registry / @suiflex/suitest / 0.1.8

@suiflex/suitest@0.1.8

Suitest local bundle — one command runs the full local stack (dashboard + SQLite + MCP).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 1.46 MB of source, external domains: 127.0.0.1, api.example.com, app.example.com, astral.sh, bit.ly, github.com, mcp.acme.dev, radix-ui.com, react.dev, redux-toolkit.js.org, redux.js.org, registry.npmjs.org, www.w3.org

Source & flagged code

6 flagged

lib/onboard.jsView file

Lines 19-59javascript

19 }

20 return loadOrCreateCredentials(credPath, { email: opts.email, password: opts.password });

21 }

22 if (!process.stdin.isTTY || !process.stdout.isTTY) {

23 throw new Error(

24 "No admin account yet and no terminal to ask — re-run interactively, or pass --email and --password.",

25 );

26 }

27 const readline = require("node:readline/promises");

28 const rl = readline.createInterface({ input: process.stdin, output: process.stdout });

29 try {

30 console.log("Create the admin account for your local Suitest (you'll log in with this):");

31 let email = "";

32 while (!email.includes("@")) {

33 email = (await rl.question(" email: ")).trim();

34 }

35 let password = "";

36 for (;;) {

37 password = (await rl.question(" password (min 8 chars): ")).trim();

38 if (password.length < 8) continue;

39 const confirm = (await rl.question(" confirm password: ")).trim();

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/onboard.jsView on unpkg · L39

40 if (confirm === password) break;

41 console.log(" Passwords don't match, try again.");

42 }

43 return loadOrCreateCredentials(credPath, { email, password });

44 } finally {

45 rl.close();

46 }

47}

49// ponytail: published dependency first; relative fallback for monorepo dev

50// (node_modules is not guaranteed to exist in packages/suitest-npx while developing).

51function loadMcpLib(mod) {

52 try {

53 return require(`@suiflex/suitest-mcp/lib/${mod}`);

54 } catch {

55 return require(path.join(__dirname, "..", "..", "mcp-npx", "lib", mod));

56 }

57}

59// Prepare = every up() prerequisite: uv, assets, venv. Used by onboard AND `suitest up`.

bin/suitest.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

4const { parseArgs } = require("node:util");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/suitest.jsView on unpkg · L3

6const USAGE = `Usage: suitest <command> [options]

lib/venv.jsView file

Lines 1-24javascript

1"use strict";

3const fs = require("node:fs");

4const path = require("node:path");

5const { execFileSync, spawnSync } = require("node:child_process");

assets/wheels/suitest_shared-0.1.0-py3-none-any.whlView file

•path = assets/wheels/suitest_shared-0.1.0-py3-none-any.whl kind = compressed_blob sizeBytes = 17007 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

assets/wheels/suitest_shared-0.1.0-py3-none-any.whlView on unpkg

•path = assets/wheels/suitest_shared-0.1.0-py3-none-any.whl kind = nested_archive_needs_inspection sizeBytes = 17007 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

assets/wheels/suitest_shared-0.1.0-py3-none-any.whlView on unpkg

assets/web/assets/geist-sans-latin-600-normal-DFOURf8L.woff2View file

•path = assets/web/assets/geist-sans-latin-600-normal-DFOURf8L.woff2 kind = high_entropy_blob sizeBytes = 35292 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/web/assets/geist-sans-latin-600-normal-DFOURf8L.woff2View on unpkg

Source & flagged code

6 flagged · loading source

lib/onboard.jsView file

39patternName = generic_password severity = medium line = 39 matchedText = const co...m();

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/onboard.jsView on unpkg · L39

bin/suitest.jsView file

3L4: const { parseArgs } = require("node:util"); L5:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/suitest.jsView on unpkg · L3

lib/venv.jsView file

4const path = require("node:path"); L5: const { execFileSync, spawnSync } = require("node:child_process"); L6: L7: const pkg = require("../package.json"); L8: L9: function uvInstallHint(platform = process.platform) { L10: const cmd = L11: platform === "win32" L12: ? ' powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"' L13: : " curl -LsSf https://astral.sh/uv/install.sh | sh";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/venv.jsView on unpkg · L4

