I analysed the 162 most popular Dart packages. 59% of what a scanner would flag never runs in your app.
I maintain capdrift, a tool that reads a Dart package and reports what it is able to do. I ran it across the 162 most-downloaded packages on pub.dev and kept the raw output. Here is what is actually in there. Method: capdrift inspect <pkg> --format json against each package's latest version, resolved AST rather than regex, no code executed. 162 packages, 1,805 findings, zero analysis failures.…
A study analyzed the 162 most popular Dart packages on pub.dev, and found that 59% of the findings flagged by a scanner never run in an actual app. The tool, capdrift, inspected each package's latest version, focusing on the actual code that would be shipped to consumers rather than tests and examples. Out of the 1,805 findings, 633 were relevant to runtime capabilities such as filesystem access, platform info, native code execution, and subprocess execution.
This suggests that a significant portion of the ecosystem's risk concentrates in a smaller set of packages. Dynamic code loading was of particular concern, as packages like build_runner, dio, sentry, and file_picker use Isolate.spawn and Isolate.spawnUri to download and execute code at runtime. Despite the large number of findings, about 47 packages had no capabilities at all, indicating a healthier ecosystem than initially expected.
However, half of the packages are inert, with no actual functionality. The analysis also noted that dynamic code loading packages are isolated from the rest of the ecosystem, making them less visible to reviewers and static analysis tools.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
