@uniqbit/mate: Suspicious npm security report (Warn)

Loading npm security reports…

Source & flagged code

6 flagged

src/tools/setup/utils-run.test.tsView file

Lines 1-21typescript

1import { EventEmitter } from "node:events";

2import * as childProcess from "node:child_process";

High

Child Process

Package source references child process execution.

src/tools/setup/utils-run.test.tsView on unpkg · L1

4import { afterAll, afterEach, beforeEach, describe, expect, mock, test } from "bun:test";

6type ChildLike = EventEmitter;

8// Capture the real spawn as a plain value *before* mock.module() runs below.

9// `import { spawn as realSpawn }` would instead create a live binding that

10// re-reads the export slot on every reference — since mock.module() mutates

11// that same slot in place, the binding would end up pointing at our own mock

12// wrapper instead of the native implementation.

13const realSpawn = childProcess.spawn;

15let spawnImpl: (...args: unknown[]) => ChildLike;

17mock.module("node:child_process", () => ({

18 spawn: ((...args: unknown[]) => spawnImpl(...args)) as unknown as typeof childProcess.spawn,

19}));

21const { runCommand, runCommandSilently, runShellCommand } = await import("./utils");

Lines 54-86typescript

54 await expect(runCommand("uv", ["sync"], { cwd: "/tmp/project" })).rejects.toThrow(

55 "uv sync exited with code 2",

56 );

57 });

59 test("runCommandSilently rejects on non-zero exit codes"

src/cli/cli-e2e.test.tsView file

Lines 507-547typescript

507 "const capturePath = process.env.MATE_E2E_EDITOR_CAPTURE_PATH;",

508 "if (!capturePath) process.exit(2);",

509 'if (process.argv[2] === "--status") process.exit(0);',

510 "const payload = { cwd: process.cwd(), argv: process.argv.slice(2) };",

511 "fs.writeFileSync(capturePath, JSON.stringify(payload, null, 2));",

512 "process.exit(0);",

src/cli-bootstrap.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { execFileSync, spawnSync } = require("node:child_process");

3const os = require("node:os");

4const

src/templates/capabilities/react-doctor/claude/hooks/react-doctor.shView file

•path = [redacted]-doctor/claude/hooks/react-doctor.sh kind = build_helper sizeBytes = 3018 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/templates/capabilities/react-doctor/claude/hooks/react-doctor.shView on unpkg

Source & flagged code

6 flagged · loading source

src/tools/setup/utils-run.test.tsView file

1import { EventEmitter } from "node:events"; L2: import * as childProcess from "node:child_process"; L3:

High

Child Process

Package source references child process execution.

src/tools/setup/utils-run.test.tsView on unpkg · L1

74expect(command).toBe("echo hello"); L75: expect(options).toEqual({ cwd: "/tmp/project", stdio: "inherit", shell: true }); L76: const child = new EventEmitter();

High

Shell

Package source references shell execution.

src/tools/setup/utils-run.test.tsView on unpkg · L74

src/cli/cli-e2e.test.tsView file

527'import fs from "node:fs";', L528: 'import http from "node:http";', L529: 'import { spawnSync } from "node:child_process";', L530: "const args = process.argv.slice(2);", ... L537: "if (sub === 'add') {", L538: " const setupCapturePath = process.env.MATE_E2E_UV_CAPTURE_PATH;", L539: " if (setupCapturePath) {",

@uniqbit/mate: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged

src/tools/setup/utils-run.test.tsView file

Lines 1-21typescript

1import { EventEmitter } from "node:events";

2import * as childProcess from "node:child_process";

High

Child Process

Package source references child process execution.

src/tools/setup/utils-run.test.tsView on unpkg · L1

4import { afterAll, afterEach, beforeEach, describe, expect, mock, test } from "bun:test";

6type ChildLike = EventEmitter;

8// Capture the real spawn as a plain value *before* mock.module() runs below.

9// `import { spawn as realSpawn }` would instead create a live binding that

10// re-reads the export slot on every reference — since mock.module() mutates

11// that same slot in place, the binding would end up pointing at our own mock

12// wrapper instead of the native implementation.

13const realSpawn = childProcess.spawn;

15let spawnImpl: (...args: unknown[]) => ChildLike;

17mock.module("node:child_process", () => ({

18 spawn: ((...args: unknown[]) => spawnImpl(...args)) as unknown as typeof childProcess.spawn,

19}));

21const { runCommand, runCommandSilently, runShellCommand } = await import("./utils");

Lines 54-86typescript

54 await expect(runCommand("uv", ["sync"], { cwd: "/tmp/project" })).rejects.toThrow(

55 "uv sync exited with code 2",

56 );

57 });

59 test("runCommandSilently rejects on non-zero exit codes"

src/cli/cli-e2e.test.tsView file

Lines 507-547typescript

507 "const capturePath = process.env.MATE_E2E_EDITOR_CAPTURE_PATH;",

508 "if (!capturePath) process.exit(2);",

509 'if (process.argv[2] === "--status") process.exit(0);',

510 "const payload = { cwd: process.cwd(), argv: process.argv.slice(2) };",

511 "fs.writeFileSync(capturePath, JSON.stringify(payload, null, 2));",

512 "process.exit(0);",

src/cli-bootstrap.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { execFileSync, spawnSync } = require("node:child_process");

3const os = require("node:os");

4const

src/templates/capabilities/react-doctor/claude/hooks/react-doctor.shView file

•path = [redacted]-doctor/claude/hooks/react-doctor.sh kind = build_helper sizeBytes = 3018 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/templates/capabilities/react-doctor/claude/hooks/react-doctor.shView on unpkg

@uniqbit/mate@0.14.3

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code