assets/wheels/suitest_shared-0.1.0-py3-none-any.whlView file

•path = assets/wheels/suitest_shared-0.1.0-py3-none-any.whl kind = compressed_blob sizeBytes = 17007 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

assets/wheels/suitest_shared-0.1.0-py3-none-any.whlView on unpkg

•path = assets/wheels/suitest_shared-0.1.0-py3-none-any.whl kind = nested_archive_needs_inspection sizeBytes = 17007 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

assets/wheels/suitest_shared-0.1.0-py3-none-any.whlView on unpkg

assets/web/assets/geist-sans-latin-600-normal-DFOURf8L.woff2View file

•path = assets/web/assets/geist-sans-latin-600-normal-DFOURf8L.woff2 kind = high_entropy_blob sizeBytes = 35292 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/web/assets/geist-sans-latin-600-normal-DFOURf8L.woff2View on unpkg

Findings

2 High7 Medium6 Low

HighSandbox Evasion Gated Capabilitylib/venv.js

HighShips High Entropy Blobassets/web/assets/geist-sans-latin-600-normal-DFOURf8L.woff2

MediumSecret Patternlib/onboard.js

MediumDynamic Requirebin/suitest.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Compressed Blobassets/wheels/suitest_shared-0.1.0-py3-none-any.whl

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNested Archive Needs Inspectionassets/wheels/suitest_shared-0.1.0-py3-none-any.whl

Source & flagged code

6 flagged

lib/onboard.jsView file

Lines 19-59javascript

19 }

20 return loadOrCreateCredentials(credPath, { email: opts.email, password: opts.password });

21 }

22 if (!process.stdin.isTTY || !process.stdout.isTTY) {

23 throw new Error(

24 "No admin account yet and no terminal to ask — re-run interactively, or pass --email and --password.",

25 );

26 }

27 const readline = require("node:readline/promises");

28 const rl = readline.createInterface({ input: process.stdin, output: process.stdout });

29 try {

30 console.log("Create the admin account for your local Suitest (you'll log in with this):");

31 let email = "";

32 while (!email.includes("@")) {

33 email = (await rl.question(" email: ")).trim();

34 }

35 let password = "";

36 for (;;) {

37 password = (await rl.question(" password (min 8 chars): ")).trim();

38 if (password.length < 8) continue;

39 const confirm = (await rl.question(" confirm password: ")).trim();

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/onboard.jsView on unpkg · L39

40 if (confirm === password) break;

41 console.log(" Passwords don't match, try again.");

42 }

43 return loadOrCreateCredentials(credPath, { email, password });

44 } finally {

45 rl.close();

46 }

47}

49// ponytail: published dependency first; relative fallback for monorepo dev

50// (node_modules is not guaranteed to exist in packages/suitest-npx while developing).

51function loadMcpLib(mod) {

52 try {

53 return require(`@suiflex/suitest-mcp/lib/${mod}`);

54 } catch {

55 return require(path.join(__dirname, "..", "..", "mcp-npx", "lib", mod));

56 }

57}

59// Prepare = every up() prerequisite: uv, assets, venv. Used by onboard AND `suitest up`.

bin/suitest.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

4const { parseArgs } = require("node:util");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/suitest.jsView on unpkg · L3

6const USAGE = `Usage: suitest <command> [options]

lib/venv.jsView file

Lines 1-24javascript

1"use strict";

3const fs = require("node:fs");

4const path = require("node:path");

5const { execFileSync, spawnSync } = require("node:child_process");

assets/wheels/suitest_shared-0.1.0-py3-none-any.whlView file

•path = assets/wheels/suitest_shared-0.1.0-py3-none-any.whl kind = compressed_blob sizeBytes = 17007 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

assets/wheels/suitest_shared-0.1.0-py3-none-any.whlView on unpkg

•path = assets/wheels/suitest_shared-0.1.0-py3-none-any.whl kind = nested_archive_needs_inspection sizeBytes = 17007 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

assets/wheels/suitest_shared-0.1.0-py3-none-any.whlView on unpkg

assets/web/assets/geist-sans-latin-600-normal-DFOURf8L.woff2View file

•path = assets/web/assets/geist-sans-latin-600-normal-DFOURf8L.woff2 kind = high_entropy_blob sizeBytes = 35292 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/web/assets/geist-sans-latin-600-normal-DFOURf8L.woff2View on unpkg