ShadowCanopy
Log inGet started

npm package intelligence

webpack — deep security report

ShadowCanopy's full breakdown of webpack on npm: verdict, AI analysis, dependency chain, network behavior, prebuilds, and obfuscated code.

Safe to use
Deep-scanned by ShadowCanopy — no threats found in its code, dependencies, or network behavior.
Scanned 10/24/2026
Approvedwebpack@5.112.2View on registry ↗latest: 5.112.2

Legitimate webpack 5.112.2. All 'obfuscation' and 'decoded payload' findings are false positives from runtime template strings (supportsArrowFunction, basicFunction, etc.) and normal base64/hex handling in data URLs, hashing, and parsers. No malicious behavior present.

Protect your projects free

AI breakdown

Plain-English summary of what this package does and how it behaves.

webpack is a module bundler that packs ECMAScript/CommonJS/AMD modules for the browser, supports code splitting into bundles, and includes loaders for preprocessing various file types.

Capabilities

  • Provides CLI entrypoint via bin/webpack.js
  • Runs prepare script with husky
  • Includes extensive build/lint/test tooling scripts
  • Depends on modules for resolution, parsing, and source handling

Data access

  • Filesystem
  • Environment variables (via test/runtime scripts)

Network

  • No network access observed

Standard webpack package with many development scripts and a large source tree; static findings reference obfuscation and payload execution but are not corroborated by the manifest or file samples.

Dependency & execution chain

Every package this one pulls in, colored by verdict. Expand to walk the tree.

77 packages18 directtruncated
webpack@5.112.2104 findings
events@3.3.0
mime-db@1.54.0
tapable@2.3.3
watchpack@2.6.3
browserslist@4.29.52 findings
es-module-lexer@3.0.412 findings
minimizer-webpack-plugin@5.14.02 findings

Security findings (104)

Static analysis rule matches, with the exact code that triggered them.

mediumObfuscated source fileATK-023lib/javascript/ArrayPushCallbackChunkFormatPlugin.js

Multiple obfuscation patterns in lib/javascript/ArrayPushCallbackChunkFormatPlugin.js

mediumObfuscated source fileATK-023package/lib/javascript/ArrayPushCallbackChunkFormatPlugin.js

Multiple obfuscation patterns in package/lib/javascript/ArrayPushCallbackChunkFormatPlugin.js

mediumObfuscated source fileATK-023lib/runtime/AsyncModuleRuntimeModule.js

Multiple obfuscation patterns in lib/runtime/AsyncModuleRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/runtime/AsyncModuleRuntimeModule.js

Multiple obfuscation patterns in package/lib/runtime/AsyncModuleRuntimeModule.js

mediumObfuscated source fileATK-023lib/wasm/AsyncWebAssemblyJavascriptGenerator.js

Multiple obfuscation patterns in lib/wasm/AsyncWebAssemblyJavascriptGenerator.js

mediumObfuscated source fileATK-023package/lib/wasm/AsyncWebAssemblyJavascriptGenerator.js

Multiple obfuscation patterns in package/lib/wasm/AsyncWebAssemblyJavascriptGenerator.js

mediumObfuscated source fileATK-023lib/graph/ChunkGraph.js

Multiple obfuscation patterns in lib/graph/ChunkGraph.js

mediumObfuscated source fileATK-023package/lib/graph/ChunkGraph.js

Multiple obfuscation patterns in package/lib/graph/ChunkGraph.js

mediumObfuscated source fileATK-023lib/optimize/ConcatenatedModule.js

Multiple obfuscation patterns in lib/optimize/ConcatenatedModule.js

mediumObfuscated source fileATK-023package/lib/optimize/ConcatenatedModule.js

Multiple obfuscation patterns in package/lib/optimize/ConcatenatedModule.js

mediumObfuscated source fileATK-023lib/sharing/ConsumeSharedRuntimeModule.js

Multiple obfuscation patterns in lib/sharing/ConsumeSharedRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/sharing/ConsumeSharedRuntimeModule.js

