registry  /  @thinkwise/testwise  /  0.2.103

@thinkwise/testwise@0.2.103

Testwise is a dedicated end-to-end (E2E) test automation solution built for applications developed on the Thinkwise Platform. It sits on top of Playwright and provides a higher-level automation layer that deeply understands the UI patterns, controls, and

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 308 file(s), 687 KB of source, external domains: d3js.org, html2canvas.hertzen.com, www.w3.org

Source & flagged code

7 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/main.js postinstall
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/main.js postinstall
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
promptCredentials.jsView file
1#!/usr/bin/env node L2: import { spawnSync } from 'node:child_process'; L3: import { readFileSync } from 'node:fs';
High
Child Process

Package source references child process execution.

promptCredentials.jsView on unpkg · L1
17spawnSync(`yarn --cwd ../ ${args.join(' ')}`, { L18: shell: true, L19: stdio: 'inherit'
High
Shell

Package source references shell execution.

promptCredentials.jsView on unpkg · L17
1Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, execution+network L1: #!/usr/bin/env node L2: import { spawnSync } from 'node:child_process'; L3: import { readFileSync } from 'node:fs'; ... L7: L8: const packageScripts = JSON.parse(readFileSync('./package.json')).scripts; L9: ... L42: try { L43: const configPath = path.resolve(process.cwd(), './Testwise.json'); L44: const config = JSON.parse(fs.readFileSync(configPath, 'utf-8')); ... L53: L54: if (process.env.SF_TEST_USERNAME && process.env.SF_TEST_PASSWORD) { L55: console.log('Using SF_TEST_USERNAME and SF_TEST_PASSWORD environment variables.');
High
Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

promptCredentials.jsView on unpkg · L1
templates/SubjectRegistry.template.tsView file
51then: (onfulfilled: any) => { L52: return import(path).then((m) => { L53: // eslint-disable-next-line @typescript-eslint/naming-convention
Medium
Dynamic Require

Package source references dynamic require/import behavior.

templates/SubjectRegistry.template.tsView on unpkg · L51
scripts/postinstall.jsView file
42L43: execSync('npx tsc', { cwd: rootDir, stdio: 'inherit' }); L44:
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L42

Findings

5 High5 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild ProcesspromptCredentials.js
HighShellpromptCredentials.js
HighEntrypoint Build DivergencepromptCredentials.js
HighRuntime Package Installscripts/postinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiretemplates/SubjectRegistry.template.ts
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings