registry / executable-stories-formatters / 1.24.1
executable-stories-formatters@1.24.1
Cucumber-compatible report formats (HTML, Markdown, JUnit XML, Cucumber JSON) for executable-stories test results.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe manifest has no install hook, and the flagged endpoint and process behavior are tied to optional, caller-invoked product features. The credential transfer requires a Jev-specific key and targets the service identified by the CLI as TypeSafe AI.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Jev enrichment runs when a caller sets JEV_API_KEY; report opening and GIF generation require their respective CLI actions.
Impact
No install-time attack, credential redirection, or malicious persistence was established.
Mechanism
The Jev client posts state and questions with the supplied key to the TypeSafe AI endpoint. The CLI also launches a platform report opener or ffmpeg for GIF output.
AI rationale
The manifest has no install hook, and the flagged endpoint and process behavior are tied to optional, caller-invoked product features. The credential transfer requires a Jev-specific key and targets the service identified by the CLI as TypeSafe AI.
Evidence
package.jsondist/cli.jsdist/index.jsdist/index.cjs
Network endpoints1
api.typesafe.ai/v1/systemone
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares library and CLI entry points and contains no install lifecycle hook.
- The CLI and both library builds create the Jev client only when JEV_API_KEY is set; the endpoint can be explicitly overridden through JEV_ENDPOINT.
- The CLI describes Jev as optional enrichment for triage, goal, and review, and returns its regular report when the key is absent.
- The Jev client sends its supplied key in a bearer header with state and questions to the TypeSafe AI endpoint.
- The CLI process calls are for opening a generated report or running ffmpeg for GIF creation.
- The CommonJS entrypoint uses static requires for package and platform modules.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcedist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = executable-stories-formatters@1.16.1
matchedIdentity = npm:[redacted]:1.16.1
similarity = 0.429
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg4import * as fs17 from "fs";
L5: import { execFile } from "child_process";
L6: import * as path23 from "path";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.js:
fs.writeFileSync(target, README, "utf8");
return "\n TESTRAIL_USERNAME must be the login email and TESTRAIL_API_KEY an API key from My Settings -> API Keys. A password fails here when the instance enforces API keys.";
Authorization: `Basic ${basicAuth}`
const xrayBase = (config.xrayBaseUrl ?? DEFAULT_XRAY_BASE).replace(/\/$/, "");
const jiraBase = config.jiraBaseUrl.replace(/\/$/, "");
XRAY_CLIENT_ID and XRAY_CLIENT_SECRET come from Jira -> Apps -> Xray -> API Keys. A Jira API token is a different credential and is rejected here.`
Authorization: `Bearer ${bearer}`,
headers: { Authorization: `Basic ${basic}`, "Content-Type
Findings
1 Critical3 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCross File Remote Execution Contextdist/cli.js
MediumDynamic Requiredist/index.cjs
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to executable-stories-formatters@1.24.1.
See all versions of executable-stories-formatters for other recorded verdicts.
- Review the evidence and your use of executable-stories-formatters@1.24.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.