.

Protect your projects free

AI breakdown

Plain-English summary of what this package does and how it behaves.

webpack is a module bundler that packs ECMAScript/CommonJS/AMD modules for the browser, supporting code splitting, loaders for various file types, and custom preprocessing.

Capabilities

Provides CLI binary via bin/webpack.js
Runs node setup script on prepare
Executes extensive lint, test, and build scripts
Bundles and optimizes JavaScript modules

Data access

Filesystem

Network

No network access observed

Widely adopted open-source bundler with many development scripts and dependencies; static findings reference obfuscation and execution patterns that may reflect generated or minified code rather than runtime behavior.

Dependency & execution chain

Every package this one pulls in, colored by verdict. Expand to walk the tree.

78 packages20 directtruncated

webpack@5.110.396 findings

acorn@8.18.04 findings

events@3.3.0

mime-db@1.54.0

tapable@2.3.3

neo-async@2.6.2

watchpack@2.5.2

graceful-fs@4.2.11

browserslist@4.28.9

schema-utils@4.4.0

@types/estree@1.0.9

es-module-lexer@3.0.2

webpack-sources@3.5.1

enhanced-resolve@5.24.5

@types/json-schema@7.0.15

@webassemblyjs/ast@1.14.1

chrome-trace-event@1.0.4

@webassemblyjs/wasm-edit@1.14.1

minimizer-webpack-plugin@5.10.1

@webassemblyjs/wasm-parser@1.14.1

Security findings (96)

Static analysis rule matches, with the exact code that triggered them.

mediumObfuscated source fileATK-023lib/javascript/ArrayPushCallbackChunkFormatPlugin.js

Multiple obfuscation patterns in lib/javascript/ArrayPushCallbackChunkFormatPlugin.js

mediumObfuscated source fileATK-023package/lib/javascript/ArrayPushCallbackChunkFormatPlugin.js

Multiple obfuscation patterns in package/lib/javascript/ArrayPushCallbackChunkFormatPlugin.js

mediumObfuscated source fileATK-023lib/runtime/AsyncModuleRuntimeModule.js

Multiple obfuscation patterns in lib/runtime/AsyncModuleRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/runtime/AsyncModuleRuntimeModule.js

Multiple obfuscation patterns in package/lib/runtime/AsyncModuleRuntimeModule.js

mediumObfuscated source fileATK-023lib/wasm-async/AsyncWebAssemblyJavascriptGenerator.js

Multiple obfuscation patterns in lib/wasm-async/AsyncWebAssemblyJavascriptGenerator.js

mediumObfuscated source fileATK-023package/lib/wasm-async/AsyncWebAssemblyJavascriptGenerator.js

Multiple obfuscation patterns in package/lib/wasm-async/AsyncWebAssemblyJavascriptGenerator.js

mediumObfuscated source fileATK-023lib/ChunkGraph.js

Multiple obfuscation patterns in lib/ChunkGraph.js

mediumObfuscated source fileATK-023package/lib/ChunkGraph.js

Multiple obfuscation patterns in package/lib/ChunkGraph.js

mediumObfuscated source fileATK-023lib/optimize/ConcatenatedModule.js

Multiple obfuscation patterns in lib/optimize/ConcatenatedModule.js

mediumObfuscated source fileATK-023package/lib/optimize/ConcatenatedModule.js

Multiple obfuscation patterns in package/lib/optimize/ConcatenatedModule.js

mediumObfuscated source fileATK-023lib/sharing/ConsumeSharedRuntimeModule.js

Multiple obfuscation patterns in lib/sharing/ConsumeSharedRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/sharing/ConsumeSharedRuntimeModule.js

Multiple obfuscation patterns in package/lib/sharing/ConsumeSharedRuntimeModule.js

mediumObfuscated source fileATK-023lib/container/ContainerEntryModule.js

Multiple obfuscation patterns in lib/container/ContainerEntryModule.js

mediumObfuscated source fileATK-023package/lib/container/ContainerEntryModule.js

Multiple obfuscation patterns in package/lib/container/ContainerEntryModule.js

mediumObfuscated source fileATK-023lib/ContextModule.js

Multiple obfuscation patterns in lib/ContextModule.js

mediumObfuscated source fileATK-023package/lib/ContextModule.js

Multiple obfuscation patterns in package/lib/ContextModule.js

mediumObfuscated source fileATK-023lib/css/CssGenerator.js

Multiple obfuscation patterns in lib/css/CssGenerator.js

mediumObfuscated source fileATK-023package/lib/css/CssGenerator.js

Multiple obfuscation patterns in package/lib/css/CssGenerator.js

mediumObfuscated source fileATK-023lib/css/CssParser.js

Multiple obfuscation patterns in lib/css/CssParser.js

mediumObfuscated source fileATK-023package/lib/css/CssParser.js

Multiple obfuscation patterns in package/lib/css/CssParser.js

mediumObfuscated source fileATK-023lib/errors/EnvironmentNotSupportAsyncWarning.js

