registry / artes / 1.7.24

artes@1.7.24

The simplest way to automate UI and API tests using Cucumber-style steps.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 46 file(s), 244 KB of source, external domains: api.anthropic.com, api.cohere.com, api.deepseek.com, api.groq.com, api.mistral.ai, api.openai.com, example.com, generativelanguage.googleapis.com, github.com, www.deque.com, www.saucedemo.com, www.w3.org

Source & flagged code

4 flagged

src/hooks/hooks.jsView file

Lines 2-42javascript

2 BeforeAll,

3 Before,

4 After,

5 Status,

6 setDefaultTimeout,

7 AfterStep,

8 BeforeStep,

9 AfterAll,

10} = require("@cucumber/cucumber");

11const { invokeBrowser } = require("../helper/contextManager/browserManager");

12const { invokeRequest } = require("../helper/contextManager/requestManager");

13const { pomCollector } = require("../helper/controller/pomCollector");

14const cucumberConfig = require("../../cucumber.config");

15const { context } = require("./context");

16const fs = require("fs");

17const path = require("path");

18const { moduleConfig, saveVar } = require("artes/src/helper/imports/commons");

19require("allure-cucumberjs");

20const allure = require("allure-js-commons");

21const ffprobe = require("ffprobe-static");

22const ffmpegPath = require("ffmpeg-static");

23const { execSync } = require("child_process");

24const { attachAiBugReport } = require("artes/src/helper/controller/aiBugReporter");

High

Child Process

Package source references child process execution.

src/hooks/hooks.jsView on unpkg · L22

27const HTTP_METHODS = ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"];

29/* ------------------- Helpers ------------------- */

31setDefaultTimeout(cucumberConfig.default.timeout);

33async function attachResponse(attachFn) {

34 if (!context.response) return;

36 for (const [key, value] of Object.entries(context.response)) {

37 const text =

38 typeof value === "object"

39 ? `${key}:\n${JSON.stringify(value, null, 2)}`

40 : `${key}:\n${value}`;

42 await attachFn(key, text, "application/json");

index.jsView file

Lines 1-36javascript

1const {

2 expect,

3 Given,

4 When,

5 Then,

6 context,

7 element,

8 selector,

9 saveVar,

src/helper/executers/projectCreator.jsView file

Lines 5-45javascript

5const { execSync } = require("child_process");

7function createProject(createYes, noDeps) {

8 const projectDir = path.join(process.cwd(), "artes");

docs/functionDefinitions.mdView file

Lines 2367-2402markdown

2367 "{{baseUrl}}/upload",

2368 JSON.stringify({

2369 headers: { Authorization: "Bearer {{token}}" },

2370 body: {

2371 file: "/path/to/document.pdf",

2372 description: "Important document",

2373 metadata: { type: "legal", priority: "high" },

2374 },

2375 }),

2376 "multipart",

2377);

2378```

Source & flagged code

4 flagged · loading source

src/hooks/hooks.jsView file

22const ffmpegPath = require("ffmpeg-static"); L23: const { execSync } = require("child_process"); L24: const { attachAiBugReport } = require("[redacted]");

High

Child Process

Package source references child process execution.

src/hooks/hooks.jsView on unpkg · L22

index.jsView file

16pathToCamelCase L17: } = require("./src/helper/imports/commons"); L18:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L16

src/helper/executers/projectCreator.jsView file

25if (!noDeps) { L26: execSync("npm i artes@latest", { cwd: projectDir, stdio: "inherit" }); L27: console.log("📦 Setting up browsers...");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/helper/executers/projectCreator.jsView on unpkg · L25

docs/functionDefinitions.mdView file

2387patternName = generic_password severity = medium line = 2387 matchedText = body: { ..." },

Medium

Secret Pattern

Hardcoded password in docs/functionDefinitions.md

docs/functionDefinitions.mdView on unpkg · L2387

Findings

3 High5 Medium4 Low

HighChild Processsrc/hooks/hooks.js

HighShell

HighRuntime Package Installsrc/helper/executers/projectCreator.js

MediumDynamic Requireindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndocs/functionDefinitions.md

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

src/hooks/hooks.jsView file

Lines 2-42javascript

2 BeforeAll,

3 Before,

4 After,

5 Status,

6 setDefaultTimeout,

7 AfterStep,

8 BeforeStep,

9 AfterAll,

10} = require("@cucumber/cucumber");

11const { invokeBrowser } = require("../helper/contextManager/browserManager");

12const { invokeRequest } = require("../helper/contextManager/requestManager");

13const { pomCollector } = require("../helper/controller/pomCollector");

14const cucumberConfig = require("../../cucumber.config");

15const { context } = require("./context");

16const fs = require("fs");

17const path = require("path");

18const { moduleConfig, saveVar } = require("artes/src/helper/imports/commons");

19require("allure-cucumberjs");

20const allure = require("allure-js-commons");

21const ffprobe = require("ffprobe-static");

22const ffmpegPath = require("ffmpeg-static");

23const { execSync } = require("child_process");

24const { attachAiBugReport } = require("artes/src/helper/controller/aiBugReporter");

High

Child Process

Package source references child process execution.

src/hooks/hooks.jsView on unpkg · L22

27const HTTP_METHODS = ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"];

29/* ------------------- Helpers ------------------- */

31setDefaultTimeout(cucumberConfig.default.timeout);

33async function attachResponse(attachFn) {

34 if (!context.response) return;

36 for (const [key, value] of Object.entries(context.response)) {

37 const text =

38 typeof value === "object"

39 ? `${key}:\n${JSON.stringify(value, null, 2)}`

40 : `${key}:\n${value}`;

42 await attachFn(key, text, "application/json");

index.jsView file

Lines 1-36javascript

1const {

2 expect,

3 Given,

4 When,

5 Then,

6 context,

7 element,

8 selector,

9 saveVar,

src/helper/executers/projectCreator.jsView file

Lines 5-45javascript

5const { execSync } = require("child_process");

7function createProject(createYes, noDeps) {

8 const projectDir = path.join(process.cwd(), "artes");

docs/functionDefinitions.mdView file

Lines 2367-2402markdown

2367 "{{baseUrl}}/upload",

2368 JSON.stringify({

2369 headers: { Authorization: "Bearer {{token}}" },

2370 body: {

2371 file: "/path/to/document.pdf",

2372 description: "Important document",

2373 metadata: { type: "legal", priority: "high" },

2374 },

2375 }),

2376 "multipart",

2377);

2378```