registry / super-api-tester / 1.6.6

super-api-tester@1.6.6

A high-performance, schema-driven API automation framework.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious install-time behavior was found, but the CLI provides a dangerous user-invoked AI code generation and execution path. The `init` command also mutates the current project and installs dependencies at runtime.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `super-api-tester --ai ...` or `super-api-tester init`.

Impact

User-supplied docs/prompts may be sent to Google Gemini, and generated code can execute in the project test process with local filesystem access.

Mechanism

remote AI-generated code written locally and executed via Vitest; runtime npm install during init

Attack narrative

The package does not auto-execute on install or import. Risk is concentrated in documented CLI flows: `--ai` posts prompt/doc context to Gemini, saves the model response as a test file, then executes it with Vitest; `init` rewrites project setup and runs npm install. This is a dangerous capability but appears user-invoked and package-aligned rather than a covert malware payload.

Rationale

Static inspection found no concrete malicious behavior, but the package intentionally executes remotely generated code in the user workspace and performs runtime package installation. That warrants a warning rather than a publish block.

Evidence

package.jsonbin/cli.jsbin/aiGenerator.jsreadme.mddist/index.jsdist/client.jstest/test.spec.jstest/ai-generated-*.spec.tsD:/dash/test-results.json

Network endpoints2

generativelanguage.googleapis.com/v1beta/models/${modelName}:generateContentpetstore.swagger.io/v2

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for block

bin/cli.js exposes a bin command that runs AI-generated test files with `npx vitest run` when user passes `--ai`.
bin/aiGenerator.js sends user prompt and optional API doc contents to Google Gemini, then writes returned code into `test/ai-generated-*.spec.ts`.
bin/aiGenerator.js instructs generated tests to write `D:/dash/test-results.json`, and README advertises this dashboard write.
bin/cli.js `init` mutates the caller workspace and runs `npm install super-api-tester vitest --save-dev` at runtime.

Evidence against

package.json has no install/postinstall/preinstall hook; `prepublishOnly` only runs build for publishers.
Main/module dist entrypoints implement API testing clients and only perform caller-requested HTTP requests.
No evidence of credential harvesting beyond requiring user-provided `GEMINI_API_KEY` for the documented Gemini API call.
No hidden persistence, destructive behavior, obfuscation, or AI-agent control-surface writes found.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 2.38 MB of source, external domains: api.restful-api.dev, generativelanguage.googleapis.com, github.com, petstore.swagger.io, vitest.dev

Source & flagged code

4 flagged

bin/cli.jsView file

Lines 1-67javascript

1#!/usr/bin/env node

3import fs from 'fs';

4import path from 'path';

5import { exec, execSync } from 'child_process';

6import { generateAndRunAiTest } from './aiGenerator.js';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L4

8const args = process.argv.slice(2);

9const command = args[0];

11// Extract parameters for the AI pipeline

12const aiIndex = args.indexOf('--ai');

13const docIndex = args.indexOf('--doc');

14const reqIndex = args.indexOf('--req');

16// 🛠️ ROUTING MECHANISM

17if (command === 'init') {

18 initializeProject();

19} else if (aiIndex !== -1) {

20 handleAiPipeline();

21} else {

22 printHelpMenu();

23}

27 */

28function handleAiPipeline() {

29 const userPrompt = args[aiIndex + 1];

30 const apiDocPath = docIndex !== -1 ? args[docIndex + 1] : null;

31 const targetRequest = reqIndex !== -1 ? args[reqIndex + 1] : "General API check";

33 if (!userPrompt) {

34 console.error("❌ Error: Please provide a description after the --ai parameter.");

35 process.exit(1);

36 }

38 console.log("\n========================================================");

39 console.log("🚀 STARTING AUTONOMOUS GEMINI AI TEST PIPELINE");

40 console.log("========================================================\n");

42 generateAndRunAiTest(userPrompt, apiDocPath, targetRequest)

43 .then((generatedFilePath) => {

44 console.log(`\n🏃 Running Vitest on: [ ${generatedFilePath} ]...\n`);

46 // Normalize path formatting for Windows/Vitest compatibility

47 const normalizedPath = generatedFilePath.replace(/\\/g, '/');

48 const runCommand = `npx vitest run "${normalizedPath}"`;

50 const child = exec(runCommand, (error, stdout, stderr) => {

51 console.log(stdout);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L47

53 if (error) {

54 console.error("\n❌ Generated test failed execution checks:");

