@cevek/screentest@0.3.6: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@cevek/screentest@0.3.6: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/global-setup.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @cevek/screentest@0.4.0 matchedIdentity = npm:QGNldmVrL3NjcmVlbnRlc3Q:0.4.0 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/global-setup.jsView on unpkg

1// src/runner/global-setup.ts L2: import { spawn } from "child_process"; L3: import { promises as fs2 } from "fs";

High

Child Process

Package source references child process execution.

dist/global-setup.jsView on unpkg · L1

1Cross-file remote execution chain: dist/global-setup.js spawns dist/index.js; helper contains network access plus dynamic code execution. L1: // src/runner/global-setup.ts L2: import { spawn } from "child_process"; L3: import { promises as fs2 } from "fs"; L4: import { createConnection } from "net"; L5: import { dirname, join as join3 } from "path"; ... L19: if (r.status !== 0) return null; L20: const branch = r.stdout.trim(); L21: return branch || null; ... L27: try { L28: return JSON.parse(await fs.readFile(snapshotFile, "utf8")); L29: } catch { ... L132: const deletedSummary = detectDeletions ? `deleted: ${summary.deleted}, ` : "";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/global-setup.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/global-setup.jsView on unpkg

dist/index.jsView file

15380} L15381: process.stdout.write( L15382: ` ... L15384: 1. screentest serve # one-time: starts the shared Firefox daemon L15385: 2. APP_URL=http://localhost:<port> \\ L15386: npx vitest run --config vitest.screentest.config.ts ... L15395: // src/daemon.ts L15396: import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process"; L15397: import { existsSync as existsSync4 } from "fs";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L15380

15380Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js L15380: } L15381: process.stdout.write( L15382: ` ... L15384: 1. screentest serve # one-time: starts the shared Firefox daemon L15385: 2. APP_URL=http://localhost:<port> \\ L15386: npx vitest run --config vitest.screentest.config.ts ... L15395: // src/daemon.ts L15396: import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process"; L15397: import { existsSync as existsSync4 } from "fs";

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L15380

Source & flagged code

6 flagged

dist/global-setup.jsView file

Lines 1-21javascript

1// src/runner/global-setup.ts

2import { spawn } from "child_process";

3import { promises as fs2 } from "fs";

High

Child Process

Package source references child process execution.

dist/global-setup.jsView on unpkg · L1

4import { createConnection } from "net";

5import { dirname, join as join3 } from "path";

6import { fileURLToPath } from "url";

7import { firefox } from "playwright";

8

9// src/doc-builder.ts

10import { spawnSync } from "child_process";

11import { createHash } from "crypto";

12import { promises as fs } from "fs";

13import { join, relative, sep } from "path";

14function detectBranch(projectRoot) {

15 const r = spawnSync("git", ["-C", projectRoot, "rev-parse", "--abbrev-ref", "HEAD"], {

16 stdio: "pipe",

17 encoding: "utf8"

18 });

19 if (r.status !== 0) return null;

20 const branch = r.stdout.trim();

21 return branch || null;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/global-setup.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = @cevek/screentest@0.4.0 matchedIdentity = npm:QGNldmVrL3NjcmVlbnRlc3Q:0.4.0 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/global-setup.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/global-setup.jsView on unpkg

dist/index.jsView file

15380} L15381: process.stdout.write( L15382: ` ... L15384: 1. screentest serve # one-time: starts the shared Firefox daemon L15385: 2. APP_URL=http://localhost:<port> \\ L15386: npx vitest run --config vitest.screentest.config.ts ... L15395: // src/daemon.ts L15396: import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process"; L15397: import { existsSync as existsSync4 } from "fs";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L15380

15380Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js L15380: } L15381: process.stdout.write( L15382: ` ... L15384: 1. screentest serve # one-time: starts the shared Firefox daemon L15385: 2. APP_URL=http://localhost:<port> \\ L15386: npx vitest run --config vitest.screentest.config.ts ... L15395: // src/daemon.ts L15396: import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process"; L15397: import { existsSync as existsSync4 } from "fs";

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L15380