registry / executable-stories-formatters / 1.26.0
executable-stories-formatters@1.26.0
Cucumber-compatible report formats (HTML, Markdown, JUnit XML, Cucumber JSON) for executable-stories test results.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the inspected CLI credential transfer is an optional, JEV-specific feature gated by JEV_API_KEY with an overrideable endpoint. The package entrypoints expose reporting and formatter APIs; the scanner signals do not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs a supported CLI enrichment command with JEV_API_KEY set.
Impact
No confirmed attack surface was established from the inspected source.
Mechanism
The CLI sends bounded questions to the configured JEV endpoint with that key; without the key it returns deterministic output.
AI rationale
The manifest has no install lifecycle hook, and the inspected CLI credential transfer is an optional, JEV-specific feature gated by JEV_API_KEY with an overrideable endpoint. The package entrypoints expose reporting and formatter APIs; the scanner signals do not establish malicious behavior.
Network endpoints1
api.typesafe.ai/v1/systemone
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares no preinstall, install, or postinstall hook.
- The CommonJS entrypoint exports the package API.
- The ESM entrypoint exports formatter and reporting APIs.
- The CLI sends JEV requests to its declared service using a dedicated bearer key.
- The JEV client is disabled unless JEV_API_KEY is set; the endpoint can be configured.
- CLI JEV enrichment returns deterministic output without a request when no key is set.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcedist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = executable-stories-formatters@1.16.1
matchedIdentity = npm:[redacted]:1.16.1
similarity = 0.429
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg4import * as fs18 from "fs";
L5: import { execFile } from "child_process";
L6: import * as path24 from "path";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.js:
fs.writeFileSync(target, README, "utf8");
return "\n TESTRAIL_USERNAME must be the login email and TESTRAIL_API_KEY an API key from My Settings -> API Keys. A password fails here when the instance enforces API keys.";
Authorization: `Basic ${basicAuth}`
const xrayBase = (config.xrayBaseUrl ?? DEFAULT_XRAY_BASE).replace(/\/$/, "");
const jiraBase = config.jiraBaseUrl.replace(/\/$/, "");
XRAY_CLIENT_ID and XRAY_CLIENT_SECRET come from Jira -> Apps -> Xray -> API Keys. A Jira API token is a different credential and is rejected here.`
Authorization: `Bearer ${bearer}`,
headers: { Authorization: `Basic ${basic}`, "Content-Type
Findings
1 Critical3 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCross File Remote Execution Contextdist/cli.js
MediumDynamic Requiredist/index.cjs
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to executable-stories-formatters@1.26.0.
See all versions of executable-stories-formatters for other recorded verdicts.
- Review the evidence and your use of executable-stories-formatters@1.26.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.