Multiple obfuscation patterns in package/lib/sharing/ConsumeSharedRuntimeModule.js

mediumObfuscated source fileATK-023lib/container/ContainerEntryModule.js

Multiple obfuscation patterns in lib/container/ContainerEntryModule.js

mediumObfuscated source fileATK-023package/lib/container/ContainerEntryModule.js

Multiple obfuscation patterns in package/lib/container/ContainerEntryModule.js

mediumObfuscated source fileATK-023lib/context/ContextModule.js

Multiple obfuscation patterns in lib/context/ContextModule.js

mediumObfuscated source fileATK-023package/lib/context/ContextModule.js

Multiple obfuscation patterns in package/lib/context/ContextModule.js

mediumObfuscated source fileATK-023lib/css/CssParser.js

Multiple obfuscation patterns in lib/css/CssParser.js

mediumObfuscated source fileATK-023package/lib/css/CssParser.js

Multiple obfuscation patterns in package/lib/css/CssParser.js

mediumObfuscated source fileATK-023lib/util/dataURL.js

Multiple obfuscation patterns in lib/util/dataURL.js

mediumObfuscated source fileATK-023package/lib/util/dataURL.js

Multiple obfuscation patterns in package/lib/util/dataURL.js

mediumObfuscated source fileATK-023lib/define/DefinePlugin.js

Multiple obfuscation patterns in lib/define/DefinePlugin.js

mediumObfuscated source fileATK-023package/lib/define/DefinePlugin.js

Multiple obfuscation patterns in package/lib/define/DefinePlugin.js

mediumObfuscated source fileATK-023lib/errors/EnvironmentNotSupportAsyncWarning.js

Multiple obfuscation patterns in lib/errors/EnvironmentNotSupportAsyncWarning.js

mediumObfuscated source fileATK-023package/lib/errors/EnvironmentNotSupportAsyncWarning.js

Multiple obfuscation patterns in package/lib/errors/EnvironmentNotSupportAsyncWarning.js

mediumObfuscated source fileATK-023lib/dependencies/esm/ESMAcceptDependency.js

Multiple obfuscation patterns in lib/dependencies/esm/ESMAcceptDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/esm/ESMAcceptDependency.js

Multiple obfuscation patterns in package/lib/dependencies/esm/ESMAcceptDependency.js

mediumObfuscated source fileATK-023lib/dependencies/esm/ESMCompatibilityDependency.js

Multiple obfuscation patterns in lib/dependencies/esm/ESMCompatibilityDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/esm/ESMCompatibilityDependency.js

Multiple obfuscation patterns in package/lib/dependencies/esm/ESMCompatibilityDependency.js

mediumObfuscated source fileATK-023lib/dependencies/esm/ESMDetectionParserPlugin.js

Multiple obfuscation patterns in lib/dependencies/esm/ESMDetectionParserPlugin.js

mediumObfuscated source fileATK-023package/lib/dependencies/esm/ESMDetectionParserPlugin.js

Multiple obfuscation patterns in package/lib/dependencies/esm/ESMDetectionParserPlugin.js

mediumObfuscated source fileATK-023lib/dependencies/esm/ESMExportImportedSpecifierDependency.js

Multiple obfuscation patterns in lib/dependencies/esm/ESMExportImportedSpecifierDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/esm/ESMExportImportedSpecifierDependency.js

Multiple obfuscation patterns in package/lib/dependencies/esm/ESMExportImportedSpecifierDependency.js

mediumObfuscated source fileATK-023lib/dependencies/esm/ESMLiveExportDependency.js

Multiple obfuscation patterns in lib/dependencies/esm/ESMLiveExportDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/esm/ESMLiveExportDependency.js

Multiple obfuscation patterns in package/lib/dependencies/esm/ESMLiveExportDependency.js

