registry / @7n/test / 0.10.2

@7n/test@0.10.2

CLI-утиліта @7n/test

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package is an explicit CLI that runs coverage, probes target modules, calls an AI coding/test agent, and writes tests or coverage artifacts as part of its advertised workflow.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `7n-test` or package APIs against a project directory.

Impact

May execute target project tests/modules and modify project test/COVERAGE files by design; no hidden install-time or import-time compromise found.

Mechanism

User-invoked AI-assisted test generation and coverage/mutation automation

Rationale

Source inspection shows dangerous primitives are explicit, package-aligned capabilities for a test-generation CLI, not hidden lifecycle/import-time malware. No credential collection, covert endpoint, persistence, destructive behavior, or unconsented AI-agent control-surface mutation was found.

Evidence

package.jsonbin/7n-test.jssrc/index.jssrc/run.mjssrc/gen-tests.mjssrc/fix-tests.mjssrc/coverage-fix.mjssrc/coverage/coverage.mjssrc/lib/pi-client.mjssrc/lib/runtime-probe.mjssrc/lib/vitest-shim.mjsCOVERAGE.mdtests/*.test.mjs

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for block

src/lib/pi-client.mjs exposes pi SDK calls and callAgent with write/bash tools, but only through explicit CLI workflows.
src/lib/runtime-probe.mjs spawns node and imports target modules to probe exports during test generation.
src/gen-tests.mjs and src/fix-tests.mjs write generated/fixed test files under the user-supplied project directory.
src/coverage-fix.mjs can spawn `pi` in agent mode for survived mutants when mutation fix is requested.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks.
bin/7n-test.js only imports src/index.js and runs on explicit CLI invocation.
src/index.js defers loading src/run.mjs until run(args) is called; no import-time side effects found.
Network/LLM behavior is package-aligned for an AI test-generation CLI and uses configured pi SDK/model auth, not hidden exfil endpoints.
Project file writes are limited to test/COVERAGE/temp lock outputs for the declared coverage/test automation workflow.
No credential harvesting, persistence, destructive install behavior, or AI-agent control-surface writes found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 168 KB of source

Source & flagged code

3 flagged

src/lib/runtime-probe.mjsView file

Lines 73-127javascript

73/**

74 * Пробує експорти модуля у дочірньому процесі й повертає фактичні виходи.

75 * @param {string} absFilePath абсолютний шлях до джерела модуля

76 * @param {string[]} exportedNames назви експортів для probing

77 * @param {string[]} [envKeys] ключі env, які треба підставити test-значеннями; за замовчуванням порожній список

78 * @returns {Record<string, Array<{input: string, output: string}> | {constant: string}>} фактичні probe-результати для кожного export

79 */

80export function probeModule(absFilePath, exportedNames, envKeys = []) {

81 const envStubs = envKeys.map(k => `process.env[${JSON.stringify(k)}] = '__probe__'`).join('\n')

83 const script = `

84import { createRequire } from 'node:module'

85${envStubs}

86globalThis.fetch = async () => ({ status: 200, json: async () => ({}) })

88const probeInputs = ${JSON.stringify(PROBE_INPUTS)}

89const names = ${JSON.stringify(exportedNames)}

90const filePath = ${JSON.stringify(absFilePath)}

92let mod

93try {

94 mod = await import(filePath)

95} catch (e) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/lib/runtime-probe.mjsView on unpkg · L93

96 process.stdout.write(JSON.stringify({ __importError: e.message }))

97 process.exit(0)

98}

100const results = {}

101for (const name of names) {

102 const val = mod[name]

103 if (typeof val === 'function') {

104 results[name] = []

105 for (const [inputLiteral, repr] of probeInputs) {

106 let input

107 // safe eval of primitive literals

108 try { input = new Function('return ' + inputLiteral)() } catch { continue }

109 try {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/lib/runtime-probe.mjsView on unpkg · L107