55 console.error(stderr || "Check the output logs above.");

56 process.exit(1);

57 }

59 console.log("\n========================================================");

60 console.log("✅ SUCCESS: Gemini AI Generated Test Passed and Synchronized!");

61 console.log("========================================================\n");

62 process.exit(0);

63 });

65 // Stream live terminal output as it processes

66 child.stdout.on('data', (data) => process.stdout.write(data));

67 child.stderr.on('data', (data) => process.stderr.write(data));

•matchType = previous_version_dangerous_delta matchedPackage = super-api-tester@1.6.5 matchedIdentity = npm:c3VwZXItYXBpLXRlc3Rlcg:1.6.5 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.jsView on unpkg

dist/client.jsView file

13915snapshotContents = content; L13916: const populate = new Function("exports", snapshotContents); L13917: populate(data);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client.jsView on unpkg · L13915

Source & flagged code

4 flagged · loading source

bin/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.jsView on unpkg

4import path from 'path'; L5: import { exec, execSync } from 'child_process'; L6: import { generateAndRunAiTest } from './aiGenerator.js';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L4

47const normalizedPath = generatedFilePath.replace(/\\/g, '/'); L48: const runCommand = `npx vitest run "${normalizedPath}"`; L49: L50: const child = exec(runCommand, (error, stdout, stderr) => { L51: console.log(stdout);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L47

dist/client.jsView file

13915snapshotContents = content; L13916: const populate = new Function("exports", snapshotContents); L13917: populate(data);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client.jsView on unpkg · L13915

Findings

1 Critical3 High3 Medium6 Low

CriticalPrevious Version Dangerous Deltabin/cli.js

HighChild Processbin/cli.js

HighShell

HighRuntime Package Installbin/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/client.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

bin/cli.jsView file

Lines 1-67javascript

1#!/usr/bin/env node

3import fs from 'fs';

4import path from 'path';

5import { exec, execSync } from 'child_process';

6import { generateAndRunAiTest } from './aiGenerator.js';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L4

8const args = process.argv.slice(2);

9const command = args[0];

11// Extract parameters for the AI pipeline

12const aiIndex = args.indexOf('--ai');

13const docIndex = args.indexOf('--doc');

14const reqIndex = args.indexOf('--req');

16// 🛠️ ROUTING MECHANISM

17if (command === 'init') {

18 initializeProject();

19} else if (aiIndex !== -1) {

20 handleAiPipeline();

21} else {

22 printHelpMenu();

23}

27 */

28function handleAiPipeline() {

29 const userPrompt = args[aiIndex + 1];

30 const apiDocPath = docIndex !== -1 ? args[docIndex + 1] : null;

31 const targetRequest = reqIndex !== -1 ? args[reqIndex + 1] : "General API check";

33 if (!userPrompt) {

34 console.error("❌ Error: Please provide a description after the --ai parameter.");

35 process.exit(1);

36 }

38 console.log("\n========================================================");

39 console.log("🚀 STARTING AUTONOMOUS GEMINI AI TEST PIPELINE");

40 console.log("========================================================\n");

42 generateAndRunAiTest(userPrompt, apiDocPath, targetRequest)

43 .then((generatedFilePath) => {

44 console.log(`\n🏃 Running Vitest on: [ ${generatedFilePath} ]...\n`);

46 // Normalize path formatting for Windows/Vitest compatibility

47 const normalizedPath = generatedFilePath.replace(/\\/g, '/');

48 const runCommand = `npx vitest run "${normalizedPath}"`;

50 const child = exec(runCommand, (error, stdout, stderr) => {

51 console.log(stdout);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L47

53 if (error) {

54 console.error("\n❌ Generated test failed execution checks:");

55 console.error(stderr || "Check the output logs above.");

56 process.exit(1);

57 }

59 console.log("\n========================================================");

60 console.log("✅ SUCCESS: Gemini AI Generated Test Passed and Synchronized!");

61 console.log("========================================================\n");

62 process.exit(0);

63 });

65 // Stream live terminal output as it processes

66 child.stdout.on('data', (data) => process.stdout.write(data));

67 child.stderr.on('data', (data) => process.stderr.write(data));

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.jsView on unpkg

dist/client.jsView file

13915snapshotContents = content; L13916: const populate = new Function("exports", snapshotContents); L13917: populate(data);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client.jsView on unpkg · L13915