mediumObfuscated source fileATK-023lib/externals/ExternalModule.js

Multiple obfuscation patterns in lib/externals/ExternalModule.js

mediumObfuscated source fileATK-023package/lib/externals/ExternalModule.js

Multiple obfuscation patterns in package/lib/externals/ExternalModule.js

mediumObfuscated source fileATK-023lib/fs/FileSystemInfo.js

Multiple obfuscation patterns in lib/fs/FileSystemInfo.js

mediumObfuscated source fileATK-023package/lib/fs/FileSystemInfo.js

Multiple obfuscation patterns in package/lib/fs/FileSystemInfo.js

mediumObfuscated source fileATK-023lib/util/hash/hash-digest.js

Multiple obfuscation patterns in lib/util/hash/hash-digest.js

mediumObfuscated source fileATK-023package/lib/util/hash/hash-digest.js

Multiple obfuscation patterns in package/lib/util/hash/hash-digest.js

mediumObfuscated source fileATK-023lib/html/HtmlParser.js

Multiple obfuscation patterns in lib/html/HtmlParser.js

mediumObfuscated source fileATK-023package/lib/html/HtmlParser.js

Multiple obfuscation patterns in package/lib/html/HtmlParser.js

mediumObfuscated source fileATK-023lib/dependencies/import/ImportContextDependency.js

Multiple obfuscation patterns in lib/dependencies/import/ImportContextDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/import/ImportContextDependency.js

Multiple obfuscation patterns in package/lib/dependencies/import/ImportContextDependency.js

mediumObfuscated source fileATK-023lib/dependencies/import/ImportDependency.js

Multiple obfuscation patterns in lib/dependencies/import/ImportDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/import/ImportDependency.js

Multiple obfuscation patterns in package/lib/dependencies/import/ImportDependency.js

mediumObfuscated source fileATK-023lib/dependencies/import/ImportEagerDependency.js

Multiple obfuscation patterns in lib/dependencies/import/ImportEagerDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/import/ImportEagerDependency.js

Multiple obfuscation patterns in package/lib/dependencies/import/ImportEagerDependency.js

mediumObfuscated source fileATK-023lib/webworker/ImportScriptsChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in lib/webworker/ImportScriptsChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/webworker/ImportScriptsChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in package/lib/webworker/ImportScriptsChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023lib/dependencies/import/ImportWeakDependency.js

Multiple obfuscation patterns in lib/dependencies/import/ImportWeakDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/import/ImportWeakDependency.js

Multiple obfuscation patterns in package/lib/dependencies/import/ImportWeakDependency.js

mediumObfuscated source fileATK-023lib/index.js

Multiple obfuscation patterns in lib/index.js

mediumObfuscated source fileATK-023package/lib/index.js

Multiple obfuscation patterns in package/lib/index.js

mediumObfuscated source fileATK-023lib/javascript/JavascriptModulesPlugin.js

Multiple obfuscation patterns in lib/javascript/JavascriptModulesPlugin.js

mediumObfuscated source fileATK-023package/lib/javascript/JavascriptModulesPlugin.js

Multiple obfuscation patterns in package/lib/javascript/JavascriptModulesPlugin.js

mediumObfuscated source fileATK-023lib/javascript/JavascriptParser.js

Multiple obfuscation patterns in lib/javascript/JavascriptParser.js

mediumObfuscated source fileATK-023package/lib/javascript/JavascriptParser.js

Multiple obfuscation patterns in package/lib/javascript/JavascriptParser.js

mediumObfuscated source fileATK-023lib/web/JsonpChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in lib/web/JsonpChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/web/JsonpChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in package/lib/web/JsonpChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023lib/runtime/MakeDeferredNamespaceObjectRuntime.js

Multiple obfuscation patterns in lib/runtime/MakeDeferredNamespaceObjectRuntime.js

mediumObfuscated source fileATK-023package/lib/runtime/MakeDeferredNamespaceObjectRuntime.js

Multiple obfuscation patterns in package/lib/runtime/MakeDeferredNamespaceObjectRuntime.js

mediumObfuscated source fileATK-023lib/esm/ModuleChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in lib/esm/ModuleChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/esm/ModuleChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in package/lib/esm/ModuleChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023lib/library/ModuleLibraryPlugin.js

