registry / obsidian-integration-testing / 7.0.0

obsidian-integration-testing@7.0.0

Simplifies integration testing of Obsidian plugins.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 95 file(s), 1.37 MB of source, external domains: github.com, obsidian.md, raw.githubusercontent.com, releases.obsidian.md

Source & flagged code

6 flagged

dist/lib/esm/obsidian-instance.mjsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { createServer } from "node:net";

High

Child Process

Package source references child process execution.

dist/lib/esm/obsidian-instance.mjsView on unpkg · L1

3import { killProcessTree } from "./kill-process-tree.mjs";

4import { log } from "./log.mjs";

5const DEFAULT_CDP_HOST = "127.0.0.1";

6const CDP_READY_POLL_INTERVAL_IN_MILLISECONDS = 1e3;

7const CDP_READY_TIMEOUT_IN_MILLISECONDS = 6e4;

8async function launchOwnedObsidianInstance(params) {

9 const cdpHost = params.cdpHost ?? DEFAULT_CDP_HOST;

10 const port = await pickFreePort();

11 const cdpUrl = `http://${cdpHost}:${String(port)}`;

12 log(`[obsidian-instance] Launching owned Obsidian: userData=${params.userDataDir}, cdpPort=${String(port)}`);

13 const child = spawn(

14 params.exePath,

15 [`--user-data-dir=${params.userDataDir}`, `--remote-debugging-port=${String(port)}`, ...params.extraArgs ?? []],

16 { detached: true, stdio: "ignore" }

17 );

18 child.unref();

19 try {

20 await waitForCdpReady(cdpUrl);

21 log(`[obsidian-instance] Owned Obsidian is serving CDP at ${cdpUrl}.`);

dist/lib/esm/exec.mjsView file

Lines 1-34javascript

1import { spawn } from "node:child_process";

2import process from "node:process";

3function exec(command, options = {}) {

4 if (Array.isArray(command)) {

5 const batchResult

dist/lib/esm/transport-factory.mjsView file

Lines 360-400javascript

360 try {

361 const [, deviceResult] = await Promise.all([

362 needsAppiumStart ? this.waitForAppiumReady(appiumUrl, appiumStartTimeoutInMilliseconds).then(() => {

363 this.log(

dist/obsidian-integration-testing-7.0.0.tgzView file

•path = dist/obsidian-integration-testing-7.0.0.tgz kind = high_entropy_blob sizeBytes = 539805 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/obsidian-integration-testing-7.0.0.tgzView on unpkg

•path = dist/obsidian-integration-testing-7.0.0.tgz kind = compressed_blob sizeBytes = 539805 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/obsidian-integration-testing-7.0.0.tgzView on unpkg

•path = dist/obsidian-integration-testing-7.0.0.tgz kind = nested_archive_needs_inspection sizeBytes = 539805 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/obsidian-integration-testing-7.0.0.tgzView on unpkg

Source & flagged code

6 flagged · loading source

dist/lib/esm/obsidian-instance.mjsView file

1import { spawn } from "node:child_process"; L2: import { createServer } from "node:net";

High

Child Process

Package source references child process execution.

dist/lib/esm/obsidian-instance.mjsView on unpkg · L1

dist/lib/esm/exec.mjsView file

14new Error( L15: `Command line is too long (${String(commandLine.length)} chars, max ${String(maxCommandLength2)} on ${process.platform}). Consider using ExecArg with batchedArgs.` L16: )

High

Shell

Package source references shell execution.

dist/lib/esm/exec.mjsView on unpkg · L14

dist/lib/esm/transport-factory.mjsView file

380startAppiumServer(port, isAppiumConsoleVisible) { L381: const child = spawn(`npx appium --log-timestamp --port ${String(port)} --allow-insecure=${CHROMEDRIVER_AUTODOWNLOAD_FEATURE}`, { L382: detached: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib/esm/transport-factory.mjsView on unpkg · L380

dist/obsidian-integration-testing-7.0.0.tgzView file

•path = dist/obsidian-integration-testing-7.0.0.tgz kind = high_entropy_blob sizeBytes = 539805 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/obsidian-integration-testing-7.0.0.tgzView on unpkg

•path = dist/obsidian-integration-testing-7.0.0.tgz kind = compressed_blob sizeBytes = 539805 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/obsidian-integration-testing-7.0.0.tgzView on unpkg

•path = dist/obsidian-integration-testing-7.0.0.tgz kind = nested_archive_needs_inspection sizeBytes = 539805 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/obsidian-integration-testing-7.0.0.tgzView on unpkg

Findings

4 High4 Medium6 Low

HighChild Processdist/lib/esm/obsidian-instance.mjs

HighShelldist/lib/esm/exec.mjs

HighRuntime Package Installdist/lib/esm/transport-factory.mjs

HighShips High Entropy Blobdist/obsidian-integration-testing-7.0.0.tgz

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobdist/obsidian-integration-testing-7.0.0.tgz

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiondist/obsidian-integration-testing-7.0.0.tgz

Source & flagged code

6 flagged

dist/lib/esm/obsidian-instance.mjsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { createServer } from "node:net";

High

Child Process

Package source references child process execution.

dist/lib/esm/obsidian-instance.mjsView on unpkg · L1

3import { killProcessTree } from "./kill-process-tree.mjs";

4import { log } from "./log.mjs";

5const DEFAULT_CDP_HOST = "127.0.0.1";

6const CDP_READY_POLL_INTERVAL_IN_MILLISECONDS = 1e3;

7const CDP_READY_TIMEOUT_IN_MILLISECONDS = 6e4;

8async function launchOwnedObsidianInstance(params) {

9 const cdpHost = params.cdpHost ?? DEFAULT_CDP_HOST;

10 const port = await pickFreePort();

11 const cdpUrl = `http://${cdpHost}:${String(port)}`;

12 log(`[obsidian-instance] Launching owned Obsidian: userData=${params.userDataDir}, cdpPort=${String(port)}`);

13 const child = spawn(

14 params.exePath,

15 [`--user-data-dir=${params.userDataDir}`, `--remote-debugging-port=${String(port)}`, ...params.extraArgs ?? []],

16 { detached: true, stdio: "ignore" }

17 );

18 child.unref();

19 try {

20 await waitForCdpReady(cdpUrl);

21 log(`[obsidian-instance] Owned Obsidian is serving CDP at ${cdpUrl}.`);

dist/lib/esm/exec.mjsView file

Lines 1-34javascript

1import { spawn } from "node:child_process";

2import process from "node:process";

3function exec(command, options = {}) {

4 if (Array.isArray(command)) {

5 const batchResult

dist/lib/esm/transport-factory.mjsView file

Lines 360-400javascript

360 try {

361 const [, deviceResult] = await Promise.all([

362 needsAppiumStart ? this.waitForAppiumReady(appiumUrl, appiumStartTimeoutInMilliseconds).then(() => {

363 this.log(

dist/obsidian-integration-testing-7.0.0.tgzView file

•path = dist/obsidian-integration-testing-7.0.0.tgz kind = high_entropy_blob sizeBytes = 539805 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/obsidian-integration-testing-7.0.0.tgzView on unpkg

•path = dist/obsidian-integration-testing-7.0.0.tgz kind = compressed_blob sizeBytes = 539805 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/obsidian-integration-testing-7.0.0.tgzView on unpkg

•path = dist/obsidian-integration-testing-7.0.0.tgz kind = nested_archive_needs_inspection sizeBytes = 539805 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/obsidian-integration-testing-7.0.0.tgzView on unpkg