Summary

CyberChef's local dev workflow is tuned to Linux/macOS (DevContainers). On Windows, npm install works, but npm run build, npm test, npm start, and npm run testnodeconsumer all fail. The root cause is that several Gruntfile.js tasks and package.json scripts shell out to Unix-only utilities and use shell syntax that cmd.exe doesn't understand. A few webpack.config.js regexes also assume / path separators.

Environment

• OS: Windows 10/11 (PowerShell or cmd.exe)
• Node: v24.x
• npm: 11.x

Steps to reproduce

1. Clone the repo on a Windows machine.
2. Run npm install — succeeds.
3. Run any of npm run build, npm test, npm start, npm run testnodeconsumer, npm run getheapsize, npm run minor, or npm run tag.

Expected: the script runs to completion, same as on macOS/Linux.
Actual: the script fails (details below).

Issues

1. npm run build — 7 webpack errors from path-separator regexes

webpack.config.js has three regex test/exclude patterns that use literal / separators. Webpack 5 matches these against the module's absolute file path, which uses \ on Windows, so they silently fail to match.

This produces two classes of error:

• jimp babel-loader conflict — Module parse failed: Identifier 'e' has already been declared. Babel transforms jimp's pre-minified browser bundle because the node_modules/(?!crypto-api|bootstrap) exclude doesn't fire.
• Asset Modules Plugin — invalid generator — generator has an unknown property 'filename' on asset/inline. First-party images in src/web/static/ match both the asset/resource and asset/inline rules because the exclude: /web\/static/ doesn't fire.

2. npm test / npm run build — Grunt tasks shell out to Unix utilities

Several Gruntfile.js exec tasks use commands that don't exist on Windows or use shell syntax cmd.exe doesn't support.

A leftover chainCommands() helper exists in Gruntfile.js hinting at Windows awareness, but it has no call sites and the underlying commands have no Windows branch.

3. package.json scripts use Unix-only shell syntax

• setheapsize — export NODE_OPTIONS=…. export isn't a cmd.exe builtin. (Also a no-op on every platform, since the variable dies with the subshell.)
• getheapsize — node -e '…single-quoted JS…'. cmd.exe doesn't strip single quotes, so the JS string is passed through with literal quotes and fails to parse.
• minor and tag — both use $(npm pkg get version | xargs). $(…) subshells don't work in cmd.exe, and xargs doesn't exist there.

Scope

Local dev only. CI is pinned to ubuntu-latest and is unaffected.

Suggested fix direction

Inline the shell commands as Node.js. The regex fixes can replace \/ with [/\\] to match both separators — / still matches via the character class on macOS/Linux, so there's no behavior change there.