registry / @sun-asterisk/sungen / 3.2.4

@sun-asterisk/sungen@3.2.4

Deterministic E2E Test Compiler - Gherkin + Selectors → Playwright tests

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 319 file(s), 2.06 MB of source, external domains: 127.0.0.1, api.figma.com, example.com, mcp.figma.com, sungen.sun-asterisk.vn, www.figma.com, www.googleapis.com, your-app.com

Source & flagged code

7 flagged

dist/tools/sungen-auth/open-browser.jsView file

Lines 1-30javascript

1"use strict";

2/**

3 * Cross-platform "open this URL in the default browser" helper.

4 *

5 * Deliberately dependency-free — a small platform switch instead of pulling in

6 * the `open` npm package. Returns false on failure so the caller can fall back

7 * to printing the URL for manual paste.

8 */

9Object.defineProperty(exports, "__esModule", { value: true });

10exports.openBrowser = openBrowser;

11const child_process_1 = require("child_process");

12/** Attempt to open `url` in the system browser. Returns true if a launcher was spawned. */

High

Child Process

Package source references child process execution.

dist/tools/sungen-auth/open-browser.jsView on unpkg · L10

13function openBrowser(url) {

14 let command;

15 let args;

16 switch (process.platform) {

17 case 'darwin':

18 command = 'open';

19 args = [url];

20 break;

21 case 'win32':

22 // `start` is a cmd builtin; the empty "" is the window-title placeholder.

23 command = 'cmd';

24 args = ['/c', 'start', '', url];

25 break;

26 default:

27 command = 'xdg-open';

28 args = [url];

29 break;

30 }

src/tools/sungen-api/edit-in-editor.tsView file

Lines 15-49typescript

16/** Resolve the editor command, mirroring git's precedence. */

17function resolveEditor(): string {

18 return (

19 process.env.VISUAL ||

20 process.env.EDITOR ||

21 (process.platform === 'win32' ?

bin/sungen.jsView file

Lines 1-13javascript

1#!/usr/bin/env node

3/**

4 * Sungen CLI Entry Point

5 * This file is the executable entry point for the sungen command

6 */

8// Import tsx loader and run the CLI

9require('tsx/cjs/api').register();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/sungen.jsView on unpkg · L8

src/harness/manifest.tsView file

Lines 42-82typescript

43/**

44 * Match a feature section name to a spec section name. Feature comments often

45 * combine spec sections (e.g. "features items / product cards" → spec "features

46 * items"), so fall back to longest substring match in either direction.

47 */

48function matchSection(featureSection: string, specNames: string[]): string |

dist/ingest/gsheet-fetch.jsView file

Lines 24-64javascript

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

dist/orchestrator/templates/ai-src/skills/sungen-tc-generation/SKILL.mdView file

Lines 596-623markdown

596 @high

597 Scenario: User logs in successfully

598 When User fill [Login:Email] field with {{login.email}}

599 And User fill [Login:Password] field with {{login.password}}

600 And User click [Login:Submit] button

601 Then User see [Dashboard] page

602

603 @high

604 Scenario: User submits nomination

src/orchestrator/templates/ai-src/skills/sungen-tc-generation/SKILL.mdView file

Lines 596-623markdown

596 @high

597 Scenario: User logs in successfully

598 When User fill [Login:Email] field with {{login.email}}

599 And User fill [Login:Password] field with {{login.password}}

600 And User click [Login:Submit] button

601 Then User see [Dashboard] page

602

603 @high

604 Scenario: User submits nomination

Source & flagged code

7 flagged · loading source

dist/tools/sungen-auth/open-browser.jsView file

10exports.openBrowser = openBrowser; L11: const child_process_1 = require("child_process"); L12: /** Attempt to open `url` in the system browser. Returns true if a launcher was spawned. */

High

Child Process

Package source references child process execution.

dist/tools/sungen-auth/open-browser.jsView on unpkg · L10

src/tools/sungen-api/edit-in-editor.tsView file

35// shell:true so editors with args work (e.g. VISUAL="code --wait"). L36: const result = spawnSync(`${editor} "${file}"`, { shell: true, stdio: 'inherit' }); L37: if (result.error) throw new Error(`Could not launch editor "${editor}": ${result.error.message}`);

High

Shell

Package source references shell execution.

src/tools/sungen-api/edit-in-editor.tsView on unpkg · L35

bin/sungen.jsView file

8// Import tsx loader and run the CLI L9: require('tsx/cjs/api').register(); L10:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/sungen.jsView on unpkg · L8

src/harness/manifest.tsView file

62const lines = fs.readFileSync(specPath, 'utf-8').split('\n'); L63: const sections: { name: string; body: string[] }[] = []; L64: let cur: { name: string; body: string[] } | null = null; ... L162: export function manifestPath(screenName: string): string { L163: return path.join(process.cwd(), '.sungen', 'manifest', `${reportSlug(screenName)}.json`); L164: } ... L166: const p = manifestPath(screenName); L167: return fs.existsSync(p) ? JSON.parse(fs.readFileSync(p, 'utf-8')) : null; L168: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/harness/manifest.tsView on unpkg · L62

