registry / executable-stories-cypress / 8.9.3

executable-stories-cypress@8.9.3

⚠ Under review

BDD-style executable stories for Cypress with documentation generation

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The inspected reporter behavior is consistent with Cypress reporting and optional raw-run output, and the inspected core helper builds documentation entries. The required executable-stories-formatters dependency is unavailable for source review, leaving runtime behavior unresolved.

Static reason

No blocking static signals were detected.

Trigger

Loading the reporter and generating reports after Cypress tests complete.

Impact

The dependency's runtime behavior could not be assessed, so the package cannot be cleared from this snapshot alone.

Mechanism

The reporter imports the unavailable formatter dependency and calls its report-generation functions.

AI rationale

Evidence

package.jsondist/reporter.jsdist/reporter.cjs

Decision evidence

public snapshot

AI called this Manual Review at 93.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest declares executable-stories-formatters 1.29.0 as a runtime dependency, and the reporter imports it for report generation.
The reporter handles test completion and writes a raw run only when rawRunPath is configured.
The inspected core helper validates and returns an HTML documentation entry; no attack behavior was identified in that helper.

Evidence against

The package snapshot does not include source for the required executable-stories-formatters dependency, so its runtime behavior could not be reviewed.

Behavioral surface

Source

Filesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 84.7 KB of source

Source & flagged code

7 flagged

package.jsonView file

Lines 18-58json

18 "import": "./dist/support.js",

19 "require": "./dist/support.cjs"

20 },

21 "./plugin": {

22 "types": "./dist/plugin.d.ts",

23 "import": "./dist/plugin.js",

24 "require": "./dist/plugin.cjs"

25 },

26 "./reporter": {

27 "types": "./dist/reporter.d.ts",

28 "import": "./dist/reporter.js",

29 "require": "./dist/reporter.cjs"

30 }

31 },

32 "files": [

33 "dist",

34 "skills",

35 "reporter.cjs"

36 ],

37 "peerDependencies": {

38 "cypress": ">=13.0.0"

39 },

40 "dependencies": {

41 "executable-stories-core": "0.30.0",

42 "executable-stories-formatters": "1.29.0"

43 },

44 "devDependencies": {

45 "cypress": "^16.1.1",

Low

Suspicious Dependency Evidence

The manifest declares executable-stories-formatters 1.29.0 as a runtime dependency, and the reporter imports it for report generation.

package.jsonView on unpkg · L38

46 "@types/node": "^26.6.1",

47 "tsup": "^8.5.1",

48 "typescript": "~6.0.3",

49 "vitest": "^5.0.1"

50 },

51 "repository": {

52 "type": "git",

53 "url": "git+https://github.com/jagreehal/executable-stories.git",

54 "directory": "packages/executable-stories-cypress"

55 },

56 "keywords": [

57 "cypress",

58 "bdd",

dist/reporter.jsView file

Lines 1-21javascript

1// src/reporter.ts

2import * as fs from "fs";

3import * as path from "path";

4import {

dist/reporter.cjsView file

Lines 18-58javascript

18 return to;

19};

20var __toESM = (mod, isNodeMode, target) => (target = mod != null ?

.lpm-dependency-evidence-e8972b22-19b4-44f2-a9e3-807ceff7e655/0/npm-linux/dist/utils/doc-builders.jsView file

1function buildHtmlDocEntry(options) { const sources = [options.path, options.url, options.content].filter( (v) => v !== void 0 ); if (sources.length !== 1) { throw new Error(

Low

Ai Review Evidence

The inspected core helper validates and returns an HTML documentation entry; no attack behavior was identified in that helper.

.lpm-dependency-evidence-e8972b22-19b4-44f2-a9e3-807ceff7e655/0/npm-linux/dist/utils/doc-builders.jsView on unpkg · L1

.lpm-dependency-evidence-e8972b22-19b4-44f2-a9e3-807ceff7e655/0/npm-linux/dist/utils/doc-builders.cjsView file

24function buildHtmlDocEntry(options) { const sources = [options.path, options.url, options.content].filter( (v) => v !== void 0 ); if (sources.length !== 1) { throw new Error( "story.html() requires ex

Low

Ai Review Evidence

The inspected core helper validates and returns an HTML documentation entry; no attack behavior was identified in that helper.

.lpm-dependency-evidence-e8972b22-19b4-44f2-a9e3-807ceff7e655/0/npm-linux/dist/utils/doc-builders.cjsView on unpkg · L24

Source & flagged code

7 flagged · loading source

package.jsonView file

38"cypress": ">=13.0.0" }, "dependencies": { "executable-stories-core": "0.30.0", "executable-stories-formatters": "1.29.0" }, "devDependencies": { "cypress":

Low

Suspicious Dependency Evidence

The manifest declares executable-stories-formatters 1.29.0 as a runtime dependency, and the reporter imports it for report generation.

package.jsonView on unpkg · L38

dist/reporter.jsView file

1// src/reporter.ts import * as fs from "fs"; import * as path from "path"; import { ReportGenerator, canonicalizeRun, readGitSha, readPackageVersion, detectCI } from "executable-st

Low

Suspicious Dependency Evidence

The manifest declares executable-stories-formatters 1.29.0 as a runtime dependency, and the reporter imports it for report generation.

dist/reporter.jsView on unpkg · L1

dist/reporter.cjsView file

Findings

9 Low

LowScripts Present

LowFilesystem

LowSuspicious Dependency Evidencepackage.json

LowSuspicious Dependency Evidencedist/reporter.js

LowSuspicious Dependency Evidencedist/reporter.cjs

LowAi Review Evidencedist/reporter.cjs

LowAi Review Evidence.lpm-dependency-evidence-e8972b22-19b4-44f2-a9e3-807ceff7e655/0/npm-linux/dist/utils/doc-builders.js

LowAi Review Evidence.lpm-dependency-evidence-e8972b22-19b4-44f2-a9e3-807ceff7e655/0/npm-linux/dist/utils/doc-builders.cjs

Affected versions and remediation

This report applies to executable-stories-cypress@8.9.3.

See all versions of executable-stories-cypress for other recorded verdicts.

Review the evidence and your use of executable-stories-cypress@8.9.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 18:45:40.413Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.