registry / executable-stories-vitest / 8.11.3

executable-stories-vitest@8.11.3

TS-first story/given/when/then helpers for Vitest with Markdown user-story doc generation.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The manifest has no install hook, and the inspected runtime and required dependency files show library and formatting behavior. The reporter’s notification send is conditional on supplied notification options; no concrete attack behavior was found.

Static reason

No blocking static signals were detected.

Trigger

Importing the library exposes its story and reporter APIs; report notifications require notification options.

Impact

No malicious impact was established.

Mechanism

The inspected code handles story metadata, trace context, report formatting, and file globbing; it contains no confirmed covert collection or transfer behavior.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 89.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json points to library entrypoints and lists no install lifecycle hook; its scripts are build, type-check, lint, clean, test, and quality tasks.
The inspected core and fast-glob files provide trace-context lookup, documentation entry creation, assertion formatting, and file globbing; no attack behavior was identified in them.
The reporter calls the notification sender only when notification options are supplied.

Evidence against

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 100 KB of source

Source & flagged code

8 flagged

package.jsonView file

Lines 1-82json

2 "name": "executable-stories-vitest",

3 "version": "8.11.3",

4 "description": "TS-first story/given/when/then helpers for Vitest with Markdown user-story doc generation.",

5 "author": "Jag Reehal <jag@jagreehal.com>",

6 "homepage": "https://github.com/jagreehal/executable-stories#readme",

7 "bugs": {

8 "url": "https://github.com/jagreehal/executable-stories/issues"

9 },

10 "repository": {

11 "type": "git",

12 "url": "git+https://github.com/jagreehal/executable-stories.git",

13 "directory": "packages/executable-stories-vitest"

14 },

15 "license": "Apache-2.0",

16 "type": "module",

17 "main": "./dist/index.cjs",

18 "module": "./dist/index.js",

19 "types": "./dist/index.d.ts",

20 "sideEffects": false,

21 "exports": {

22 ".": {

23 "types": "./dist/index.d.ts",

Low

Suspicious Lifecycle Evidence

package.json points to library entrypoints and lists no install lifecycle hook; its scripts are build, type-check, lint, clean, test, and quality tasks.

package.jsonView on unpkg · L16

24 "import": "./dist/index.js",

25 "require": "./dist/index.cjs"

26 },

27 "./reporter": {

28 "types": "./dist/reporter.d.ts",

29 "import": "./dist/reporter.js",

30 "require": "./dist/reporter.cjs"

31 },

32 "./otel": {

33 "types": "./dist/otel.d.ts",

34 "import": "./dist/otel.js",

35 "require": "./dist/otel.cjs"

36 }

37 },

38 "files": [

39 "dist",

40 "skills",

41 "README.md"

42 ],

43 "peerDependencies": {

44 "vitest": ">=4.1.5"

45 },

46 "dependencies": {

47 "fast-glob": "^3.3.3",

48 "picomatch": "^4.0.7",

49 "executable-stories-core": "0.30.0",

50 "executable-stories-formatters": "1.29.0"

51 },

52 "devDependencies": {

53 "@opentelemetry/api": "^1.9.1",

Low

Suspicious Lifecycle Evidence

package.json points to library entrypoints and lists no install lifecycle hook; its scripts are build, type-check, lint, clean, test, and quality tasks.

package.jsonView on unpkg · L43

54 "@opentelemetry/sdk-trace-base": "^2.11.0",

55 "@types/node": "^26.6.1",

56 "@types/picomatch": "^4.0.3",

57 "tsup": "^8.5.1",

58 "typescript": "~6.0.3",

59 "vitest": "^5.0.1",

60 "eslint-config-executable-stories": "0.2.0"

61 },

62 "keywords": [

63 "vitest",

64 "bdd",

65 "gherkin",

66 "user-story",

67 "markdown",

68 "confluence",

69 "scenario",

70 "given",

71 "when",

72 "then"

73 ],

74 "scripts": {

75 "build": "tsup && node scripts/verify-dist.mjs",

76 "type-check": "tsc --noEmit",

77 "lint": "eslint .",

78 "clean": "rm -rf dist",

79 "test": "vitest run",

80 "quality": "pnpm type-check && pnpm test && pnpm lint"

Low

Suspicious Lifecycle Evidence

package.json points to library entrypoints and lists no install lifecycle hook; its scripts are build, type-check, lint, clean, test, and quality tasks.

package.jsonView on unpkg · L74

81 }

82}

.lpm-dependency-evidence-9821219e-67a2-4164-96ec-816dc6e0509e/1/npm-linux/dist/index.cjsView file

30// src/index.ts var src_exports = {}; __export(src_exports, { AgentTextFormatter: () => AgentTextFormatter, AstroFormatter: () => AstroFormatter, BehaviorManifestJsonFormatte

Low

Ai Review Evidence

The inspected core and fast-glob files provide trace-context lookup, documentation entry creation, assertion formatting, and file globbing; no attack behavior was identified in them.