Multiple obfuscation patterns in lib/errors/EnvironmentNotSupportAsyncWarning.js

mediumObfuscated source fileATK-023package/lib/errors/EnvironmentNotSupportAsyncWarning.js

Multiple obfuscation patterns in package/lib/errors/EnvironmentNotSupportAsyncWarning.js

mediumObfuscated source fileATK-023lib/EvalSourceMapDevToolPlugin.js

Multiple obfuscation patterns in lib/EvalSourceMapDevToolPlugin.js

mediumObfuscated source fileATK-023package/lib/EvalSourceMapDevToolPlugin.js

Multiple obfuscation patterns in package/lib/EvalSourceMapDevToolPlugin.js

mediumObfuscated source fileATK-023lib/ExternalModule.js

Multiple obfuscation patterns in lib/ExternalModule.js

mediumObfuscated source fileATK-023package/lib/ExternalModule.js

Multiple obfuscation patterns in package/lib/ExternalModule.js

mediumObfuscated source fileATK-023lib/FileSystemInfo.js

Multiple obfuscation patterns in lib/FileSystemInfo.js

mediumObfuscated source fileATK-023package/lib/FileSystemInfo.js

Multiple obfuscation patterns in package/lib/FileSystemInfo.js

mediumObfuscated source fileATK-023lib/dependencies/HarmonyAcceptDependency.js

Multiple obfuscation patterns in lib/dependencies/HarmonyAcceptDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/HarmonyAcceptDependency.js

Multiple obfuscation patterns in package/lib/dependencies/HarmonyAcceptDependency.js

mediumObfuscated source fileATK-023lib/dependencies/HarmonyCompatibilityDependency.js

Multiple obfuscation patterns in lib/dependencies/HarmonyCompatibilityDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/HarmonyCompatibilityDependency.js

Multiple obfuscation patterns in package/lib/dependencies/HarmonyCompatibilityDependency.js

mediumObfuscated source fileATK-023lib/dependencies/HarmonyDetectionParserPlugin.js

Multiple obfuscation patterns in lib/dependencies/HarmonyDetectionParserPlugin.js

mediumObfuscated source fileATK-023package/lib/dependencies/HarmonyDetectionParserPlugin.js

Multiple obfuscation patterns in package/lib/dependencies/HarmonyDetectionParserPlugin.js

mediumObfuscated source fileATK-023lib/dependencies/HarmonyExportImportedSpecifierDependency.js

Multiple obfuscation patterns in lib/dependencies/HarmonyExportImportedSpecifierDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/HarmonyExportImportedSpecifierDependency.js

Multiple obfuscation patterns in package/lib/dependencies/HarmonyExportImportedSpecifierDependency.js

mediumObfuscated source fileATK-023lib/util/hash/hash-digest.js

Multiple obfuscation patterns in lib/util/hash/hash-digest.js

mediumObfuscated source fileATK-023package/lib/util/hash/hash-digest.js

Multiple obfuscation patterns in package/lib/util/hash/hash-digest.js

mediumObfuscated source fileATK-023lib/html/HtmlParser.js

Multiple obfuscation patterns in lib/html/HtmlParser.js

mediumObfuscated source fileATK-023package/lib/html/HtmlParser.js

Multiple obfuscation patterns in package/lib/html/HtmlParser.js

mediumObfuscated source fileATK-023lib/dependencies/ImportDependency.js

Multiple obfuscation patterns in lib/dependencies/ImportDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/ImportDependency.js

Multiple obfuscation patterns in package/lib/dependencies/ImportDependency.js

mediumObfuscated source fileATK-023lib/webworker/ImportScriptsChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in lib/webworker/ImportScriptsChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/webworker/ImportScriptsChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in package/lib/webworker/ImportScriptsChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023lib/index.js

Multiple obfuscation patterns in lib/index.js

mediumObfuscated source fileATK-023package/lib/index.js

Multiple obfuscation patterns in package/lib/index.js

mediumObfuscated source fileATK-023lib/javascript/JavascriptModulesPlugin.js

Multiple obfuscation patterns in lib/javascript/JavascriptModulesPlugin.js

mediumObfuscated source fileATK-023package/lib/javascript/JavascriptModulesPlugin.js

