ai-test-fixer
AI-powered test-driven code generation and automated test repair CLI and toolkit
This report shows the evidence for ai-test-fixer@1.0.8. 0 of 8 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package has no install hooks or import-time activity, and its project-context requests occur as part of the documented repair feature. The bundled Gemini key is a concern, but the inspected code uses it with Google's Gemini endpoint; I found no unrelated credential exfiltration or other concrete attack behavior.
Decision evidence
public snapshot- There are no install lifecycle scripts; the declared scripts are for tests and package checks.
- The package entry point re-exports modules and starts no network or filesystem work at import time.
- Project context is sent to an AI provider during the documented repair and planning workflow.
- The Gemini provider sends its API request to Google's Gemini endpoint.
- The Gemini provider includes a bundled API key fallback, which is an operational security concern.
- Repair context, including test files, implementation files, and failure output, is sent to the selected provider.
Source & flagged code
6 flaggedPackage contains a high-severity secret pattern.
src/providers/gemini.jsView on unpkg · L19The Gemini provider sends its API request to Google's Gemini endpoint.
src/providers/gemini.jsView on unpkg · L151Findings
Affected versions and remediation
This report applies to ai-test-fixer@1.0.8.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of ai-test-fixer@1.0.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.