.lpm-dependency-evidence-9821219e-67a2-4164-96ec-816dc6e0509e/1/npm-linux/dist/index.cjsView on unpkg · L30

.lpm-dependency-evidence-9821219e-67a2-4164-96ec-816dc6e0509e/1/npm-linux/dist/index.jsView file

1// src/index.ts import * as path14 from "path"; import * as fsPromises3 from "fs/promises"; import { canonicalizeRun as canonicalizeRun2 } from "executable-stories-core/converters/

Low

Ai Review Evidence

The inspected core and fast-glob files provide trace-context lookup, documentation entry creation, assertion formatting, and file globbing; no attack behavior was identified in them.

.lpm-dependency-evidence-9821219e-67a2-4164-96ec-816dc6e0509e/1/npm-linux/dist/index.jsView on unpkg · L1

.lpm-dependency-evidence-9821219e-67a2-4164-96ec-816dc6e0509e/1/npm-linux/dist/cli.jsView file

1#!/usr/bin/env node // src/cli.ts import * as fs19 from "fs"; import { execFile } from "child_process"; import * as path25 from "path"; import { parseArgs as parseArgs5 } from "util"; import { canoni

Low

Ai Review Evidence

The inspected core and fast-glob files provide trace-context lookup, documentation entry creation, assertion formatting, and file globbing; no attack behavior was identified in them.

.lpm-dependency-evidence-9821219e-67a2-4164-96ec-816dc6e0509e/1/npm-linux/dist/cli.jsView on unpkg · L1

.lpm-dependency-evidence-9821219e-67a2-4164-96ec-816dc6e0509e/0/npm-linux/package.jsonView file

1{ "name": "executable-stories-core", "version": "0.30.0", "license": "Apache-2.0", "repository": { "type": "git", "url": "git+https://github.com/jagreehal/executable-stories.git",

Low

Ai Review Evidence

The inspected core and fast-glob files provide trace-context lookup, documentation entry creation, assertion formatting, and file globbing; no attack behavior was identified in them.

.lpm-dependency-evidence-9821219e-67a2-4164-96ec-816dc6e0509e/0/npm-linux/package.jsonView on unpkg · L1

.lpm-dependency-evidence-9821219e-67a2-4164-96ec-816dc6e0509e/0/npm-linux/dist/utils/otel-detect.cjsView file

32function tryGetActiveOtelContext() { try { const api = getRequire()("@opentelemetry/api"); const span = api.trace?.getActiveSpan?.(); if (!span) return void 0; const ctx = span.spanContext?.(); if (!ctx?.traceId || ctx.traceId === "000000

Low

Ai Review Evidence

The inspected core and fast-glob files provide trace-context lookup, documentation entry creation, assertion formatting, and file globbing; no attack behavior was identified in them.

.lpm-dependency-evidence-9821219e-67a2-4164-96ec-816dc6e0509e/0/npm-linux/dist/utils/otel-detect.cjsView on unpkg · L32

Source & flagged code

8 flagged · loading source

package.jsonView file

16"type": "module", "main": "./dist/index.cjs", "module": "./dist/index.js", "types": "./dist/index.d.ts", "sideEffects": false, "exports": { ".": { "types": ".

Low

Suspicious Lifecycle Evidence

package.json points to library entrypoints and lists no install lifecycle hook; its scripts are build, type-check, lint, clean, test, and quality tasks.

package.jsonView on unpkg · L16

43"peerDependencies": { "vitest": ">=4.1.5" }, "dependencies": { "fast-glob": "^3.3.3", "picomatch": "^4.0.7", "executable-stories-core": "0.30.0", "executable-stories-formatters": "1.29.0" }, "devDependencies": { "@opentelemetr

Low

Suspicious Lifecycle Evidence

package.json points to library entrypoints and lists no install lifecycle hook; its scripts are build, type-check, lint, clean, test, and quality tasks.

package.jsonView on unpkg · L43

74"scripts": { "build": "tsup && node scripts/verify-dist.mjs", "type-check": "tsc --noEmit", "lint": "eslint .", "clean": "rm -rf dist", "test": "vitest run", "quali

Low

Suspicious Lifecycle Evidence

package.json points to library entrypoints and lists no install lifecycle hook; its scripts are build, type-check, lint, clean, test, and quality tasks.

Findings

1 Medium10 Low

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidence.lpm-dependency-evidence-9821219e-67a2-4164-96ec-816dc6e0509e/1/npm-linux/dist/index.cjs

LowAi Review Evidence.lpm-dependency-evidence-9821219e-67a2-4164-96ec-816dc6e0509e/1/npm-linux/dist/index.js

LowAi Review Evidence.lpm-dependency-evidence-9821219e-67a2-4164-96ec-816dc6e0509e/1/npm-linux/dist/cli.js

LowAi Review Evidence.lpm-dependency-evidence-9821219e-67a2-4164-96ec-816dc6e0509e/0/npm-linux/package.json

LowAi Review Evidence.lpm-dependency-evidence-9821219e-67a2-4164-96ec-816dc6e0509e/0/npm-linux/dist/utils/otel-detect.cjs

Affected versions and remediation

This report applies to executable-stories-vitest@8.11.3.

See all versions of executable-stories-vitest for other recorded verdicts.

Review the evidence and your use of executable-stories-vitest@8.11.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 18:46:30.890Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.