Multiple obfuscation patterns in package/lib/javascript/JavascriptModulesPlugin.js

mediumObfuscated source fileATK-023lib/javascript/JavascriptParser.js

Multiple obfuscation patterns in lib/javascript/JavascriptParser.js

mediumObfuscated source fileATK-023package/lib/javascript/JavascriptParser.js

Multiple obfuscation patterns in package/lib/javascript/JavascriptParser.js

mediumObfuscated source fileATK-023lib/web/JsonpChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in lib/web/JsonpChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/web/JsonpChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in package/lib/web/JsonpChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023lib/runtime/MakeDeferredNamespaceObjectRuntime.js

Multiple obfuscation patterns in lib/runtime/MakeDeferredNamespaceObjectRuntime.js

mediumObfuscated source fileATK-023package/lib/runtime/MakeDeferredNamespaceObjectRuntime.js

Multiple obfuscation patterns in package/lib/runtime/MakeDeferredNamespaceObjectRuntime.js

mediumObfuscated source fileATK-023lib/esm/ModuleChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in lib/esm/ModuleChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/esm/ModuleChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in package/lib/esm/ModuleChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023lib/node/nodeConsole.js

Multiple obfuscation patterns in lib/node/nodeConsole.js

mediumObfuscated source fileATK-023package/lib/node/nodeConsole.js

Multiple obfuscation patterns in package/lib/node/nodeConsole.js

mediumObfuscated source fileATK-023lib/NodeStuffPlugin.js

Multiple obfuscation patterns in lib/NodeStuffPlugin.js

mediumObfuscated source fileATK-023package/lib/NodeStuffPlugin.js

Multiple obfuscation patterns in package/lib/NodeStuffPlugin.js

mediumObfuscated source fileATK-023lib/node/ReadFileChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in lib/node/ReadFileChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/node/ReadFileChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in package/lib/node/ReadFileChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023lib/container/RemoteRuntimeModule.js

Multiple obfuscation patterns in lib/container/RemoteRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/container/RemoteRuntimeModule.js

Multiple obfuscation patterns in package/lib/container/RemoteRuntimeModule.js

mediumObfuscated source fileATK-023lib/node/RequireChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in lib/node/RequireChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/node/RequireChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in package/lib/node/RequireChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023lib/RuntimeTemplate.js

Multiple obfuscation patterns in lib/RuntimeTemplate.js

mediumObfuscated source fileATK-023package/lib/RuntimeTemplate.js

Multiple obfuscation patterns in package/lib/RuntimeTemplate.js

mediumObfuscated source fileATK-023lib/sharing/ShareRuntimeModule.js

Multiple obfuscation patterns in lib/sharing/ShareRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/sharing/ShareRuntimeModule.js

Multiple obfuscation patterns in package/lib/sharing/ShareRuntimeModule.js

mediumObfuscated source fileATK-023lib/util/SourceProcessor.js

Multiple obfuscation patterns in lib/util/SourceProcessor.js

mediumObfuscated source fileATK-023package/lib/util/SourceProcessor.js

Multiple obfuscation patterns in package/lib/util/SourceProcessor.js

mediumObfuscated source fileATK-023lib/javascript/StartupHelpers.js

Multiple obfuscation patterns in lib/javascript/StartupHelpers.js

mediumObfuscated source fileATK-023package/lib/javascript/StartupHelpers.js

Multiple obfuscation patterns in package/lib/javascript/StartupHelpers.js

mediumObfuscated source fileATK-023lib/javascript/syntax.js

Multiple obfuscation patterns in lib/javascript/syntax.js

mediumObfuscated source fileATK-023package/lib/javascript/syntax.js

Multiple obfuscation patterns in package/lib/javascript/syntax.js

mediumObfuscated source fileATK-023lib/Template.js

Multiple obfuscation patterns in lib/Template.js

mediumObfuscated source fileATK-023package/lib/Template.js

Multiple obfuscation patterns in package/lib/Template.js

mediumObfuscated source fileATK-023lib/runtime/ToBinaryRuntimeModule.js

Multiple obfuscation patterns in lib/runtime/ToBinaryRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/runtime/ToBinaryRuntimeModule.js

