registry / obsidian-integration-testing / 6.2.0

obsidian-integration-testing@6.2.0

Simplifies integration testing of Obsidian plugins.

AI Security Review

scanned 15h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Explicit CLI or test setup may provision and launch Obsidian, create a disposable vault, and connect to local CDP/Appium services for integration testing.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit CLI invocation or integration-test/global-setup runtime

Impact

Downloads a requested Obsidian release to temporary cache and runs it for tests; no stealth persistence, credential exfiltration, or foreign control-surface mutation found.

Mechanism

Obsidian integration-test provisioning and local automation

Rationale

The process, filesystem, environment, and network operations are package-aligned integration-test functionality activated by explicit runtime paths, not install-time behavior. Source inspection found no concrete malicious chain, exfiltration, dynamic code execution, or unconsented AI-agent control-surface mutation.

Evidence

package.jsonbin/obsidian-integration-testing.mjsdist/lib/esm/cli.mjsdist/lib/esm/global-setup-core.mjsdist/lib/esm/obsidian-installer.mjsdist/lib/esm/obsidian-instance.mjsdist/lib/esm/transport-factory.mjsdist/lib/esm/obsidian-version-switch.mjsdist/lib/esm/temp-vault.mjsdist/obsidian-integration-testing-6.2.0.tgz${tmpdir}/obsidian-integration-testing/shell-cache<projectRoot>/.env<projectRoot>/dist/dev<projectRoot>/dist/build<tempVault>/.obsidian/plugins/<pluginId><tempVault>/.obsidian/community-plugins.json

Network endpoints2

github.com/obsidianmd/obsidian-releases/releases/download/v${version}/${assetName}127.0.0.1:${port}

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/lib/esm/obsidian-installer.mjs` downloads and extracts an Obsidian shell when runtime test setup requests it.
`dist/lib/esm/obsidian-instance.mjs` launches the selected Obsidian executable with local CDP enabled.
`dist/lib/esm/global-setup-core.mjs` reads project `.env` and copies the project plugin build into a temporary test vault.

Evidence against

`package.json` has only `prepare`; its referenced `scripts/prepare.ts` is not shipped, while no `preinstall`/`install`/`postinstall` hook exists.
`bin/obsidian-integration-testing.mjs` invokes the explicit CLI entrypoint only.
`dist/lib/esm/obsidian-installer.mjs` uses the fixed Obsidian GitHub-release URL and caches under the system temp directory.
`dist/lib/esm/transport-factory.mjs` targets requested local Appium/CDP test services.
No `eval`, `Function`, or `node:vm` usage found in shipped ESM code.
`dist/obsidian-integration-testing-6.2.0.tgz` lists a duplicate package archive, not a hidden payload.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 93 file(s), 1.35 MB of source, external domains: github.com, obsidian.md, raw.githubusercontent.com, releases.obsidian.md

Source & flagged code

7 flagged

dist/lib/esm/obsidian-instance.mjsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { createServer } from "node:net";

High

Child Process

Package source references child process execution.

dist/lib/esm/obsidian-instance.mjsView on unpkg · L1

3import { killProcessTree } from "./kill-process-tree.mjs";

4import { log } from "./log.mjs";

5const DEFAULT_CDP_HOST = "127.0.0.1";

6const CDP_READY_POLL_INTERVAL_IN_MILLISECONDS = 1e3;

7const CDP_READY_TIMEOUT_IN_MILLISECONDS = 6e4;

8async function launchOwnedObsidianInstance(params) {

9 const cdpHost = params.cdpHost ?? DEFAULT_CDP_HOST;

10 const port = await pickFreePort();

11 const cdpUrl = `http://${cdpHost}:${String(port)}`;

12 log(`[obsidian-instance] Launching owned Obsidian: userData=${params.userDataDir}, cdpPort=${String(port)}`);

13 const child = spawn(

14 params.exePath,

15 [`--user-data-dir=${params.userDataDir}`, `--remote-debugging-port=${String(port)}`, ...params.extraArgs ?? []],

16 { detached: true, stdio: "ignore" }

17 );

18 child.unref();

19 try {

20 await waitForCdpReady(cdpUrl);

21 log(`[obsidian-instance] Owned Obsidian is serving CDP at ${cdpUrl}.`);

dist/lib/esm/exec.mjsView file

Lines 1-34javascript

1import { spawn } from "node:child_process";

2import process from "node:process";

3function exec(command, options = {}) {

4 if (Array.isArray(command)) {

5 const batchResult

dist/lib/esm/transport-factory.mjsView file

Lines 360-400javascript

360 try {

361 const [, deviceResult] = await Promise.all([

362 needsAppiumStart ? this.waitForAppiumReady(appiumUrl, appiumStartTimeoutInMilliseconds).then(() => {

363 this.log(

dist/obsidian-integration-testing-6.2.0.tgzView file

•path = dist/obsidian-integration-testing-6.2.0.tgz kind = high_entropy_blob sizeBytes = 529178 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/obsidian-integration-testing-6.2.0.tgzView on unpkg

•path = dist/obsidian-integration-testing-6.2.0.tgz kind = compressed_blob sizeBytes = 529178 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/obsidian-integration-testing-6.2.0.tgzView on unpkg

