@cevek/screentest@0.3.7: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@cevek/screentest@0.3.7: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/global-setup.jsView file

1// src/runner/global-setup.ts L2: import { spawn } from "child_process"; L3: import { promises as fs2 } from "fs";

High

Child Process

Package source references child process execution.

dist/global-setup.jsView on unpkg · L1

1Cross-file remote execution chain: dist/global-setup.js spawns dist/index.js; helper contains network access plus dynamic code execution. L1: // src/runner/global-setup.ts L2: import { spawn } from "child_process"; L3: import { promises as fs2 } from "fs"; L4: import { createConnection } from "net"; L5: import { dirname, join as join3 } from "path"; ... L19: if (r.status !== 0) return null; L20: const branch = r.stdout.trim(); L21: return branch || null; ... L27: try { L28: return JSON.parse(await fs.readFile(snapshotFile, "utf8")); L29: } catch { ... L139: const deletedSummary = detectDeletions ? `deleted: ${summary.deleted}, ` : "";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/global-setup.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/global-setup.jsView on unpkg

dist/index.jsView file

15386} L15387: process.stdout.write( L15388: ` ... L15390: 1. screentest serve # one-time: starts the shared Firefox daemon L15391: 2. APP_URL=http://localhost:<port> \\ L15392: npx vitest run --config vitest.screentest.config.ts ... L15401: // src/daemon.ts L15402: import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process"; L15403: import { existsSync as existsSync4 } from "fs";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L15386

15386Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js L15386: } L15387: process.stdout.write( L15388: ` ... L15390: 1. screentest serve # one-time: starts the shared Firefox daemon L15391: 2. APP_URL=http://localhost:<port> \\ L15392: npx vitest run --config vitest.screentest.config.ts ... L15401: // src/daemon.ts L15402: import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process"; L15403: import { existsSync as existsSync4 } from "fs";

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L15386

Source & flagged code

5 flagged

dist/global-setup.jsView file

Lines 1-21javascript

1// src/runner/global-setup.ts

2import { spawn } from "child_process";

3import { promises as fs2 } from "fs";

High

Child Process

Package source references child process execution.

dist/global-setup.jsView on unpkg · L1

4import { createConnection } from "net";

5import { dirname, join as join3 } from "path";

6import { fileURLToPath } from "url";

7import { firefox } from "playwright";

8

9// src/doc-builder.ts

10import { spawnSync } from "child_process";

11import { createHash } from "crypto";

12import { promises as fs } from "fs";

13import { join, relative, sep } from "path";

14function detectBranch(projectRoot) {

15 const r = spawnSync("git", ["-C", projectRoot, "rev-parse", "--abbrev-ref", "HEAD"], {

16 stdio: "pipe",

17 encoding: "utf8"

18 });

19 if (r.status !== 0) return null;

20 const branch = r.stdout.trim();

21 return branch || null;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/global-setup.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/global-setup.jsView on unpkg

dist/index.jsView file

15386} L15387: process.stdout.write( L15388: ` ... L15390: 1. screentest serve # one-time: starts the shared Firefox daemon L15391: 2. APP_URL=http://localhost:<port> \\ L15392: npx vitest run --config vitest.screentest.config.ts ... L15401: // src/daemon.ts L15402: import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process"; L15403: import { existsSync as existsSync4 } from "fs";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L15386

15386Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js L15386: } L15387: process.stdout.write( L15388: ` ... L15390: 1. screentest serve # one-time: starts the shared Firefox daemon L15391: 2. APP_URL=http://localhost:<port> \\ L15392: npx vitest run --config vitest.screentest.config.ts ... L15401: // src/daemon.ts L15402: import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process"; L15403: import { existsSync as existsSync4 } from "fs";

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L15386