registry / executable-stories-formatters / 1.17.0
executable-stories-formatters@1.17.0
Cucumber-compatible report formats (HTML, Markdown, JUnit XML, Cucumber JSON) for executable-stories test results.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe manifest has no install lifecycle hooks, and the library entrypoints expose formatter functionality. The scanner’s credential-transfer hint resolves to an explicit push command using a configurable destination and the package’s stated cloud default, so the inspected source does not support a malicious verdict.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the executable-stories push subcommand with a run file and API key.
Impact
The inspected source does not establish credential theft or another concrete attack.
Mechanism
The CLI sends the key as a bearer credential to the URL selected by the --url option, environment setting, or documented service default.
AI rationale
The manifest has no install lifecycle hooks, and the library entrypoints expose formatter functionality. The scanner’s credential-transfer hint resolves to an explicit push command using a configurable destination and the package’s stated cloud default, so the inspected source does not support a malicious verdict.
Evidence
package.jsondist/index.cjsdist/index.jsdist/cli.js
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes formatter entrypoints and has no install lifecycle hooks.
- The CommonJS entrypoint exports formatter APIs; the ESM entrypoint builds snapshots from test results.
- The CLI runs push only for the explicit push subcommand, requires an API key, and sends it to the configured URL or the package’s stated service default.
Evidence against
- The push command accepts a configurable URL, but the inspected default is the package’s stated cloud service; no fixed unofficial gateway was found.
- The CLI includes process-launch helpers for user-invoked report opening and site setup; these do not establish an attack.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcedist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = executable-stories-formatters@1.19.0
matchedIdentity = npm:[redacted]:1.19.0
similarity = 0.636
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg10758// src/init-astro.ts
L10759: import { spawnSync } from "child_process";
L10760: import * as fs13 from "fs";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.js:
fs.writeFileSync(target, README, "utf8");
return "\n TESTRAIL_USERNAME must be the login email and TESTRAIL_API_KEY an API key from My Settings -> API Keys. A password fails here when the instance enforces API keys.";
Authorization: `Basic ${basicAuth}`
const xrayBase = (config.xrayBaseUrl ?? DEFAULT_XRAY_BASE).replace(/\/$/, "");
const jiraBase = config.jiraBaseUrl.replace(/\/$/, "");
XRAY_CLIENT_ID and XRAY_CLIENT_SECRET come from Jira -> Apps -> Xray -> API Keys. A Jira API token is a different credential and is rejected here.`
Authorization: `Bearer ${bearer}`,
headers: { Authorization: `Basic ${basic}`, "Content-Type
Findings
1 Critical4 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighShell
HighCredential Redirect Persistencedist/cli.js
HighCross File Remote Execution Contextdist/cli.js
MediumDynamic Requiredist/index.cjs
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to executable-stories-formatters@1.17.0.
See all versions of executable-stories-formatters for other recorded verdicts.
- Review the evidence and your use of executable-stories-formatters@1.17.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.