registry / executable-stories-formatters / 1.19.0
executable-stories-formatters@1.19.0
⚠ Under reviewCucumber-compatible report formats (HTML, Markdown, JUnit XML, Cucumber JSON) for executable-stories test results.
Static Scan Results
scanned 1mo ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/cli.jsView file
10982// src/init-astro.ts
L10983: import { spawnSync } from "child_process";
L10984: import * as fs13 from "fs";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.js:
fs.writeFileSync(target, README, "utf8");
return "\n TESTRAIL_USERNAME must be the login email and TESTRAIL_API_KEY an API key from My Settings -> API Keys. A password fails here when the instance enforces API keys.";
Authorization: `Basic ${basicAuth}`
const xrayBase = (config.xrayBaseUrl ?? DEFAULT_XRAY_BASE).replace(/\/$/, "");
const jiraBase = config.jiraBaseUrl.replace(/\/$/, "");
XRAY_CLIENT_ID and XRAY_CLIENT_SECRET come from Jira -> Apps -> Xray -> API Keys. A Jira API token is a different credential and is rejected here.`
Authorization: `Bearer ${bearer}`,
headers: { Authorization: `Basic ${basic}`, "Content-Type
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli.jsView on unpkg29Cross-file remote execution chain: dist/cli.js spawns dist/index.js; helper contains network access plus dynamic code execution.
L29: try {
L30: const parsed = JSON.parse(deps.readFile(filePath));
L31: if (!Array.isArray(parsed?.testCases)) throw new Error("no testCases");
...
L397: try {
L398: const res = await fetch(url, { method, signal: controller.signal, redirect: "follow" });
L399: return res.status < 400;
...
L684: section: raw.section_id === void 0 ? void 0 : sectionNames.get(raw.section_id),
L685: body: {
L686: title,
...
L1371: } else {
L1372: const present = CONFIG_CANDIDATES.map((name) => resolve2(process.cwd(), name)).filter(existsSync4);
L1373: if (present.length > 1) {
Findings
4 High3 Medium5 Low
HighChild Processdist/cli.js
HighShell
HighCredential Redirect Persistencedist/cli.js
HighCross File Remote Execution Contextdist/cli.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to executable-stories-formatters@1.19.0.
See all versions of executable-stories-formatters for other recorded verdicts.
- Review the evidence and your use of executable-stories-formatters@1.19.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.