registry / executable-stories-react / 0.20.0

executable-stories-react@0.20.0

⚠ Under review

React components for rendering executable-stories StoryReport JSON. Semantic, SSR-safe, themeable via CSS variables.

Static Scan Results

scanned 25d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 6 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequire

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 1.34 MB of source, external domains: base-ui.com, cdn.jsdelivr.net, cdnjs.cloudflare.com, docs.executablestories.com, executable-stories.dev, github.com, json-schema.org, react.dev, www.w3.org

Source & flagged code

2 flagged

dist/parse.cjsView file

Lines 15-55javascript

15 }

16 return to;

17};

18var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

20// src/parse-entry.ts

21var parse_entry_exports = {};

22__export(parse_entry_exports, {

23 STORY_REPORT_SCHEMA_MAJOR: () => STORY_REPORT_SCHEMA_MAJOR,

24 err: () => err,

25 ok: () => ok,

26 parseStoryReport: () => parseStoryReport,

27 storyReportSchema: () => storyReportSchema

28});

29module.exports = __toCommonJS(parse_entry_exports);

31// src/result.ts

32var ok = (data) => ({ ok: true, data });

33var err = (error) => ({ ok: false, error });

35// src/schema/story-report.schema.ts

36var import_zod = require("zod");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/parse.cjsView on unpkg · L35

38// ../executable-stories-core/schemas/story-report-v1.json

39var story_report_v1_default = {

40 $schema: "https://json-schema.org/draft/2020-12/schema",

41 $id: "https://executable-stories.dev/schemas/story-report-v1.schema.json",

42 title: "StoryReport",

43 description: "Pre-grouped, denormalized report shape consumed by UI renderers (React, Svelte, Vue, etc.). Stable public contract \u2014 additive-only within a major. Distinct from internal TestRunResult.",

44 type: "object",

45 $ref: "#/$defs/StoryReport",

46 $defs: {

47 StoryReport: {

48 type: "object",

49 description: "Top-level report containing all features, runtime metadata, and a pre-computed summary.",

50 properties: {

51 schemaVersion: {

52 type: "string",

53 pattern: "^1\\.[0-9]+$",

54 description: "Schema version as 'major.minor'. Major bumps are breaking; minors are additive-only. UI packages must accept any 1.x."

55 },

dist/styles.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/styles.cssView on unpkg

Source & flagged code

2 flagged · loading source

dist/parse.cjsView file

35// src/schema/story-report.schema.ts L36: var import_zod = require("zod"); L37:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/parse.cjsView on unpkg · L35

dist/styles.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/styles.cssView on unpkg

Findings

1 High2 Medium3 Low

HighSemantic Analysis Limiteddist/styles.css

MediumDynamic Requiredist/parse.cjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to executable-stories-react@0.20.0.

See all versions of executable-stories-react for other recorded verdicts.

Review the evidence and your use of executable-stories-react@0.20.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-29 04:49:10.018Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.