registry / executable-stories-react / 0.17.0

executable-stories-react@0.17.0

React components for rendering executable-stories StoryReport JSON. Semantic, SSR-safe, themeable via CSS variables.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 6 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequire

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 1.28 MB of source, external domains: cdn.jsdelivr.net, cdnjs.cloudflare.com, executable-stories.dev, executablestories.com, github.com, json-schema.org, react.dev, www.w3.org

Source & flagged code

2 flagged

dist/parse.cjsView file

Lines 15-55javascript

15 }

16 return to;

17};

18var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

20// src/parse-entry.ts

21var parse_entry_exports = {};

22__export(parse_entry_exports, {

23 STORY_REPORT_SCHEMA_MAJOR: () => STORY_REPORT_SCHEMA_MAJOR,

24 err: () => err,

25 ok: () => ok,

26 parseStoryReport: () => parseStoryReport,

27 storyReportSchema: () => storyReportSchema

28});

29module.exports = __toCommonJS(parse_entry_exports);

31// src/result.ts

32var ok = (data) => ({ ok: true, data });

33var err = (error) => ({ ok: false, error });

35// src/schema/story-report.schema.ts

36var import_zod = require("zod");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/parse.cjsView on unpkg · L35

38// ../executable-stories-core/schemas/story-report-v1.json

39var story_report_v1_default = {

40 $schema: "https://json-schema.org/draft/2020-12/schema",

41 $id: "https://executable-stories.dev/schemas/story-report-v1.schema.json",

42 title: "StoryReport",

43 description: "Pre-grouped, denormalized report shape consumed by UI renderers (React, Svelte, Vue, etc.). Stable public contract \u2014 additive-only within a major. Distinct from internal TestRunResult.",

44 type: "object",

45 $ref: "#/$defs/StoryReport",

46 $defs: {

47 StoryReport: {

48 type: "object",

49 description: "Top-level report containing all features, runtime metadata, and a pre-computed summary.",

50 properties: {

51 schemaVersion: {

52 type: "string",

53 pattern: "^1\\.[0-9]+$",

54 description: "Schema version as 'major.minor'. Major bumps are breaking; minors are additive-only. UI packages must accept any 1.x."

55 },

dist/styles.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/styles.cssView on unpkg

Source & flagged code

2 flagged · loading source

dist/parse.cjsView file

35// src/schema/story-report.schema.ts L36: var import_zod = require("zod"); L37:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/parse.cjsView on unpkg · L35

dist/styles.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/styles.cssView on unpkg

Findings

1 High2 Medium3 Low

HighSemantic Analysis Limiteddist/styles.css

MediumDynamic Requiredist/parse.cjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to executable-stories-react@0.17.0.

See all versions of executable-stories-react for other recorded verdicts.

Review the evidence and your use of executable-stories-react@0.17.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-11 06:26:22.291Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.