registry / executable-stories-jest / 8.10.5

executable-stories-jest@8.10.5

BDD-style executable stories for Jest with documentation generation

AI Security Review

scanned 17h ago · by lpm-firewall-ai

Source inspection found no install hook or concrete attack behavior. The flagged runtime writes are tied to story reporting, and the inspected entrypoints and callers show no credential export or automatic account changes.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A test or story initializes the reporter, which registers a process-exit handler.

Impact

The observed effect is local test-report generation; no unrelated account action or credential transfer was found.

Mechanism

The handler writes collected story data and attachments as JSON under the configured output directory.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes the library entrypoints and lists only build, type-check, and test scripts; it has no install lifecycle script.
The runtime collects story data and writes JSON files to the configured local output directory when the process exits.
Inspected runtime callers register this exit-time flush while initializing stories; they do not send credentials or perform automatic account actions.
The declared dependencies and inspected dependency sources fit the test-reporting and formatting functionality; no package install trigger or unrelated data transfer was identified.

Evidence against

Behavioral surface

Source

CryptoEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 92.0 KB of source

Source & flagged code

9 flagged

dist/index.jsView file

Lines 24-64javascript

24 registerAfterEach?.(() => {

25 flushPendingAssertions();

26 });

27} catch {

28}

29function flushPendingAssertions() {

30 const ctx = activeContext;

31 if (!ctx) return;

32 const step = ctx.pendingStep;

33 const before = ctx.pendingFrom;

34 ctx.pendingStep = null;

35 ctx.pendingFrom = void 0;

36 if (!step) return;

37 recordAssertions(step, before);

38}

39var featureRegistry = /* @__PURE__ */ new Map();

40var storyRegistry = globalThis.__jestExecutableStoriesRegistry ??= /* @__PURE__ */ new Map();

41var attachmentRegistry = /* @__PURE__ */ new Map();

42var otelSpansRegistry = /* @__PURE__ */ new Map();

43var exitHandlerRegistered = globalThis.__jestExecutableStoriesExitHandler ?? false;

44function getOutputDir() {

45 const baseDir = process.env.JEST_STORY_DOCS_DIR ?? ".jest-executable-stories";

46 return path.resolve(process.cwd(), baseDir);

47}

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L44

48function flushStories() {

49 if (storyRegistry.size === 0) return;

50 const workerId = process.env.JEST_WORKER_ID ?? "0";

51 const outputDir = path.join(getOutputDir(), `worker-${workerId}`);

52 fs.mkdirSync(outputDir, { recursive: true });

53 for (const [testFilePath, scenarios] of storyRegistry) {

54 if (!scenarios.length) continue;

55 const hash = createHash("sha1").update(testFilePath).digest("hex").slice(0, 12);

56 const baseName = testFilePath === "unknown" ? "unknown" : path.basename(testFilePath);

57 const outFile = path.join(outputDir, `${baseName}.${hash}.json`);

58 const fileAttachments = attachmentRegistry.get(testFilePath);

59 const fileOtelSpans = otelSpansRegistry.get(testFilePath);

60 const scenariosWithAttachments = scenarios.map((s, i) => ({

61 ...s,

62 _attachments: fileAttachments?.get(i) ?? [],

63 ...fileOtelSpans?.get(i) ? { _otelSpans: fileOtelSpans.get(i) } : {}

64 }));

dist/index.cjsView file

Lines 71-120javascript

71}

72function flushPendingAssertions() {

73 const ctx = activeContext;

74 if (!ctx) return;

75 const step

package.jsonView file

Lines 1-67json

2 "name": "executable-stories-jest",

3 "version": "8.10.5",

4 "license": "Apache-2.0",

5 "description": "BDD-style executable stories for Jest with documentation generation",

dist/setup.cjsView file

Lines 56-96javascript

56}

57function flushPendingAssertions() {

58 const ctx = activeContext;

59 if (!ctx) return;

60 const step

Source & flagged code

9 flagged · loading source

dist/index.jsView file

44function getOutputDir() { L45: const baseDir = process.env.JEST_STORY_DOCS_DIR ?? ".jest-executable-stories"; L46: return path.resolve(process.cwd(), baseDir); L47: } ... L155: if (docs.custom) { L156: entries.push({ kind: "custom", type: docs.custom.type, data: docs.custom.data, phase: "runtime" }); L157: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L44

dist/index.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = executable-stories-jest@8.9.2 matchedIdentity = npm:ZXhlY3V0YWJsZS1zdG9yaWVzLWplc3Q:8.9.2 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.cjsView on unpkg

91function flushStories() { if (storyRegistry.size === 0) return; const workerId = process.env.JEST_WORKER_ID ?? "0"; const outputDir = path.join(getOutputDir(), `worker-${work

Findings

1 High1 Medium10 Low

HighPrevious Version Dangerous Deltadist/index.cjs

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptodist/index.js

LowFilesystem

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Dependency Evidencepackage.json

LowAi Review Evidencedist/index.cjs

LowAi Review Evidencedist/setup.cjs

LowAi Review Evidencedist/index.cjs

Affected versions and remediation

This report applies to executable-stories-jest@8.10.5.

See all versions of executable-stories-jest for other recorded verdicts.

Review the evidence and your use of executable-stories-jest@8.10.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-23 10:22:46.136Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.