registry / @7n/test / 0.14.4

@7n/test@0.14.4

CLI-утиліта @7n/test

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 29 file(s), 218 KB of source

Source & flagged code

4 flagged

src/coverage-classify/prompt.mjsView file

Lines 1-25javascript

1/**

2 * Промпт-builder для coverage-classify.

3 * SYSTEM_PROMPT — статичний, кешується через cache_control: ephemeral у API call.

4 * buildUserPrompt — асемблює per-mutant контекст (location, source ±10, tests, git).

5 */

6import { execFileSync } from 'node:child_process'

7import { existsSync, readFileSync } from 'node:fs'

High

Child Process

Package source references child process execution.

src/coverage-classify/prompt.mjsView on unpkg · L5

8import { basename, dirname, join } from 'node:path'

10const CONTEXT_LINES = 10

11const TEST_FILE_MAX_LINES = 2000

13export const SYSTEM_PROMPT = `You are a mutation testing classifier.

15For each survived Stryker mutant, classify it into exactly one verdict:

17- **worth-testing**: pure logic with real branches that should be tested. The mutant

18 exposes a missing assertion in a unit test. Recommend a test approach.

19- **equivalent**: the mutated code is behaviorally indistinguishable from the original

20 (e.g., both branches produce the same observable output, or the mutant lies on dead

21 code). You MUST cite a concrete reason referencing input flow or output equivalence.

22- **defensive**: the branch guards against an impossible state given input contracts

23 or type system. You MUST identify the invariant that makes the state unreachable.

24- **glue**: thin CLI entrypoint, factory, or boilerplate (e.g., runStandardRule

25 wrapper, fix.mjs stubs). Integration tests via subprocess cover the behavior.

src/lib/runtime-probe.mjsView file

Lines 142-182javascript

142 if (Array.isArray(section)) {

143 capped[name] = section

144 .slice(0, PROBE_MAX_ENTRIES_PER_EXPORT)

145 .map(entry => ({ ...entry, output: capProbeOutput(entry.output) }))

146 } else if (section

src/coverage/js-collector.mjsView file

Lines 287-327javascript

287 // резолвить, тож coverage ганяємо нативним `bun test`. Bun ремапить

288 // `import ... from 'vitest'` у тест-файлах на `bun:test` — тести лишаються canon.

289 const r = spawnSync('bun', ['test', '--coverage', '--coverage-reporter=lcov', `--coverage-dir=${lcovDir}`], {

290 cwd,

291 stdio: 'inherit'

Source & flagged code

4 flagged · loading source

src/coverage-classify/prompt.mjsView file

5*/ L6: import { execFileSync } from 'node:child_process' L7: import { existsSync, readFileSync } from 'node:fs'

High

Child Process

Package source references child process execution.

src/coverage-classify/prompt.mjsView on unpkg · L5

src/lib/runtime-probe.mjsView file

162* @param {number} [timeout] ліміт очікування в мс; за замовчуванням `PROBE_TIMEOUT_MS` L163: * @returns {import('node:child_process').SpawnSyncReturns<string>} результат spawnSync L164: */

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/lib/runtime-probe.mjsView on unpkg · L162

214// safe eval of primitive literals L215: try { input = new Function('return ' + inputLiteral)() } catch { continue } L216: try {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/lib/runtime-probe.mjsView on unpkg · L214

src/coverage/js-collector.mjsView file

307? spawnSync(strykerBin, ['run', ...mutateArgs], { cwd, stdio: 'inherit', env: process.env }) L308: : spawnSync('npx', ['@stryker-mutator/core', 'run', ...mutateArgs], { cwd, stdio: 'inherit', env: process.env }) L309: return r.status ?? 1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/coverage/js-collector.mjsView on unpkg · L307

Findings

3 High4 Medium4 Low

HighChild Processsrc/coverage-classify/prompt.mjs

HighShell

HighRuntime Package Installsrc/coverage/js-collector.mjs

MediumDynamic Requiresrc/lib/runtime-probe.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalsrc/lib/runtime-probe.mjs

LowFilesystem

LowHigh Entropy Strings