registry / super-api-tester / 1.6.8

super-api-tester@1.6.8

A high-performance, schema-driven API automation framework.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 2.39 MB of source, external domains: api.example.com, api.restful-api.dev, generativelanguage.googleapis.com, github.com, vitest.dev

Source & flagged code

3 flagged

bin/cli.jsView file

Lines 1-22javascript

1import fs from 'fs';

2import path from 'path';

3import { exec, execSync } from 'child_process';

4import { generateAndRunAiTest } from './aiGenerator.js';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

5import { healTestScript } from './aiHealer.js';

6import { startMockServer } from './aiMockServer.js';

8const args = process.argv.slice(2);

9const command = args[0];

11const aiIndex = args.indexOf('--ai');

12const docIndex = args.indexOf('--doc');

13const reqIndex = args.indexOf('--req');

15// 🛠️ CENTRAL MATRIX DISTRIBUTION ROUTER

16if (command === 'init') {

17 initializeProject();

18} else if (command === 'mock') {

19 // 📡 Launch dynamic AI mock simulation background loop

20 const docPath = docIndex !== -1 ? args[docIndex + 1] : './swagger.json';

21 startMockServer(docPath).catch((err) => {

22 console.error("\n❌ Critical: Mock server initialization crashed!");

Lines 65-105javascript

65 })

66 .catch((err) => {

67 console.error("\n❌ Process Interrupted:", err.message);

68 process.exit(1);

69 });

70}

72/**

73 * Contract validation check scanner execution entrypoint

74 */

dist/client.jsView file

13915snapshotContents = content; L13916: const populate = new Function("exports", snapshotContents); L13917: populate(data);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client.jsView on unpkg · L13915

Source & flagged code

3 flagged · loading source

bin/cli.jsView file

2import path from 'path'; L3: import { exec, execSync } from 'child_process'; L4: import { generateAndRunAiTest } from './aiGenerator.js';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

85function executeTestDirectory() { L86: const runCommand = `npx vitest run test/ --reporter=verbose`; L87: L88: const child = exec(runCommand, async (error, stdout, stderr) => { L89: const fullLog = stdout + '\n' + stderr;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L85

dist/client.jsView file

13915snapshotContents = content; L13916: const populate = new Function("exports", snapshotContents); L13917: populate(data);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client.jsView on unpkg · L13915

Findings

3 High3 Medium6 Low

HighChild Processbin/cli.js

HighShell

HighRuntime Package Installbin/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/client.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

bin/cli.jsView file

Lines 1-22javascript

1import fs from 'fs';

2import path from 'path';

3import { exec, execSync } from 'child_process';

4import { generateAndRunAiTest } from './aiGenerator.js';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

5import { healTestScript } from './aiHealer.js';

6import { startMockServer } from './aiMockServer.js';

8const args = process.argv.slice(2);

9const command = args[0];

11const aiIndex = args.indexOf('--ai');

12const docIndex = args.indexOf('--doc');

13const reqIndex = args.indexOf('--req');

15// 🛠️ CENTRAL MATRIX DISTRIBUTION ROUTER

16if (command === 'init') {

17 initializeProject();

18} else if (command === 'mock') {

19 // 📡 Launch dynamic AI mock simulation background loop

20 const docPath = docIndex !== -1 ? args[docIndex + 1] : './swagger.json';

21 startMockServer(docPath).catch((err) => {

22 console.error("\n❌ Critical: Mock server initialization crashed!");

Lines 65-105javascript

65 })

66 .catch((err) => {

67 console.error("\n❌ Process Interrupted:", err.message);

68 process.exit(1);

69 });

70}

72/**

73 * Contract validation check scanner execution entrypoint

74 */

dist/client.jsView file

13915snapshotContents = content; L13916: const populate = new Function("exports", snapshotContents); L13917: populate(data);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client.jsView on unpkg · L13915