Multiple obfuscation patterns in lib/library/ModuleLibraryPlugin.js

mediumObfuscated source fileATK-023package/lib/library/ModuleLibraryPlugin.js

Multiple obfuscation patterns in package/lib/library/ModuleLibraryPlugin.js

mediumObfuscated source fileATK-023lib/node/nodeConsole.js

Multiple obfuscation patterns in lib/node/nodeConsole.js

mediumObfuscated source fileATK-023package/lib/node/nodeConsole.js

Multiple obfuscation patterns in package/lib/node/nodeConsole.js

mediumObfuscated source fileATK-023lib/node/NodeStuffPlugin.js

Multiple obfuscation patterns in lib/node/NodeStuffPlugin.js

mediumObfuscated source fileATK-023package/lib/node/NodeStuffPlugin.js

Multiple obfuscation patterns in package/lib/node/NodeStuffPlugin.js

mediumObfuscated source fileATK-023lib/node/ReadFileChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in lib/node/ReadFileChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/node/ReadFileChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in package/lib/node/ReadFileChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023lib/container/RemoteRuntimeModule.js

Multiple obfuscation patterns in lib/container/RemoteRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/container/RemoteRuntimeModule.js

Multiple obfuscation patterns in package/lib/container/RemoteRuntimeModule.js

mediumObfuscated source fileATK-023lib/node/RequireChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in lib/node/RequireChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/node/RequireChunkLoadingRuntimeModule.js

Multiple obfuscation patterns in package/lib/node/RequireChunkLoadingRuntimeModule.js

mediumObfuscated source fileATK-023lib/template/RuntimeTemplate.js

Multiple obfuscation patterns in lib/template/RuntimeTemplate.js

mediumObfuscated source fileATK-023package/lib/template/RuntimeTemplate.js

Multiple obfuscation patterns in package/lib/template/RuntimeTemplate.js

mediumObfuscated source fileATK-023lib/sharing/ShareRuntimeModule.js

Multiple obfuscation patterns in lib/sharing/ShareRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/sharing/ShareRuntimeModule.js

Multiple obfuscation patterns in package/lib/sharing/ShareRuntimeModule.js

mediumObfuscated source fileATK-023lib/util/SourceProcessor.js

Multiple obfuscation patterns in lib/util/SourceProcessor.js

mediumObfuscated source fileATK-023package/lib/util/SourceProcessor.js

Multiple obfuscation patterns in package/lib/util/SourceProcessor.js

mediumObfuscated source fileATK-023lib/javascript/StartupHelpers.js

Multiple obfuscation patterns in lib/javascript/StartupHelpers.js

mediumObfuscated source fileATK-023package/lib/javascript/StartupHelpers.js

Multiple obfuscation patterns in package/lib/javascript/StartupHelpers.js

mediumObfuscated source fileATK-023lib/css/syntax-printer.js

Multiple obfuscation patterns in lib/css/syntax-printer.js

mediumObfuscated source fileATK-023package/lib/css/syntax-printer.js

Multiple obfuscation patterns in package/lib/css/syntax-printer.js

mediumObfuscated source fileATK-023lib/template/Template.js

Multiple obfuscation patterns in lib/template/Template.js

mediumObfuscated source fileATK-023package/lib/template/Template.js

Multiple obfuscation patterns in package/lib/template/Template.js

mediumObfuscated source fileATK-023lib/runtime/ToBinaryRuntimeModule.js

Multiple obfuscation patterns in lib/runtime/ToBinaryRuntimeModule.js

mediumObfuscated source fileATK-023package/lib/runtime/ToBinaryRuntimeModule.js

Multiple obfuscation patterns in package/lib/runtime/ToBinaryRuntimeModule.js

mediumObfuscated source fileATK-023lib/wasm-sync/WebAssemblyParser.js

Multiple obfuscation patterns in lib/wasm-sync/WebAssemblyParser.js

mediumObfuscated source fileATK-023package/lib/wasm-sync/WebAssemblyParser.js

Multiple obfuscation patterns in package/lib/wasm-sync/WebAssemblyParser.js

mediumObfuscated source fileATK-023lib/dependencies/worker/WorkletDependency.js

Multiple obfuscation patterns in lib/dependencies/worker/WorkletDependency.js

mediumObfuscated source fileATK-023package/lib/dependencies/worker/WorkletDependency.js

Multiple obfuscation patterns in package/lib/dependencies/worker/WorkletDependency.js

highDecoded payload executedATK-026lib/optimize/ConcatenationScope.js

File lib/optimize/ConcatenationScope.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highDecoded payload executedATK-026package/lib/optimize/ConcatenationScope.js

