The package uses importScripts with eval, but this is a legitimate use case for loading worker threads in a bundler, so it's not classified as malware.
No verification record available.
The provided evidence highlights the use of importScripts with eval in wasi-worker.mjs. While this pattern can lead to arbitrary code execution if the input to importScripts is attacker-controlled, the provided information about the legitimate use case of this package indicates that this pattern is used for worker threads to load additional logic dynamically, which is a common practice in bundlers. Given this context, and the warning against classifying the package as malware based on this behavior, I am classifying this package as not malicious.
