@gatetest/cli@1.61.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@gatetest/cli@1.61.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

bin/gatetest.jsView file

729async function runAutoPr(summary, projectRoot, args) { L730: const { execSync } = require('child_process'); L731: const { runFixBatch } = require('../src/core/cli-fix-orchestrator');

High

Child Process

Package source references child process execution.

bin/gatetest.jsView on unpkg · L729

lib/sweep-steps.jsView file

100const commandLine = ['npx', ...args].join(' '); L101: return exec(commandLine, [], { ...opts, shell: true }); L102: }

High

Shell

Package source references shell execution.

lib/sweep-steps.jsView on unpkg · L100

bin/gatetest-promote.jsView file

35L36: const fs = require('fs'); L37: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/gatetest-promote.jsView on unpkg · L35

src/core/direct-repair.jsView file

28const crypto = require('crypto'); L29: const { spawnSync } = require('child_process'); L30: const { siteHost } = require('./site-url'); ... L56: try { L57: const raw = JSON.parse(fs.readFileSync(file, 'utf8')); L58: for (const [k, v] of Object.entries(raw)) this.store.set(k, v); ... L82: encoding: 'utf8', L83: env: { ...process.env, GIT_TERMINAL_PROMPT: '0', ...env }, L84: timeout: 120_000, ... L86: if (result.status !== 0) { L87: throw new Error(`git ${args[0]} failed: ${(result.stderr || '').trim()}`); L88: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/core/direct-repair.jsView on unpkg · L28

src/app-server.jsView file

22L23: const http = require('http'); L24: const crypto = require('crypto'); ... L31: // execSync, so reaching for it is a visible change rather than a one-liner. L32: const { execFileSync } = require('child_process'); L33: L34: const PORT = process.env.PORT || 3333; L35: const APP_ID = process.env.GATETEST_APP_ID;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/app-server.jsView on unpkg · L22

src/core/doctor.jsView file

20Source sends the broad process environment to a literal external destination. L20: const path = require('path'); L21: const { execSync } = require('child_process'); L22: const { apiUrl: anthropicApiUrl, apiVersion: anthropicVersion } = require('./anthropic-config'); ... L54: } catch (err) { L55: return { ok: false, error: err.message || String(err), output: err.stdout || '' }; L56: } ... L74: try { L75: const res = await fetch(anthropicApiUrl(), { L76: method: 'POST', ... L81: }, L82: body: JSON.stringify({ L83: model: 'claude-sonnet-5',

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/core/doctor.jsView on unpkg · L20

src/core/ssrf-guard.jsView file

19* validateDomainForProbing(), which already covers more ground than L20: * a plain private-range blocklist (0.x, metadata hostnames by name, L21: * reserved TLDs). ... L26: L27: const dns = require("dns").promises; L28: const { validateDomainForProbing } = require("./pentest/dns-verify");

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/core/ssrf-guard.jsView on unpkg · L19

bin/gatetest-blame.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 25

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/gatetest-blame.js#virtual:normalized:round1View on unpkg

Source & flagged code

8 flagged

bin/gatetest.jsView file

Lines 709-749javascript

709 ' to .gatetest.json.\x1b[0m\n'

710 );

711 } catch { /* best-effort notice */ } // error-ok

712}

713

714/**

715 * Auto-PR runner — applies AI-driven fixes to every finding that has a file

716 * path, then opens a pull request via the `gh` CLI.

717 *

718 * Uses the full production fix pipeline (iterative retry loop, syntax gate,

719 * regression test generation, rich PR body) — same pipeline as /api/scan/fix.

720 *

721 * Returns { prUrl, fixesApplied, error }. Never throws — the gate's exit

722 * code is the authoritative signal; the auto-PR is a value-add on top.

723 *

724 * Pre-conditions checked at runtime:

725 * - We're inside a git repository

726 * - `gh` CLI is on PATH and authenticated (or GH_TOKEN is set)

727 * - ANTHROPIC_API_KEY is set

728 */

729async function runAutoPr(summary, projectRoot, args) {

730 const { execSync } = require('child_process');

731 const { runFixBatch } = require('../src/core/cli-fix-orchestrator');

High

Child Process

Package source references child process execution.

bin/gatetest.jsView on unpkg · L729

732 const { resolveModelChoice, CHEAP_MODEL } = require('../src/core/engine-models');

733

734 function sh(cmd, opts) {

735 return execSync(cmd, { cwd: projectRoot, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], ...opts });

736 }

737

738 // Model choice: --model flag > GATETEST_FIX_MODEL env > CHEAP_MODEL.

739 // Validated BEFORE the key check so a bad name fails fast and keyless.

740 let fixModel = CHEAP_MODEL;

741 const rawModel = args.model || process.env.GATETEST_FIX_MODEL;

742 if (rawModel) {

743 const choice = resolveModelChoice(rawModel);

744 if (!choice.ok) return { error: choice.error };

745 fixModel = choice.model;

746 }

747

748 // Pre-flight checks

749 try { sh('git rev-parse --git-dir'); }

lib/sweep-steps.jsView file

Lines 80-120javascript

80 stderr,

81 exitCode,

82 spawnError,

83 };

84}

85

86/**

87 * Run an `npx <args...>` command cross-platform.

88 *

89 * Windows can't spawnSync a bare "npx" (it's a .cmd shim) without a shell —

90 * and as of Node's CVE-2024-27980 fix, spawning a .cmd/.bat file directly

91

bin/gatetest-promote.jsView file

Lines 15-55javascript

15 * USAGE

16 * gatetest-promote --recipe-store <path-or-url> [options]

17 *

18 *

src/core/direct-repair.jsView file

Lines 8-48javascript

8 * 2. scan(workspace) — run GateTest engine on the local clone

9 * 3. repair(workspace, findings) — apply patches directly to files on disk

10 * - check pattern cache first (no Claude call needed for known fixes)

11 *

src/app-server.jsView file

Lines 2-42javascript

2 * GateTest GitHub App Server

3 *

4 * A lightweight GitHub App that:

5 * 1. Receives webhooks (push, pull_request)

6 * 2.

src/core/doctor.jsView file

Lines 1-40javascript

1'use strict';

2

3/**

4 * GateTest Doctor — runs every prerequisite check and reports back in

5 * plain English what's working, what's broken, and exactly how to fix it.

6 *

7 * Designed for non-experts. The output uses tick / cross / warning symbols,

8 * NEVER assumes the reader knows what "ANTHROPIC_API_KEY" means, and

9 * gives the exact command to fix each missing piece.

10 *

11 * Run: `gatetest --doctor`

src/core/ssrf-guard.jsView file

Lines 1-39javascript

1"use strict";

2

3/**

4 * SSRF guard for user-supplied URLs — shared by /api/web/scan and

5 * /api/wp/scan (both accept ANY URL from an unauthenticated caller and

6 * fetch it server-side, no signup required).

7 *

8 * Previously each route had its own copy of a hostname-string blocklist

9 * (`localhost` / `127.` / `10.` / etc.) with two gaps: no DNS resolution

10 * (a domain the attacker controls can resolve to 127.0.0.1 or the cloud

bin/gatetest-blame.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 25

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/gatetest-blame.js#virtual:normalized:round1View on unpkg