registry / @gatetest/cli / 1.58.1

@gatetest/cli@1.58.1

GateTest — 120-module QA gate with MCP. Eyes (screenshot live pages), ears (production errors), hands (verify fixes worked). Security, supply chain, AI safety, mutation testing. Iterative Claude fix loop. Replaces SonarQube + Snyk + ESLint + 10 others.

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 18 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 229 file(s), 2.49 MB of source, external domains: api.anthropic.com, api.github.com, api.osv.dev, api.rollbar.com, api.wordpress.org, attacker.example.com, cli.github.com, console.anthropic.com, cwe.mitre.org, example.com, example.gatetest-probe.invalid, gatetest.ai, github.com, gluecron.com, mysite.com, nodejs.org, osv.dev, raw.githubusercontent.com, sentry.io, trusted.com, www.php.net, your-server.com, zoobicon.com

Source & flagged code

9 flagged

src/modules/secret-rotation.jsView file

Lines 14-54javascript

14 * error: a live credential-shaped secret in a tracked file whose

15 * last modification is older than 90 days

16 * (rule: `secret-rotation:stale:<kind>:<rel>:<line>`)

17 * warning: a credential older than 30 days

18 * (rule: `secret-rotation:aging:<kind>:<rel>:<line>`)

19 * warning: .env.example drift — variables in .env that aren't in

20 * .env.example (or vice versa). Rotating a key requires

21 * a matching example; drift means contributors don't know

22 * what to set.

23 * (rule: `secret-rotation:env-drift:<var>`)

24 * warning: placeholder-looking values in .env.example that match a

25 * real secret shape — copy-paste risk.

26 * (rule: `secret-rotation:example-shaped-like-real:<var>`)

27 * info: no .env.example present but .env is referenced in code

28 * (rule: `secret-rotation:no-example`)

29 *

30 * Secret detection re-uses the credential shapes from `src/core/config.js`

31 * secretPatterns plus a few that matter for rotation specifically:

32 * AWS access keys (AKIA/ASIA), GitHub tokens (ghp_/gho_/ghs_/github_pat_),

33 * Stripe live keys (sk_live_*), Slack tokens (xox[bapors]-*), generic

34 * `-----BEGIN PRIVATE KEY-----` blocks.

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/modules/secret-rotation.jsView on unpkg · L34

Critical

Secret Pattern

RSA private key in src/modules/secret-rotation.js

src/modules/secret-rotation.jsView on unpkg · L34

35 *

36 * If the project isn't a git repo, or git isn't on PATH, stale/aging

37 * checks degrade to the file's mtime — which is still more signal

38 * than zero.

39 *

40 * TODO(gluecron): when Gluecron ships a hosted scan API, wire the

41 * git-blame calls to hit that so we don't need a local clone for

42 * mature-project scans.

43 */

45const fs = require('fs');

46const path = require('path');

47const { execFileSync } = require('child_process');

48const BaseModule = require('./base-module');

50const DEFAULT_EXCLUDES = [

51 'node_modules', '.git', '.claude', 'dist', 'build', 'coverage', '.gatetest',

52 '.next', '__pycache__', 'target', 'vendor', '.terraform', 'out',

53];

bin/gatetest.jsView file

Lines 521-561javascript

521 }

522

523 process.exit(summary.gateStatus === 'PASSED' ? 0 : 1);

524}

525

526/**

527 * Auto-PR runner — applies AI-driven fixes to every finding that has a file

src/core/universal-checker.jsView file

Lines 23-63javascript

23/**

24 * Skip these files & directories entirely.

25 */

26const DEFAULT_EXCLUDES = [

27 'node_modules', '.git', 'dist', 'build', 'coverage', '.gatetest',

bin/gatetest-promote.jsView file

Lines 15-55javascript

15 * USAGE

16 * gatetest-promote --recipe-store <path-or-url> [options]

17 *

18 *

src/core/direct-repair.jsView file

Lines 8-48javascript

8 * 2. scan(workspace) — run GateTest engine on the local clone

9 * 3. repair(workspace, findings) — apply patches directly to files on disk

10 * - check pattern cache first (no Claude call needed for known fixes)

11 *

src/app-server.jsView file

Lines 2-42javascript

2 * GateTest GitHub App Server

3 *

4 * A lightweight GitHub App that:

5 * 1. Receives webhooks (push, pull_request)

6 * 2.

src/core/live-probe-runner.jsView file

Lines 9-49javascript

9 * - Concurrency cap (default 8 in flight)

10 * - Total-probe-count cap per scan (default 500 — DoS safety)

11 *

bin/gatetest-mcp.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @gatetest/cli@1.58.0 matchedIdentity = npm:QGdhdGV0ZXN0L2NsaQ:1.58.0 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/gatetest-mcp.mjsView on unpkg

@gatetest/cli@1.58.1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code