110 const out = await Promise.resolve(val(input))

111 if (out !== undefined) {

112 results[name].push({ input: repr, output: JSON.stringify(out) })

113 }

114 } catch {

115 // skip — function threw on this input

116 }

117 }

118 } else if (val !== undefined) {

119 try { results[name] = { constant: JSON.stringify(val) } } catch { /* skip non-serializable */ }

120 }

121}

122process.stdout.write(JSON.stringify(results))

123`

124

125 const proc = spawnSync('node', ['--input-type=module'], {

126 input: script,

127 encoding: 'utf8',

src/gen-tests.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @7n/test@0.10.1 matchedIdentity = npm:QDduL3Rlc3Q:0.10.1 similarity = 0.960 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

src/gen-tests.mjsView on unpkg

Source & flagged code

3 flagged · loading source

src/lib/runtime-probe.mjsView file

93try { L94: mod = await import(filePath) L95: } catch (e) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/lib/runtime-probe.mjsView on unpkg · L93

107// safe eval of primitive literals L108: try { input = new Function('return ' + inputLiteral)() } catch { continue } L109: try {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/lib/runtime-probe.mjsView on unpkg · L107

src/gen-tests.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

src/gen-tests.mjsView on unpkg

Findings

1 Critical3 Medium4 Low

CriticalPrevious Version Dangerous Deltasrc/gen-tests.mjs

MediumDynamic Requiresrc/lib/runtime-probe.mjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvalsrc/lib/runtime-probe.mjs

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

src/lib/runtime-probe.mjsView file

Lines 73-127javascript

73/**

74 * Пробує експорти модуля у дочірньому процесі й повертає фактичні виходи.

75 * @param {string} absFilePath абсолютний шлях до джерела модуля

76 * @param {string[]} exportedNames назви експортів для probing

77 * @param {string[]} [envKeys] ключі env, які треба підставити test-значеннями; за замовчуванням порожній список

78 * @returns {Record<string, Array<{input: string, output: string}> | {constant: string}>} фактичні probe-результати для кожного export

79 */

80export function probeModule(absFilePath, exportedNames, envKeys = []) {

81 const envStubs = envKeys.map(k => `process.env[${JSON.stringify(k)}] = '__probe__'`).join('\n')

83 const script = `

84import { createRequire } from 'node:module'

85${envStubs}

86globalThis.fetch = async () => ({ status: 200, json: async () => ({}) })

88const probeInputs = ${JSON.stringify(PROBE_INPUTS)}

89const names = ${JSON.stringify(exportedNames)}

90const filePath = ${JSON.stringify(absFilePath)}

92let mod

93try {

94 mod = await import(filePath)

95} catch (e) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/lib/runtime-probe.mjsView on unpkg · L93

96 process.stdout.write(JSON.stringify({ __importError: e.message }))

97 process.exit(0)

98}

100const results = {}

101for (const name of names) {

102 const val = mod[name]

103 if (typeof val === 'function') {

104 results[name] = []

105 for (const [inputLiteral, repr] of probeInputs) {

106 let input

107 // safe eval of primitive literals

108 try { input = new Function('return ' + inputLiteral)() } catch { continue }

109 try {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/lib/runtime-probe.mjsView on unpkg · L107

110 const out = await Promise.resolve(val(input))

111 if (out !== undefined) {

112 results[name].push({ input: repr, output: JSON.stringify(out) })

113 }

114 } catch {

115 // skip — function threw on this input

116 }

117 }

118 } else if (val !== undefined) {

119 try { results[name] = { constant: JSON.stringify(val) } } catch { /* skip non-serializable */ }

120 }

121}

122process.stdout.write(JSON.stringify(results))

123`

124

125 const proc = spawnSync('node', ['--input-type=module'], {

126 input: script,

127 encoding: 'utf8',

src/gen-tests.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

src/gen-tests.mjsView on unpkg