@gatetest/cli@1.56.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@gatetest/cli@1.56.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

bin/gatetest.jsView file

514async function runAutoPr(summary, projectRoot, args) { L515: const { execSync } = require('child_process'); L516: const { runFixOrchestration } = require('../src/core/cli-fix-orchestrator');

High

Child Process

Package source references child process execution.

bin/gatetest.jsView on unpkg · L514

•matchType = previous_version_dangerous_delta matchedPackage = @gatetest/cli@1.58.1 matchedIdentity = npm:QGdhdGV0ZXN0L2NsaQ:1.58.1 similarity = 0.842 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/gatetest.jsView on unpkg

src/core/universal-checker.jsView file

43{ name: 'eval', pattern: /\beval\s*\(/, severity: 'error', L44: message: 'eval() — arbitrary code execution risk', L45: suggestion: 'Use ast.literal_eval for literals, or refactor to avoid eval entirely.' },

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/core/universal-checker.jsView on unpkg · L43

bin/gatetest-promote.jsView file

35L36: const fs = require('fs'); L37: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/gatetest-promote.jsView on unpkg · L35

src/core/direct-repair.jsView file

28const crypto = require('crypto'); L29: const { spawnSync } = require('child_process'); L30: ... L55: try { L56: const raw = JSON.parse(fs.readFileSync(file, 'utf8')); L57: for (const [k, v] of Object.entries(raw)) this.store.set(k, v); ... L81: encoding: 'utf8', L82: env: { ...process.env, GIT_TERMINAL_PROMPT: '0', ...env }, L83: timeout: 120_000, ... L85: if (result.status !== 0) { L86: throw new Error(`git ${args[0]} failed: ${(result.stderr || '').trim()}`); L87: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/core/direct-repair.jsView on unpkg · L28

src/app-server.jsView file

22L23: const http = require('http'); L24: const crypto = require('crypto'); ... L27: const path = require('path'); L28: const { execSync, execFile } = require('child_process'); L29: L30: const PORT = process.env.PORT || 3333; L31: const APP_ID = process.env.GATETEST_APP_ID;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/app-server.jsView on unpkg · L22

src/core/doctor.jsView file

20Source sends the broad process environment to a literal external destination. L20: const path = require('path'); L21: const { execSync } = require('child_process'); L22: ... L53: } catch (err) { L54: return { ok: false, error: err.message || String(err), output: err.stdout || '' }; L55: } ... L73: try { L74: const res = await fetch('https://api.anthropic.com/v1/messages', { L75: method: 'POST', ... L80: }, L81: body: JSON.stringify({ L82: model: 'claude-sonnet-4-6',

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/core/doctor.jsView on unpkg · L20

src/core/live-probe-runner.jsView file

29L30: const https = require('https'); L31: const http = require('http'); ... L146: L147: // Block requests to private / loopback / metadata endpoints — never L148: // probe internal infra even by accident. ... L220: headers: res.headers, L221: body: Buffer.concat(chunks).toString('utf-8'), L222: truncated: totalLen > maxBodyBytes,

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/core/live-probe-runner.jsView on unpkg · L29

Source & flagged code

8 flagged

bin/gatetest.jsView file

Lines 494-534javascript

494 }

495

496 process.exit(summary.gateStatus === 'PASSED' ? 0 : 1);

497}

498

499/**

500 * Auto-PR runner — applies AI-driven fixes to every finding that has a file

501 * path, then opens a pull request via the `gh` CLI.

502 *

503 * Uses the full production fix pipeline (iterative retry loop, syntax gate,

504 * regression test generation, rich PR body) — same pipeline as /api/scan/fix.

505 *

506 * Returns { prUrl, fixesApplied, error }. Never throws — the gate's exit

507 * code is the authoritative signal; the auto-PR is a value-add on top.

508 *

509 * Pre-conditions checked at runtime:

510 * - We're inside a git repository

511 * - `gh` CLI is on PATH and authenticated (or GH_TOKEN is set)

512 * - ANTHROPIC_API_KEY is set

513 */

514async function runAutoPr(summary, projectRoot, args) {

515 const { execSync } = require('child_process');

516 const { runFixOrchestration } = require('../src/core/cli-fix-orchestrator');

High

Child Process

Package source references child process execution.

bin/gatetest.jsView on unpkg · L514

517

518 function sh(cmd, opts) {

519 return execSync(cmd, { cwd: projectRoot, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], ...opts });

520 }

521

522 // Pre-flight checks

523 try { sh('git rev-parse --git-dir'); }

524 catch { return { error: 'Not a git repository — auto-PR skipped' }; }

525

526 try { sh('gh --version'); }

527 catch { return { error: 'gh CLI not found on PATH. Install: https://cli.github.com/' }; }

528

529 const apiKey = process.env.ANTHROPIC_API_KEY;

530 if (!apiKey) {

531 return { error: 'ANTHROPIC_API_KEY not set — AI fix engine cannot run' };

532 }

533

534 // Capture original branch so we can return to it if needed

•matchType = previous_version_dangerous_delta matchedPackage = @gatetest/cli@1.58.1 matchedIdentity = npm:QGdhdGV0ZXN0L2NsaQ:1.58.1 similarity = 0.842 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/gatetest.jsView on unpkg

src/core/universal-checker.jsView file

Lines 23-63javascript

23/**

24 * Skip these files & directories entirely.

25 */

26const DEFAULT_EXCLUDES = [

27 'node_modules', '.git', 'dist', 'build', 'coverage', '.gatetest',

bin/gatetest-promote.jsView file

Lines 15-55javascript

15 * USAGE

16 * gatetest-promote --recipe-store <path-or-url> [options]

17 *

18 *

src/core/direct-repair.jsView file

Lines 8-48javascript

8 * 2. scan(workspace) — run GateTest engine on the local clone

9 * 3. repair(workspace, findings) — apply patches directly to files on disk

10 * - check pattern cache first (no Claude call needed for known fixes)

11 *

src/app-server.jsView file

Lines 2-42javascript

2 * GateTest GitHub App Server

3 *

4 * A lightweight GitHub App that:

5 * 1. Receives webhooks (push, pull_request)

6 * 2.

src/core/doctor.jsView file

Lines 1-40javascript

1'use strict';

2

3/**

4 * GateTest Doctor — runs every prerequisite check and reports back in

5 * plain English what's working, what's broken, and exactly how to fix it.

6 *

7 * Designed for non-experts. The output uses tick / cross / warning symbols,

8 * NEVER assumes the reader knows what "ANTHROPIC_API_KEY" means, and

9 * gives the exact command to fix each missing piece.

10 *

11 * Run: `gatetest --doctor`

src/core/live-probe-runner.jsView file

Lines 9-49javascript

9 * - Concurrency cap (default 8 in flight)

10 * - Total-probe-count cap per scan (default 500 — DoS safety)

11 *