dist/ingest/gsheet-fetch.jsView file

44* `googleapis` is an OPTIONAL dependency (lazy-required) — the core install stays lean; L45: * users who want the Google fetch run `npm i googleapis` + authenticate once with L46: * `gcloud auth application-default login` (or set GOOGLE_APPLICATION_CREDENTIALS). ... L49: const readline = __importStar(require("readline")); L50: const child_process_1 = require("child_process"); L51: const SCOPE = 'https://www.googleapis.com/auth/spreadsheets.readonly';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/ingest/gsheet-fetch.jsView on unpkg · L44

dist/orchestrator/templates/ai-src/skills/sungen-tc-generation/SKILL.mdView file

616patternName = generic_password severity = medium line = 616 matchedText = password...123"

Medium

Secret Pattern

Hardcoded password in dist/orchestrator/templates/ai-src/skills/sungen-tc-generation/SKILL.md

dist/orchestrator/templates/ai-src/skills/sungen-tc-generation/SKILL.mdView on unpkg · L616

src/orchestrator/templates/ai-src/skills/sungen-tc-generation/SKILL.mdView file

616patternName = generic_password severity = medium line = 616 matchedText = password...123"

Medium

Secret Pattern

Hardcoded password in src/orchestrator/templates/ai-src/skills/sungen-tc-generation/SKILL.md

src/orchestrator/templates/ai-src/skills/sungen-tc-generation/SKILL.mdView on unpkg · L616

Findings

3 High6 Medium6 Low

HighChild Processdist/tools/sungen-auth/open-browser.js

HighShellsrc/tools/sungen-api/edit-in-editor.ts

HighRuntime Package Installdist/ingest/gsheet-fetch.js

MediumDynamic Requirebin/sungen.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/orchestrator/templates/ai-src/skills/sungen-tc-generation/SKILL.md

MediumSecret Patternsrc/orchestrator/templates/ai-src/skills/sungen-tc-generation/SKILL.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptosrc/harness/manifest.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/tools/sungen-auth/open-browser.jsView file

Lines 1-30javascript

1"use strict";

2/**

3 * Cross-platform "open this URL in the default browser" helper.

4 *

5 * Deliberately dependency-free — a small platform switch instead of pulling in

6 * the `open` npm package. Returns false on failure so the caller can fall back

7 * to printing the URL for manual paste.

8 */

9Object.defineProperty(exports, "__esModule", { value: true });

10exports.openBrowser = openBrowser;

11const child_process_1 = require("child_process");

12/** Attempt to open `url` in the system browser. Returns true if a launcher was spawned. */

High

Child Process

Package source references child process execution.

dist/tools/sungen-auth/open-browser.jsView on unpkg · L10

13function openBrowser(url) {

14 let command;

15 let args;

16 switch (process.platform) {

17 case 'darwin':

18 command = 'open';

19 args = [url];

20 break;

21 case 'win32':

22 // `start` is a cmd builtin; the empty "" is the window-title placeholder.

23 command = 'cmd';

24 args = ['/c', 'start', '', url];

25 break;

26 default:

27 command = 'xdg-open';

28 args = [url];

29 break;

30 }

src/tools/sungen-api/edit-in-editor.tsView file

Lines 15-49typescript

16/** Resolve the editor command, mirroring git's precedence. */

17function resolveEditor(): string {

18 return (

19 process.env.VISUAL ||

20 process.env.EDITOR ||

21 (process.platform === 'win32' ?

bin/sungen.jsView file

Lines 1-13javascript

1#!/usr/bin/env node

3/**

4 * Sungen CLI Entry Point

5 * This file is the executable entry point for the sungen command

6 */

8// Import tsx loader and run the CLI

9require('tsx/cjs/api').register();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/sungen.jsView on unpkg · L8

src/harness/manifest.tsView file

Lines 42-82typescript

43/**

44 * Match a feature section name to a spec section name. Feature comments often

45 * combine spec sections (e.g. "features items / product cards" → spec "features

46 * items"), so fall back to longest substring match in either direction.

47 */

48function matchSection(featureSection: string, specNames: string[]): string |

dist/ingest/gsheet-fetch.jsView file

Lines 24-64javascript

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

dist/orchestrator/templates/ai-src/skills/sungen-tc-generation/SKILL.mdView file

Lines 596-623markdown

596 @high

597 Scenario: User logs in successfully

598 When User fill [Login:Email] field with {{login.email}}

599 And User fill [Login:Password] field with {{login.password}}

600 And User click [Login:Submit] button

601 Then User see [Dashboard] page

602

603 @high

604 Scenario: User submits nomination

src/orchestrator/templates/ai-src/skills/sungen-tc-generation/SKILL.mdView file

Lines 596-623markdown

596 @high

597 Scenario: User logs in successfully

598 When User fill [Login:Email] field with {{login.email}}

599 And User fill [Login:Password] field with {{login.password}}

600 And User click [Login:Submit] button

601 Then User see [Dashboard] page

602

603 @high

604 Scenario: User submits nomination