registry / @rtorcato/js-tooling / 2.50.0

@rtorcato/js-tooling@2.50.0

JavaScript and TypeScript tooling for Node.js, React, Next.js, and Vitest.

Static Scan Results

scanned 17h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 60 file(s), 317 KB of source, external domains: biomejs.dev, bundlephobia.com, codecov.io, conventionalcommits.org, docs.github.com, docs.renovatebot.com, github.com, gitlab.com, img.shields.io, json-schema.org, nodejs.org, opensource.org, registry.npmjs.org, rtorcato.github.io, turborepo.com, unpkg.com, www.conventionalcommits.org, www.npmjs.com

Source & flagged code

2 flagged

tooling/tests/ssr-safety.mjsView file

Lines 1-30javascript

1import { readdirSync } from 'node:fs'

2import { join } from 'node:path'

3import { pathToFileURL } from 'node:url'

4import { describe, expect, it } from 'vitest'

6/**

7 * Asserts that every module folder under `srcDir` can be imported in a Node

8 * environment without throwing (no DOM, no `window`, no `document`).

9 *

10 * For each folder under `srcDir` (excluding `excludeDirs`), the helper resolves

11 * `<srcDir>/<name>/<moduleEntry>` and `await import(...)` it. If the import

12 * throws or the module accesses a missing global at top level, the test fails.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tooling/tests/ssr-safety.mjsView on unpkg · L10

13 *

14 * Use this as a contract test for libraries that promise SSR safety — i.e., that

15 * importing a module is always safe even when its underlying API isn't available.

16 *

17 * @example

18 * ```ts

19 * // src/tests/ssr-safety.test.ts (run with vitest --environment node)

20 * import { fileURLToPath } from 'node:url'

21 * import { runSsrSafetyTest } from '@rtorcato/js-tooling/tests/ssr-safety'

22 *

23 * runSsrSafetyTest({

24 * srcDir: fileURLToPath(new URL('../', import.meta.url)),

25 * excludeDirs: ['tests'],

26 * })

27 * ```

28 *

29 * @param {object} options

30 * @param {string} options.srcDir Absolute path to the source folder.

tooling/semantic-release/index.mjsView file

Lines 1-31javascript

1export default {

2 branches: [

3 '+([0-9])?(.{+([0-9]),x}).x',

4 'main', // → stable

5 'next',

6 'release',

Source & flagged code

2 flagged · loading source

tooling/tests/ssr-safety.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code