A survey of 162 Dart packages says 59% of scanner findings never ship

Triage is priced per finding, and dio sets the price. A scanner that walks every .dart file in the published archive reports 142 findings against it; four are things a consumer of dio is actually exposed to, and the remaining 138 are the package's own test suite and example app ^[5][6]. That leaves 2.8% of the report worth a human minute ^[3].

The reason the ratio exists is not subtle. A pub archive carries test/ and example/ next to lib/, and a scanner reading .dart files has no reason to care which tree a socket call sits in unless someone teaches it the difference. capdrift's maintainer resolved the AST rather than matching regexes and executed nothing ^[2], and makes the point that none of the 142 are wrong: each is a real API call in a real file ^[7]. What the report does not do is say which ones could reach a dependent, and a test that opens a socket stops existing the moment you add the package to pubspec.yaml ^[4].

Restricted to code that runs for a consumer, the survey lands on 633 findings across 81 packages ^[8]. That is 7.8 per package ^[2], and it means the other 81 of the 162 have nothing consumer-reachable at all ^[1]. Forty-seven have no capabilities whatever, including collection and meta ^[9]. What is left is a much smaller reading list than the raw count implies, and the part of it worth reading first is runtime code loading, because static analysis cannot follow it: build_runner calls Isolate.spawnUri, which downloads Dart from a URI and runs it ^[10], drift uses both spawn forms, and dio, sentry, sentry_flutter, file_picker, flutter_map and extended_image use Isolate.spawn ^[11]. analyzer, pigeon and collection touch dart:mirrors, and collection's use of it turns out to be confined to its own test support ^[12] - which capdrift logs as a caveat about the analysis rather than a verdict on the package ^[13].

The number that does not sit still is the headline one. 633 consumer-reachable findings out of 1,805 is 35%, which puts 65% outside shipped code, not 59% ^[4]. Six points of the survey's central claim are unreconciled in the post itself. The raw JSON for all 162 packages and the analysis script are published ^[19], so the gap is checkable by anyone who cares to, which is more than most vendor telemetry offers.

The null result is the part I would keep. None of the 162 packages ship a hook/ directory ^[14], code that runs on your machine at pub get time before your own app executes. The maintainer checked that against three synthetic fixtures, one of which shells out to curl from a build hook, with 11/11 recall on that corpus ^[15]. Native-assets hooks are new enough that the established packages predate them, and nobody reviewing dependencies has built habits for reading them ^[16]. Two caveats sit on all of this: the corpus is the download ranking, and popular packages are better maintained than average, so it is a best case rather than a typical one ^[17], and fl_chart, get, hive_flutter and photo_view did not fully resolve, so their contributions are floors ^[18].