registry / @7n/test / 0.11.1

@7n/test@0.11.1

CLI-утиліта @7n/test

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 173 KB of source

Source & flagged code

3 flagged

src/lib/runtime-probe.mjsView file

Lines 73-127javascript

73/**

74 * Пробує експорти модуля у дочірньому процесі й повертає фактичні виходи.

75 * @param {string} absFilePath абсолютний шлях до джерела модуля

76 * @param {string[]} exportedNames назви експортів для probing

77 * @param {string[]} [envKeys] ключі env, які треба підставити test-значеннями; за замовчуванням порожній список

78 * @returns {Record<string, Array<{input: string, output: string}> | {constant: string}>} фактичні probe-результати для кожного export

79 */

80export function probeModule(absFilePath, exportedNames, envKeys = []) {

81 const envStubs = envKeys.map(k => `process.env[${JSON.stringify(k)}] = '__probe__'`).join('\n')

83 const script = `

84import { createRequire } from 'node:module'

85${envStubs}

86globalThis.fetch = async () => ({ status: 200, json: async () => ({}) })

88const probeInputs = ${JSON.stringify(PROBE_INPUTS)}

89const names = ${JSON.stringify(exportedNames)}

90const filePath = ${JSON.stringify(absFilePath)}

92let mod

93try {

94 mod = await import(filePath)

95} catch (e) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/lib/runtime-probe.mjsView on unpkg · L93

96 process.stdout.write(JSON.stringify({ __importError: e.message }))

97 process.exit(0)

98}

100const results = {}

101for (const name of names) {

102 const val = mod[name]

103 if (typeof val === 'function') {

104 results[name] = []

105 for (const [inputLiteral, repr] of probeInputs) {

106 let input

107 // safe eval of primitive literals

108 try { input = new Function('return ' + inputLiteral)() } catch { continue }

109 try {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/lib/runtime-probe.mjsView on unpkg · L107

110 const out = await Promise.resolve(val(input))

111 if (out !== undefined) {

112 results[name].push({ input: repr, output: JSON.stringify(out) })

113 }

114 } catch {

115 // skip — function threw on this input

116 }

117 }

118 } else if (val !== undefined) {

119 try { results[name] = { constant: JSON.stringify(val) } } catch { /* skip non-serializable */ }

120 }

121}

122process.stdout.write(JSON.stringify(results))

123`

124

125 const proc = spawnSync('node', ['--input-type=module'], {

126 input: script,

127 encoding: 'utf8',

src/gen-tests.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @7n/test@0.11.0 matchedIdentity = npm:QDduL3Rlc3Q:0.11.0 similarity = 0.880 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/gen-tests.mjsView on unpkg

Source & flagged code

3 flagged · loading source

src/lib/runtime-probe.mjsView file

93try { L94: mod = await import(filePath) L95: } catch (e) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/lib/runtime-probe.mjsView on unpkg · L93

107// safe eval of primitive literals L108: try { input = new Function('return ' + inputLiteral)() } catch { continue } L109: try {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/lib/runtime-probe.mjsView on unpkg · L107

src/gen-tests.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/gen-tests.mjsView on unpkg

Findings

1 High3 Medium4 Low

HighPrevious Version Dangerous Deltasrc/gen-tests.mjs

MediumDynamic Requiresrc/lib/runtime-probe.mjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvalsrc/lib/runtime-probe.mjs

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

src/lib/runtime-probe.mjsView file

Lines 73-127javascript

73/**

74 * Пробує експорти модуля у дочірньому процесі й повертає фактичні виходи.

75 * @param {string} absFilePath абсолютний шлях до джерела модуля

76 * @param {string[]} exportedNames назви експортів для probing

77 * @param {string[]} [envKeys] ключі env, які треба підставити test-значеннями; за замовчуванням порожній список

78 * @returns {Record<string, Array<{input: string, output: string}> | {constant: string}>} фактичні probe-результати для кожного export

79 */

80export function probeModule(absFilePath, exportedNames, envKeys = []) {

81 const envStubs = envKeys.map(k => `process.env[${JSON.stringify(k)}] = '__probe__'`).join('\n')

83 const script = `

84import { createRequire } from 'node:module'

85${envStubs}

86globalThis.fetch = async () => ({ status: 200, json: async () => ({}) })

88const probeInputs = ${JSON.stringify(PROBE_INPUTS)}

89const names = ${JSON.stringify(exportedNames)}

90const filePath = ${JSON.stringify(absFilePath)}

92let mod

93try {

94 mod = await import(filePath)

95} catch (e) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/lib/runtime-probe.mjsView on unpkg · L93

96 process.stdout.write(JSON.stringify({ __importError: e.message }))

97 process.exit(0)

98}

100const results = {}

101for (const name of names) {

102 const val = mod[name]

103 if (typeof val === 'function') {

104 results[name] = []

105 for (const [inputLiteral, repr] of probeInputs) {

106 let input

107 // safe eval of primitive literals

108 try { input = new Function('return ' + inputLiteral)() } catch { continue }

109 try {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/lib/runtime-probe.mjsView on unpkg · L107

110 const out = await Promise.resolve(val(input))

111 if (out !== undefined) {

112 results[name].push({ input: repr, output: JSON.stringify(out) })

113 }

114 } catch {

115 // skip — function threw on this input

116 }

117 }

118 } else if (val !== undefined) {

119 try { results[name] = { constant: JSON.stringify(val) } } catch { /* skip non-serializable */ }

120 }

121}

122process.stdout.write(JSON.stringify(results))

123`

124

125 const proc = spawnSync('node', ['--input-type=module'], {

126 input: script,

127 encoding: 'utf8',

src/gen-tests.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/gen-tests.mjsView on unpkg