registry / tapsmith / 0.3.3

tapsmith@0.3.3

Mobile app testing framework — TypeScript SDK and test runner

Static Scan Results

scanned 18d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 126 file(s), 1.67 MB of source, external domains: 127.0.0.1, example.com, github.com, nodejs.org

Source & flagged code

5 flagged

dist/setup-ios-device.jsView file

Lines 1-39javascript

1/**

2 * `tapsmith setup-ios-device` — first-run preflight for physical iOS devices.

3 *

4 * Runs an idempotent ✓ / ✗ checklist of the tribal knowledge users would

5 * otherwise have to pick up from Stack Overflow and Apple's docs. Each

6 * failing row prints the exact command / action to fix it.

7 *

8 * The failure modes this catches:

9 * - Xcode command-line tools not installed

10 * - `xcrun devicectl` not available (Xcode < 15)

11 * - `libimobiledevice` (`iproxy`) not installed

12 * - No code signing identity in the user's keychain

13 * - No physical device connected / paired / trusted

14 * - Developer Mode disabled on the device

15 *

16 * Non-goals: this command does NOT modify system state — it only reads.

17 * The user is the one that runs brew install, opens Xcode to pair the

18 * device, or flips the Developer Mode toggle on the phone.

19 */

20import { execFileSync } from 'node:child_process';

21import * as fs from 'node:fs';

High

Child Process

Package source references child process execution.

dist/setup-ios-device.jsView on unpkg · L19

22import * as path from 'node:path';

23import { listPhysicalDevices } from './ios-devicectl.js';

24import { parseCodesignIdentities, readXcodeRegisteredTeams } from './build-ios-agent.js';

25import { getProfileExpiryInfo, formatExpiryWarning, EXPIRY_WARNING_DAYS } from './ios-profile-expiry.js';

26const DIM = '\x1b[2m';

27const BOLD = '\x1b[1m';

28const GREEN = '\x1b[32m';

29const YELLOW = '\x1b[33m';

30const RED = '\x1b[31m';

31const RESET = '\x1b[0m';

32const bold = (s) => `${BOLD}${s}${RESET}`;

33const dim = (s) => `${DIM}${s}${RESET}`;

34const green = (s) => `${GREEN}${s}${RESET}`;

35const yellow = (s) => `${YELLOW}${s}${RESET}`;

36const red = (s) => `${RED}${s}${RESET}`;

37/** Check Xcode command-line tools are installed. */

38export function checkXcodeCommandLineTools() {

39 try {

dist/reporter.jsView file

Lines 122-162javascript

122 }

123 if (typeof config === 'string') {

124 return [config];

125 }

126 // Check if it's a single tuple like ['json', { outputFile: '...' }]

127 if (isSingleTuple(config)) {

dist/ios-simulator.jsView file

Lines 1-31javascript

1/**

2 * iOS simulator management utilities.

3 *

4 * Parallel to `emulator.ts` for Android, this module wraps `xcrun simctl`

5 * commands for discovering, booting, and managing iOS simulators.

6 *

7 * All simctl calls are synchronous (`execFileSync`) because the parallel

8 * provisioning loop needs deterministic ordering — clone, boot, and health

9 * checks must complete in sequence per simulator. `Atomics.wait` is used for

10 * brief sleeps between retries since `setTimeout` requires an async context.

dist/verify-ios-network.jsView file

Lines 23-63javascript

23 * for one URL is faster than spinning up an agent session.

24 */

25import { spawn } from 'node:child_process';

26import * as fs from 'node:fs';

dist/ios-agent/create-xcode-project.shView file

•path = dist/ios-agent/create-xcode-project.sh kind = build_helper sizeBytes = 2156 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/ios-agent/create-xcode-project.shView on unpkg

Source & flagged code

5 flagged · loading source

dist/setup-ios-device.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code