registry / @7n/test / 0.11.0

@7n/test@0.11.0

CLI-утиліта @7n/test

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 171 KB of source

Source & flagged code

2 flagged

src/lib/runtime-probe.mjsView file

Lines 73-127javascript

73/**

74 * Пробує експорти модуля у дочірньому процесі й повертає фактичні виходи.

75 * @param {string} absFilePath абсолютний шлях до джерела модуля

76 * @param {string[]} exportedNames назви експортів для probing

77 * @param {string[]} [envKeys] ключі env, які треба підставити test-значеннями; за замовчуванням порожній список

78 * @returns {Record<string, Array<{input: string, output: string}> | {constant: string}>} фактичні probe-результати для кожного export

79 */

80export function probeModule(absFilePath, exportedNames, envKeys = []) {

81 const envStubs = envKeys.map(k => `process.env[${JSON.stringify(k)}] = '__probe__'`).join('\n')

83 const script = `

84import { createRequire } from 'node:module'

85${envStubs}

86globalThis.fetch = async () => ({ status: 200, json: async () => ({}) })

88const probeInputs = ${JSON.stringify(PROBE_INPUTS)}

89const names = ${JSON.stringify(exportedNames)}

90const filePath = ${JSON.stringify(absFilePath)}

92let mod

93try {

94 mod = await import(filePath)

95} catch (e) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/lib/runtime-probe.mjsView on unpkg · L93

96 process.stdout.write(JSON.stringify({ __importError: e.message }))

97 process.exit(0)

98}

100const results = {}

101for (const name of names) {

102 const val = mod[name]

103 if (typeof val === 'function') {

104 results[name] = []

105 for (const [inputLiteral, repr] of probeInputs) {

106 let input

107 // safe eval of primitive literals

108 try { input = new Function('return ' + inputLiteral)() } catch { continue }

109 try {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/lib/runtime-probe.mjsView on unpkg · L107

110 const out = await Promise.resolve(val(input))

111 if (out !== undefined) {

112 results[name].push({ input: repr, output: JSON.stringify(out) })

113 }

114 } catch {

115 // skip — function threw on this input

116 }

117 }

118 } else if (val !== undefined) {

119 try { results[name] = { constant: JSON.stringify(val) } } catch { /* skip non-serializable */ }

120 }

121}

122process.stdout.write(JSON.stringify(results))

123`

124

125 const proc = spawnSync('node', ['--input-type=module'], {

126 input: script,

127 encoding: 'utf8',

Source & flagged code

2 flagged · loading source

src/lib/runtime-probe.mjsView file

93try { L94: mod = await import(filePath) L95: } catch (e) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/lib/runtime-probe.mjsView on unpkg · L93

107// safe eval of primitive literals L108: try { input = new Function('return ' + inputLiteral)() } catch { continue } L109: try {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/lib/runtime-probe.mjsView on unpkg · L107

Findings

3 Medium4 Low

MediumDynamic Requiresrc/lib/runtime-probe.mjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvalsrc/lib/runtime-probe.mjs

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

src/lib/runtime-probe.mjsView file

Lines 73-127javascript

73/**

74 * Пробує експорти модуля у дочірньому процесі й повертає фактичні виходи.

75 * @param {string} absFilePath абсолютний шлях до джерела модуля

76 * @param {string[]} exportedNames назви експортів для probing

77 * @param {string[]} [envKeys] ключі env, які треба підставити test-значеннями; за замовчуванням порожній список

78 * @returns {Record<string, Array<{input: string, output: string}> | {constant: string}>} фактичні probe-результати для кожного export

79 */

80export function probeModule(absFilePath, exportedNames, envKeys = []) {

81 const envStubs = envKeys.map(k => `process.env[${JSON.stringify(k)}] = '__probe__'`).join('\n')

83 const script = `

84import { createRequire } from 'node:module'

85${envStubs}

86globalThis.fetch = async () => ({ status: 200, json: async () => ({}) })

88const probeInputs = ${JSON.stringify(PROBE_INPUTS)}

89const names = ${JSON.stringify(exportedNames)}

90const filePath = ${JSON.stringify(absFilePath)}

92let mod

93try {

94 mod = await import(filePath)

95} catch (e) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/lib/runtime-probe.mjsView on unpkg · L93

96 process.stdout.write(JSON.stringify({ __importError: e.message }))

97 process.exit(0)

98}

100const results = {}

101for (const name of names) {

102 const val = mod[name]

103 if (typeof val === 'function') {

104 results[name] = []

105 for (const [inputLiteral, repr] of probeInputs) {

106 let input

107 // safe eval of primitive literals

108 try { input = new Function('return ' + inputLiteral)() } catch { continue }

109 try {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/lib/runtime-probe.mjsView on unpkg · L107

110 const out = await Promise.resolve(val(input))

111 if (out !== undefined) {

112 results[name].push({ input: repr, output: JSON.stringify(out) })

113 }

114 } catch {

115 // skip — function threw on this input

116 }

117 }

118 } else if (val !== undefined) {

119 try { results[name] = { constant: JSON.stringify(val) } } catch { /* skip non-serializable */ }

120 }

121}

122process.stdout.write(JSON.stringify(results))

123`

124

125 const proc = spawnSync('node', ['--input-type=module'], {

126 input: script,

127 encoding: 'utf8',