registry / executable-stories-formatters / 1.30.0
executable-stories-formatters@1.30.0
Cucumber-compatible report formats (HTML, Markdown, JUnit XML, Cucumber JSON) for executable-stories test results.
AI Security Review
scanned 2d ago · by lpm-firewall-aiSource inspection shows no install hook or covert credential redirect. The flagged network behavior is an optional product feature activated by JEV_API_KEY and uses a specifically named endpoint that users can override.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs a Jev-enabled triage, goal, or review command with JEV_API_KEY set.
Impact
No confirmed credential theft, persistence, or other attack behavior was established.
Mechanism
The CLI sends requests to the TypeSafe AI endpoint by default; JEV_ENDPOINT can explicitly override the destination.
AI rationale
Source inspection shows no install hook or covert credential redirect. The flagged network behavior is an optional product feature activated by JEV_API_KEY and uses a specifically named endpoint that users can override.
Evidence
package.jsondist/cli.jsdist/index.js
Network endpoints1
api.typesafe.ai/v1/systemone
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no install lifecycle hook and exposes the package library and CLI.
- Jev sends a key only when the dedicated JEV_API_KEY is set; its default endpoint is the TypeSafe AI service, and JEV_ENDPOINT can override it.
- CLI help describes Jev as optional and identifies triage, goal, and review as its callers.
- Inspected dependency entrypoints provide Cucumber formatting, message parsing, and JSON Schema validation; their manifests show no install hooks.
- The SHA-1 use in the CommonJS bundle hashes canonical scenario content into a short identifier.
Evidence against
- The CLI contains network access and a bearer token, but the source ties these to the optional Jev integration and its named key.
- The package includes dynamic imports and weak hash algorithms, but inspected examples are for React report rendering and scenario identifiers.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
6 flagged · loading sourcedist/cli.jsView file
4import * as fs19 from "fs";
L5: import { execFile } from "child_process";
L6: import * as path25 from "path";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.js:
fs.writeFileSync(target, README, "utf8");
return "\n TESTRAIL_USERNAME must be the login email and TESTRAIL_API_KEY an API key from My Settings -> API Keys. A password fails here when the instance enforces API keys.";
Authorization: `Basic ${basicAuth}`
const xrayBase = (config.xrayBaseUrl ?? DEFAULT_XRAY_BASE).replace(/\/$/, "");
const jiraBase = config.jiraBaseUrl.replace(/\/$/, "");
XRAY_CLIENT_ID and XRAY_CLIENT_SECRET come from Jira -> Apps -> Xray -> API Keys. A Jira API token is a different credential and is rejected here.`
Authorization: `Bearer ${bearer}`,
headers: { Authorization: `Basic ${basic}`, "Content-Type
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli.jsView on unpkg4Cross-file remote execution chain: dist/cli.js spawns dist/index.js; helper contains network access plus dynamic code execution.
L4: import * as fs19 from "fs";
L5: import { execFile } from "child_process";
L6: import * as path25 from "path";
...
L30: try {
L31: const parsed = JSON.parse(deps.readFile(filePath));
L32: if (!Array.isArray(parsed?.testCases)) throw new Error("no testCases");
...
L407: try {
L408: const res = await fetch(url, { method, signal: controller.signal, redirect: "follow" });
L409: return res.status < 400;
...
L694: section: raw.section_id === void 0 ? void 0 : sectionNames.get(raw.section_id),
L695: body: {
L696: title,
Findings
3 High3 Medium6 Low
HighChild Processdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCross File Remote Execution Contextdist/cli.js
MediumDynamic Requiredist/index.cjs
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to executable-stories-formatters@1.30.0.
See all versions of executable-stories-formatters for other recorded verdicts.
- Review the evidence and your use of executable-stories-formatters@1.30.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.