•path = dist/obsidian-integration-testing-6.2.0.tgz kind = nested_archive_needs_inspection sizeBytes = 529178 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/obsidian-integration-testing-6.2.0.tgzView on unpkg

dist/lib/cjs/transport-factory.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = obsidian-integration-testing@5.2.0 matchedIdentity = npm:[redacted]:5.2.0 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/cjs/transport-factory.cjsView on unpkg

Source & flagged code

7 flagged · loading source

dist/lib/esm/obsidian-instance.mjsView file

1import { spawn } from "node:child_process"; L2: import { createServer } from "node:net";

High

Child Process

Package source references child process execution.

dist/lib/esm/obsidian-instance.mjsView on unpkg · L1

dist/lib/esm/exec.mjsView file

14new Error( L15: `Command line is too long (${String(commandLine.length)} chars, max ${String(maxCommandLength2)} on ${process.platform}). Consider using ExecArg with batchedArgs.` L16: )

High

Shell

Package source references shell execution.

dist/lib/esm/exec.mjsView on unpkg · L14

dist/lib/esm/transport-factory.mjsView file

380startAppiumServer(port, isAppiumConsoleVisible) { L381: const child = spawn(`npx appium --log-timestamp --port ${String(port)} --allow-insecure=${CHROMEDRIVER_AUTODOWNLOAD_FEATURE}`, { L382: detached: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib/esm/transport-factory.mjsView on unpkg · L380

dist/obsidian-integration-testing-6.2.0.tgzView file

•path = dist/obsidian-integration-testing-6.2.0.tgz kind = high_entropy_blob sizeBytes = 529178 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/obsidian-integration-testing-6.2.0.tgzView on unpkg

•path = dist/obsidian-integration-testing-6.2.0.tgz kind = compressed_blob sizeBytes = 529178 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/obsidian-integration-testing-6.2.0.tgzView on unpkg

•path = dist/obsidian-integration-testing-6.2.0.tgz kind = nested_archive_needs_inspection sizeBytes = 529178 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/obsidian-integration-testing-6.2.0.tgzView on unpkg

dist/lib/cjs/transport-factory.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/cjs/transport-factory.cjsView on unpkg

Findings

1 Critical4 High4 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/lib/cjs/transport-factory.cjs

HighChild Processdist/lib/esm/obsidian-instance.mjs

HighShelldist/lib/esm/exec.mjs

HighRuntime Package Installdist/lib/esm/transport-factory.mjs

HighShips High Entropy Blobdist/obsidian-integration-testing-6.2.0.tgz

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobdist/obsidian-integration-testing-6.2.0.tgz

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiondist/obsidian-integration-testing-6.2.0.tgz

Source & flagged code

7 flagged

dist/lib/esm/obsidian-instance.mjsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { createServer } from "node:net";

High

Child Process

Package source references child process execution.

dist/lib/esm/obsidian-instance.mjsView on unpkg · L1

3import { killProcessTree } from "./kill-process-tree.mjs";

4import { log } from "./log.mjs";

5const DEFAULT_CDP_HOST = "127.0.0.1";

6const CDP_READY_POLL_INTERVAL_IN_MILLISECONDS = 1e3;

7const CDP_READY_TIMEOUT_IN_MILLISECONDS = 6e4;

8async function launchOwnedObsidianInstance(params) {

9 const cdpHost = params.cdpHost ?? DEFAULT_CDP_HOST;

10 const port = await pickFreePort();

11 const cdpUrl = `http://${cdpHost}:${String(port)}`;

12 log(`[obsidian-instance] Launching owned Obsidian: userData=${params.userDataDir}, cdpPort=${String(port)}`);

13 const child = spawn(

14 params.exePath,

15 [`--user-data-dir=${params.userDataDir}`, `--remote-debugging-port=${String(port)}`, ...params.extraArgs ?? []],

16 { detached: true, stdio: "ignore" }

17 );

18 child.unref();

19 try {

20 await waitForCdpReady(cdpUrl);

21 log(`[obsidian-instance] Owned Obsidian is serving CDP at ${cdpUrl}.`);

dist/lib/esm/exec.mjsView file

Lines 1-34javascript

1import { spawn } from "node:child_process";

2import process from "node:process";

3function exec(command, options = {}) {

4 if (Array.isArray(command)) {

5 const batchResult

dist/lib/esm/transport-factory.mjsView file

Lines 360-400javascript

360 try {

361 const [, deviceResult] = await Promise.all([

362 needsAppiumStart ? this.waitForAppiumReady(appiumUrl, appiumStartTimeoutInMilliseconds).then(() => {

363 this.log(

dist/obsidian-integration-testing-6.2.0.tgzView file

•path = dist/obsidian-integration-testing-6.2.0.tgz kind = high_entropy_blob sizeBytes = 529178 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/obsidian-integration-testing-6.2.0.tgzView on unpkg

•path = dist/obsidian-integration-testing-6.2.0.tgz kind = compressed_blob sizeBytes = 529178 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/obsidian-integration-testing-6.2.0.tgzView on unpkg

•path = dist/obsidian-integration-testing-6.2.0.tgz kind = nested_archive_needs_inspection sizeBytes = 529178 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/obsidian-integration-testing-6.2.0.tgzView on unpkg

dist/lib/cjs/transport-factory.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/cjs/transport-factory.cjsView on unpkg