File package/lib/optimize/ConcatenationScope.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highDecoded payload executedATK-026lib/util/dataURL.js

File lib/util/dataURL.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highDecoded payload executedATK-026package/lib/util/dataURL.js

File package/lib/util/dataURL.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highRemote fetch with process executionATK-024lib/dependencies/html/HtmlEntryDependency.js

File lib/dependencies/html/HtmlEntryDependency.js combines network access with process execution

highRemote fetch with process executionATK-024package/lib/dependencies/html/HtmlEntryDependency.js

File package/lib/dependencies/html/HtmlEntryDependency.js combines network access with process execution

highDecoded payload executedATK-026lib/html/HtmlGenerator.js

File lib/html/HtmlGenerator.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highDecoded payload executedATK-026package/lib/html/HtmlGenerator.js

File package/lib/html/HtmlGenerator.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.

highRemote fetch with process executionATK-024lib/config/target.js

File lib/config/target.js combines network access with process execution

highRemote fetch with process executionATK-024package/lib/config/target.js

File package/lib/config/target.js combines network access with process execution

Package metadata

LicenseMIT

Packs ECMAScript/CommonJs/AMD modules for the browser. Allows you to split your codebase into multiple bundles, which can be loaded on demand. Supports loaders to preprocess files, i.e. json, jsx, es7, css, less, ... and your custom stuff.

Homepage ↗Repository ↗

Files in package (500)

LICENSEpackage/LICENSElib/library/AbstractLibraryPlugin.jspackage/lib/library/AbstractLibraryPlugin.jslib/errors/AbstractMethodError.jspackage/lib/errors/AbstractMethodError.jslib/cache/AddBuildDependenciesPlugin.jspackage/lib/cache/AddBuildDependenciesPlugin.jslib/cache/AddManagedPathsPlugin.jspackage/lib/cache/AddManagedPathsPlugin.jslib/serialization/AggregateErrorSerializer.jspackage/lib/serialization/AggregateErrorSerializer.jslib/optimize/AggressiveMergingPlugin.jspackage/lib/optimize/AggressiveMergingPlugin.jsschemas/plugins/optimize/AggressiveSplittingPlugin.check.jspackage/schemas/plugins/optimize/AggressiveSplittingPlugin.check.jslib/optimize/AggressiveSplittingPlugin.jspackage/lib/optimize/AggressiveSplittingPlugin.jslib/dependencies/amd/AMDDefineDependency.jspackage/lib/dependencies/amd/AMDDefineDependency.jslib/dependencies/amd/AMDDefineDependencyParserPlugin.jspackage/lib/dependencies/amd/AMDDefineDependencyParserPlugin.jslib/library/AmdLibraryPlugin.jspackage/lib/library/AmdLibraryPlugin.jslib/dependencies/amd/AMDPlugin.jspackage/lib/dependencies/amd/AMDPlugin.jslib/dependencies/amd/AMDRequireArrayDependency.jspackage/lib/dependencies/amd/AMDRequireArrayDependency.jslib/dependencies/amd/AMDRequireContextDependency.jspackage/lib/dependencies/amd/AMDRequireContextDependency.jslib/dependencies/amd/AMDRequireDependenciesBlock.jspackage/lib/dependencies/amd/AMDRequireDependenciesBlock.jslib/dependencies/amd/AMDRequireDependenciesBlockParserPlugin.jspackage/lib/dependencies/amd/AMDRequireDependenciesBlockParserPlugin.jslib/dependencies/amd/AMDRequireDependency.jspackage/lib/dependencies/amd/AMDRequireDependency.jslib/dependencies/amd/AMDRequireItemDependency.jspackage/lib/dependencies/amd/AMDRequireItemDependency.jslib/dependencies/amd/AMDRuntimeModules.jspackage/lib/dependencies/amd/AMDRuntimeModules.js

How ShadowCanopy checks npm packages

ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.

Protect your projects freeSee what's being blocked

Other npm packages

expressreactreact-domlodashaxioschalkcommandernexttypescriptviteeslintprettier

This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/webpack