registry / @avesbox/magpie / 0.3.5

@avesbox/magpie@0.3.5

Acceptance criteria scenarios on top of Vitest.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 120 KB of source

Source & flagged code

2 flagged

dist/bin.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L1

4import { createRequire } from "node:module";

Source & flagged code

2 flagged · loading source

dist/bin.jsView file

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L1

49catch { L50: process.stderr.write("magpie: could not resolve vitest — install it first: npm install --save-dev vitest\n"); L51: process.exitCode = 1; ... L53: } L54: const child = spawn(process.execPath, [vitestEntry, ...forwardedArgv], { L55: env,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin.jsView on unpkg · L49

Findings

3 High2 Medium3 Low

HighChild Processdist/bin.js

HighShell

HighRuntime Package Installdist/bin.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Lines 29-69javascript

29 const packageJsonPath = require.resolve("vitest/package.json", { paths: [process.cwd()] });

30 const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));

31 const bin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.["vitest"];

32 if (!bin) {

33 throw new Error("vitest package has no bin entry");

34 }

35 return join(dirname(packageJsonPath), bin);

36}

37function main() {

38 const argv = process.argv.slice(2);

39 if (argv.includes("--help") || argv.includes("-h")) {

40 process.stdout.write(HELP_TEXT);

41 return;

42 }

43 const { magpieArgv, forwardedArgv } = partitionMagpieArgv(argv.map((argument) => (argument === "--help-vitest" ? "--help" : argument)));

44 const env = { ...process.env, ...toMagpieEnv(magpieArgv) };

45 let vitestEntry;

46 try {

47 vitestEntry = resolveVitestEntry();

48 }

49 catch {

50 process.stderr.write("magpie: could not resolve vitest — install it first: npm install --save-dev vitest\n");

51 process.exitCode = 1;

52 return;

53 }

54 const child = spawn(process.execPath, [vitestEntry, ...forwardedArgv], {

55 env,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin.jsView on unpkg · L49

56 stdio: "inherit",

57 });

58 child.on("exit", (code, signal) => {

59 if (signal) {

60 process.kill(process.pid, signal);

61 return;

62 }

63 process.exitCode = code ?? 1;

64 });

65 child.on("error", (error) => {

66 process.stderr.write(`magpie: failed to start vitest: ${error.message}\n`);

67 process.exitCode = 1;

68 });

69}