audit-pub-package

A static audit of Dart pub archives detects supply chain risks by analyzing downloaded package contents, metadata, and dependencies without executing code or requiring network access, reporting potential risk factors with supporting evidence.

You can statically check pub package dependencies for malicious behavior without executing code by analyzing the archive's metadata and dependency tree to extract potential security issues and identify suspicious patterns.

Static analysis of a Dart pub archive evaluates metadata and dependency information to identify potential supply chain risks and malicious behavior, operating strictly within a Dart-only environment to assess package safety without runtime execution.

No, this static audit avoids network access and code execution entirely, relying solely on the static analysis of downloaded archive contents, metadata, and dependencies to evaluate supply chain risks in a Dart-only environment.

To specify which Dart package version to audit for dependency risks, you provide the package name and an optional version parameter to retrieve the exact pub archive and perform static analysis on its contents.

Limitations of statically analyzing Dart pub archives include restricting analysis to a Dart-only environment and relying solely on metadata and dependencies, meaning dynamic or runtime-based malicious behaviors may go undetected without code execution.