registry / @avesbox/magpie / 0.3.0

@avesbox/magpie@0.3.0

Acceptance criteria scenarios on top of Vitest.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 115 KB of source

Source & flagged code

2 flagged

dist/bin.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L1

4import { createRequire } from "node:module";

5import { dirname, join } from "node:path";

6import { partitionMagpieArgv, toMagpieEnv } from "./cli.js";

7const HELP_TEXT = `magpie — run Vitest with Magpie filter flags, no "--" passthrough needed.

9Usage:

10 magpie [vitest args] [magpie flags]

12Magpie flags (converted to MAGPIE_* environment variables):

13 --tag <tag> filter by scenario tag (repeatable, csv allowed)

14 --acceptance <id> filter by acceptance id (glob * supported)

15 --story <title> filter by story title

16 --scenario <title> filter by scenario title

17 --regex, --grep <text> match id, title, description, tags, acceptance, story

18 --output <kind> enable report outputs (e.g. html, json)

20Everything else is forwarded to Vitest unchanged:

21 magpie run --tag auth

Lines 29-69javascript

29 const packageJsonPath = require.resolve("vitest/package.json", { paths: [process.cwd()] });

30 const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));

31 const bin = typeof packageJson.bin === "string" ?

Source & flagged code

2 flagged · loading source

dist/bin.jsView file

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L1

49catch { L50: process.stderr.write("magpie: could not resolve vitest — install it first: npm install --save-dev vitest\n"); L51: process.exitCode = 1; ... L53: } L54: const child = spawn(process.execPath, [vitestEntry, ...forwardedArgv], { L55: env,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin.jsView on unpkg · L49

Findings

3 High2 Medium4 Low

HighChild Processdist/bin.js

HighShell

HighRuntime Package Installdist/bin.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

dist/bin.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L1

4import { createRequire } from "node:module";

5import { dirname, join } from "node:path";

6import { partitionMagpieArgv, toMagpieEnv } from "./cli.js";

7const HELP_TEXT = `magpie — run Vitest with Magpie filter flags, no "--" passthrough needed.

9Usage:

10 magpie [vitest args] [magpie flags]

12Magpie flags (converted to MAGPIE_* environment variables):

13 --tag <tag> filter by scenario tag (repeatable, csv allowed)

14 --acceptance <id> filter by acceptance id (glob * supported)

15 --story <title> filter by story title

16 --scenario <title> filter by scenario title

17 --regex, --grep <text> match id, title, description, tags, acceptance, story

18 --output <kind> enable report outputs (e.g. html, json)

20Everything else is forwarded to Vitest unchanged:

21 magpie run --tag auth

Lines 29-69javascript

29 const packageJsonPath = require.resolve("vitest/package.json", { paths: [process.cwd()] });

30 const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));

31 const bin = typeof packageJson.bin === "string" ?