Multiple obfuscation patterns in package/lib/runtime/ToBinaryRuntimeModule.js

mediumObfuscated source fileATK-023lib/wasm-sync/WebAssemblyGenerator.js

Multiple obfuscation patterns in lib/wasm-sync/WebAssemblyGenerator.js

mediumObfuscated source fileATK-023package/lib/wasm-sync/WebAssemblyGenerator.js

Multiple obfuscation patterns in package/lib/wasm-sync/WebAssemblyGenerator.js

mediumObfuscated source fileATK-023lib/wasm-sync/WebAssemblyParser.js

Multiple obfuscation patterns in lib/wasm-sync/WebAssemblyParser.js

mediumObfuscated source fileATK-023package/lib/wasm-sync/WebAssemblyParser.js

Multiple obfuscation patterns in package/lib/wasm-sync/WebAssemblyParser.js

mediumObfuscated source fileATK-023lib/dependencies/WorkletDependency.js

Multiple obfuscation patterns in lib/dependencies/WorkletDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/WorkletDependency.js

Multiple obfuscation patterns in package/lib/dependencies/WorkletDependency.js

highDecoded payload executedATK-026lib/ConcatenationScope.js

File lib/ConcatenationScope.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highDecoded payload executedATK-026package/lib/ConcatenationScope.js

File package/lib/ConcatenationScope.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highDecoded payload executedATK-026lib/util/dataURL.js

File lib/util/dataURL.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highDecoded payload executedATK-026package/lib/util/dataURL.js

File package/lib/util/dataURL.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highRemote fetch with process executionATK-024lib/dependencies/HtmlEntryDependency.js

File lib/dependencies/HtmlEntryDependency.js combines network access with process execution

highRemote fetch with process executionATK-024package/lib/dependencies/HtmlEntryDependency.js

File package/lib/dependencies/HtmlEntryDependency.js combines network access with process execution

highDecoded payload executedATK-026lib/html/HtmlGenerator.js

File lib/html/HtmlGenerator.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highDecoded payload executedATK-026package/lib/html/HtmlGenerator.js

File package/lib/html/HtmlGenerator.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highRemote fetch with process executionATK-024lib/config/target.js

File lib/config/target.js combines network access with process execution

highRemote fetch with process executionATK-024package/lib/config/target.js

File package/lib/config/target.js combines network access with process execution

Package metadata

LicenseMIT

Packs ECMAScript/CommonJs/AMD modules for the browser. Allows you to split your codebase into multiple bundles, which can be loaded on demand. Supports loaders to preprocess files, i.e. json, jsx, es7, css, less, ... and your custom stuff.

Homepage ↗Repository ↗

Files in package (500)

LICENSEpackage/LICENSElib/library/AbstractLibraryPlugin.jspackage/lib/library/AbstractLibraryPlugin.jslib/errors/AbstractMethodError.jspackage/lib/errors/AbstractMethodError.jslib/cache/AddBuildDependenciesPlugin.jspackage/lib/cache/AddBuildDependenciesPlugin.jslib/cache/AddManagedPathsPlugin.jspackage/lib/cache/AddManagedPathsPlugin.jslib/serialization/AggregateErrorSerializer.jspackage/lib/serialization/AggregateErrorSerializer.jslib/optimize/AggressiveMergingPlugin.jspackage/lib/optimize/AggressiveMergingPlugin.jsschemas/plugins/optimize/AggressiveSplittingPlugin.check.jspackage/schemas/plugins/optimize/AggressiveSplittingPlugin.check.jslib/optimize/AggressiveSplittingPlugin.jspackage/lib/optimize/AggressiveSplittingPlugin.jslib/dependencies/AMDDefineDependency.jspackage/lib/dependencies/AMDDefineDependency.jslib/dependencies/AMDDefineDependencyParserPlugin.jspackage/lib/dependencies/AMDDefineDependencyParserPlugin.jslib/library/AmdLibraryPlugin.jspackage/lib/library/AmdLibraryPlugin.jslib/dependencies/AMDPlugin.jspackage/lib/dependencies/AMDPlugin.jslib/dependencies/AMDRequireArrayDependency.jspackage/lib/dependencies/AMDRequireArrayDependency.jslib/dependencies/AMDRequireContextDependency.jspackage/lib/dependencies/AMDRequireContextDependency.jslib/dependencies/AMDRequireDependenciesBlock.jspackage/lib/dependencies/AMDRequireDependenciesBlock.jslib/dependencies/AMDRequireDependenciesBlockParserPlugin.jspackage/lib/dependencies/AMDRequireDependenciesBlockParserPlugin.jslib/dependencies/AMDRequireDependency.jspackage/lib/dependencies/AMDRequireDependency.jslib/dependencies/AMDRequireItemDependency.jspackage/lib/dependencies/AMDRequireItemDependency.jslib/dependencies/AMDRuntimeModules.jspackage/lib/dependencies/AMDRuntimeModules.js

How ShadowCanopy checks npm packages

ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.

Protect your projects free See what's being blocked

Other npm packages

express react react-dom lodash axios chalk commander next typescript vite eslint prettier

This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/webpack

webpack — deep security report