registry / samaro-uitest / 1.0.1

samaro-uitest@1.0.1

Comprehensive testing framework for Angular with Vitest, Playwright, and Allure reporting

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. Process execution and project writes are explicit testing/setup CLI features.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `samaro-init`, `samaro-test`, `samaro-allure`, or the Angular `ng add` schematic.

Impact

Creates or updates testing configuration and can run user-selected test/report commands in the current project.

Mechanism

User-invoked test framework setup, report generation, and configured application API helpers.

Rationale

The flagged primitives are aligned with an explicitly invoked Angular/Playwright/Allure testing toolkit. Static inspection found no install-time execution or concrete malicious chain.

Evidence

package.jsonbin/samaro-init.jsbin/samaro-allure.jsbin/samaro-test.jsschematics/ng-add/index.jsdist/helpers/api.js.gitignorevitest.config.tsplaywright.config.tsplaywright.component.config.tse2e/ct-tests/

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for block

`bin/samaro-allure.js` invokes `npx allure` through `execSync`, but only for explicit `generate`/`open` commands.
`bin/samaro-test.js` enables a shell for a user-supplied test command.

Evidence against

`package.json` has no preinstall, install, or postinstall hook; `prepublishOnly` only builds.
`bin/samaro-init.js` only writes test configs, test files, scripts, and `.gitignore` after explicit CLI use.
`schematics/ng-add/index.js` performs package setup only through explicit Angular `ng add`.
`dist/helpers/api.js` targets the configured application API, defaulting to localhost; no hard-coded third-party endpoint.
No credential harvesting, exfiltration, payload download, persistence, AI-agent mutation, eval, or binary loading was found.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 40.3 KB of source, external domains: github.com

Source & flagged code

4 flagged

dist/helpers/auth.jsView file

Lines 54-94javascript

54 await page.waitForURL('/settings', { timeout: 5000 });

55 }

56 else {

57 await page.goto('/settings');

58 }

59 const logoutButton = page.locator('button:has-text("logout"), button:has-text("Logout"), [data-testid="logout-button"]').first();

60 await Promise.all([

61 page.waitForURL('/', { timeout: 10000 }),

62 logoutButton.click()

63 ]);

64}

65/**

66 * Generate unique user credentials to avoid conflicts

67 */

68export function generateUniqueUser() {

69 const timestamp = Date.now();

70 const random = Math.random().toString(36).substring(2, 8);

71 return {

72 username: `testuser_${timestamp}_${random}`,

73 email: `test_${timestamp}_${random}@example.com`,

74 password: 'TestPassword123!',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/helpers/auth.jsView on unpkg · L74

75 };

76}

77/**

78 * Check if user is logged in

79 */

80export async function isLoggedIn(page) {

81 // Check for logout button or user-specific elements

82 const logoutVisible = await page.locator('a[href="/settings"], [data-testid="logout-button"]').isVisible().catch(() => false);

83 const loginVisible = await page.locator('a[href="/login"]').isVisible().catch(() => false);

84 return logoutVisible && !loginVisible;

85}

86/**

87 * Get current username if logged in

88 */

89export async function getCurrentUsername(page) {

90 const usernameElement = page.locator('[data-testid="username"], .user-name, .username').first();

91 if (await usernameElement.isVisible().catch(() => false)) {

92 return usernameElement.textContent();

93 }

94 return null;

bin/samaro-allure.jsView file

Lines 1-56javascript

1#!/usr/bin/env node

3import { execSync } from 'child_process';

4import fs from 'fs';

High

Child Process

Package source references child process execution.

bin/samaro-allure.jsView on unpkg · L2

5import path from 'path';

7const

README.mdView file

Lines 179-219markdown

179```typescript

180import { generateUniqueUser, register, login, logout } from 'samaro-uitest/helpers';

181

182const user = generateUniqueUser();

183await register(page, user.username, user.email, user.password);

184await logout(page);

185await login(page, user.email, user.password);

Source & flagged code

4 flagged · loading source

dist/helpers/auth.jsView file

74patternName = generic_password severity = medium line = 74 matchedText = password...3!',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/helpers/auth.jsView on unpkg · L74

bin/samaro-allure.jsView file

2L3: import { execSync } from 'child_process'; L4: import fs from 'fs';

High

Child Process

Package source references child process execution.

bin/samaro-allure.jsView on unpkg · L2

36try { L37: execSync(`npx allure generate "${resultsPath}" --output "${reportPath}" --clean`, { L38: stdio: 'pipe',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/samaro-allure.jsView on unpkg · L36

README.mdView file

199patternName = generic_password severity = medium line = 199 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L199

Findings

3 High3 Medium4 Low

HighChild Processbin/samaro-allure.js

HighShell

HighRuntime Package Installbin/samaro-allure.js

MediumSecret Patterndist/helpers/auth.js

MediumEnvironment Vars

MediumSecret PatternREADME.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

4 flagged

dist/helpers/auth.jsView file

Lines 54-94javascript

54 await page.waitForURL('/settings', { timeout: 5000 });

55 }

56 else {

57 await page.goto('/settings');

58 }

59 const logoutButton = page.locator('button:has-text("logout"), button:has-text("Logout"), [data-testid="logout-button"]').first();

60 await Promise.all([

61 page.waitForURL('/', { timeout: 10000 }),

62 logoutButton.click()

63 ]);

64}

65/**

66 * Generate unique user credentials to avoid conflicts

67 */

68export function generateUniqueUser() {

69 const timestamp = Date.now();

70 const random = Math.random().toString(36).substring(2, 8);

71 return {

72 username: `testuser_${timestamp}_${random}`,

73 email: `test_${timestamp}_${random}@example.com`,

74 password: 'TestPassword123!',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/helpers/auth.jsView on unpkg · L74

75 };

76}

77/**

78 * Check if user is logged in

79 */

80export async function isLoggedIn(page) {

81 // Check for logout button or user-specific elements

82 const logoutVisible = await page.locator('a[href="/settings"], [data-testid="logout-button"]').isVisible().catch(() => false);

83 const loginVisible = await page.locator('a[href="/login"]').isVisible().catch(() => false);

84 return logoutVisible && !loginVisible;

85}

86/**

87 * Get current username if logged in

88 */

89export async function getCurrentUsername(page) {

90 const usernameElement = page.locator('[data-testid="username"], .user-name, .username').first();

91 if (await usernameElement.isVisible().catch(() => false)) {

92 return usernameElement.textContent();

93 }

94 return null;

bin/samaro-allure.jsView file

Lines 1-56javascript

1#!/usr/bin/env node

3import { execSync } from 'child_process';

4import fs from 'fs';

High

Child Process

Package source references child process execution.

bin/samaro-allure.jsView on unpkg · L2

5import path from 'path';

7const

README.mdView file

Lines 179-219markdown

179```typescript

180import { generateUniqueUser, register, login, logout } from 'samaro-uitest/helpers';