registry / @delorenj/pjangler / 1.2.9

@delorenj/pjangler@1.2.9

Project subsystem bootstrapper CLI

Static Scan Results

scanned 4mo ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 306 KB of source, external domains: dash.cloudflare.com, plane.delo.sh, raw.githubusercontent.com, trello.com

Source & flagged code

5 flagged

.mise/scripts/versioning.shView file

•path = .mise/scripts/versioning.sh kind = payload_in_excluded_dir sizeBytes = 8295 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.mise/scripts/versioning.shView on unpkg

•path = .mise/scripts/versioning.sh kind = build_helper sizeBytes = 8295 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.mise/scripts/versioning.shView on unpkg

templates/commonproject/_bmad/bmm/workflows/testarch/automate/instructions.mdView file

Lines 422-481markdown

422 ```

423

424 **Critical patterns:**

425 - Tag tests with priority: `[P0]`, `[P1]`, `[P2]`, `[P3]` in test name

426 - One assertion per test (atomic tests)

427 - Explicit waits (no hard waits/sleeps)

428 - Network-first approach (route interception before navigation)

429 - data-testid selectors for stability

430 - Clear Given-When-Then structure

431

4323. **Write API Tests (If Applicable)**

433

434 ```typescript

435 import { test, expect } from '@playwright/test';

436

437 test.describe('User Authentication API', () => {

438 test('[P1] POST /api/auth/login - should return token for valid credentials', async ({ request }) => {

439 // GIVEN: Valid user credentials

440 const credentials = {

441 email: 'user@example.com',

442 password: 'Password123!',

Medium

Secret Pattern

Hardcoded password in templates/commonproject/_bmad/bmm/workflows/testarch/automate/instructions.md

templates/commonproject/_bmad/bmm/workflows/testarch/automate/instructions.mdView on unpkg · L442

443 };

444

445 // WHEN: Logging in via API

446 const response = await request.post('/api/auth/login', {

447 data: credentials,

448 });

449

450 // THEN: Returns 200 and JWT token

451 expect(response.status()).toBe(200);

452 const body = await response.json();

453 expect(body).toHaveProperty('token');

454 expect(body.token).toMatch(/^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+$/); // JWT format

455 });

456

457 test('[P1] POST /api/auth/login - should return 401 for invalid credentials', async ({ request }) => {

458 // GIVEN: Invalid credentials

459 const credentials = {

460 email: 'invalid@example.com',

461 password: 'wrongpassword',

Medium

Secret Pattern

Hardcoded password in templates/commonproject/_bmad/bmm/workflows/testarch/automate/instructions.md

templates/commonproject/_bmad/bmm/workflows/testarch/automate/instructions.mdView on unpkg · L461

462 };

463

464 // WHEN: Attempting login

465 const response = await request.post('/api/auth/login', {

466 data: credentials,

467 });

468

469 // THEN: Returns 401 with error

470 expect(response.status()).toBe(401);

471 const body = await response.json();

472 expect(body).toMatchObject({

473 error: 'Invalid credentials',

474 });

475 });

476 });

477 ```

478

4794. **Write Component Tests (If Applicable)**

480

481 **Knowledge Base Reference**: `component-tdd.md`

templates/commonproject/_bmad/bmm/testarch/knowledge/data-factories.mdView file

Lines 297-337markdown

297}

298

299test('admin can delete user', async ({ page }) => {

300 const users = require('../fixtures/users.json');

301 // Brittle: IDs collide in parallel, schema drift breaks tests

302});

303```

304

305**Why It Fails**:

306

307- **Parallel collisions**: Hardcoded IDs (`id: 1`, `email: 'test@test.com'`) cause failures when tests run concurrently

Source & flagged code

5 flagged · loading source

.mise/scripts/versioning.shView file

•path = .mise/scripts/versioning.sh kind = payload_in_excluded_dir sizeBytes = 8295 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.mise/scripts/versioning.shView on unpkg

•path = .mise/scripts/versioning.sh kind = build_helper sizeBytes = 8295 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.mise/scripts/versioning.shView on unpkg

templates/commonproject/_bmad/bmm/workflows/testarch/automate/instructions.mdView file

442patternName = generic_password severity = medium line = 442 matchedText = password...3!',

Findings

1 High6 Medium5 Low

HighPayload In Excluded Dir.mise/scripts/versioning.sh

MediumEnvironment Vars

MediumShips Build Helper.mise/scripts/versioning.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterntemplates/commonproject/_bmad/bmm/workflows/testarch/automate/instructions.md

MediumSecret Patterntemplates/commonproject/_bmad/bmm/testarch/knowledge/data-factories.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @delorenj/pjangler@1.2.9.

See all versions of @delorenj/pjangler for other recorded verdicts.

Review the evidence and your use of @delorenj/pjangler@1.2.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-09 20:19:44.790Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.