tapsmith@0.4.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

tapsmith@0.4.0: Suspicious npm security report (Warn) | LPM Firewall

dist/create-avd.jsView file

Lines 6-79javascript

6 * (`google_apis_playstore`) images are production builds that block root, so

7 * Tapsmith can neither install its CA certificate nor set up the iptables

8 * redirect on them. Android Studio's Device Manager preselects Play images

9 * for most phone profiles, which silently degrades capture to plain HTTP.

10 *

11 * This wrapper downloads the right system image for the host architecture

12 * via `sdkmanager` (the user accepts Google's SDK license through their own

13 * SDK — the image cannot be redistributed) and creates the AVD via

14 * `avdmanager`, then prints a ready-to-paste config snippet.

15 *

16 * Android Studio installs the SDK *without* the command-line tools, so for

17 * most Studio users `sdkmanager`/`avdmanager` don't exist at all. Rather than

18 * bounce them to a download page, the command offers to bootstrap the

19 * cmdline-tools zip from Google's repository into `$ANDROID_HOME` itself

20 * (interactive consent, or `--install-tools` for scripts), and falls back to

21 * Android Studio's bundled JDK when no `java` is on PATH.

22 *

23 * Non-goals:

24 * - Installing the Android SDK itself (an SDK root must already exist).

25 * - Managing emulator snapshots or hardware profiles beyond `-d`.

26 */

27import { execFileSync, spawn } from 'node:child_process';

28import * as fs from 'node:fs';

29import * as os from 'node:os';

30import * as path from 'node:path';

31import { unzipSync } from 'fflate';

32import Enquirer from 'enquirer';

33import { scanAvdImageTags } from './doctor.js';

34const enquirer = new Enquirer();

35const DIM = '\x1b[2m';

36const BOLD = '\x1b[1m';

37const GREEN = '\x1b[32m';

38const RED = '\x1b[31m';

39const RESET = '\x1b[0m';

40const bold = (s) => `${BOLD}${s}${RESET}`;

41const dim = (s) => `${DIM}${s}${RESET}`;

42const green = (s) => `${GREEN}${s}${RESET}`;

43const red = (s) => `${RED}${s}${RESET}`;

44export const DEFAULT_API_LEVEL = 36;

45export const DEFAULT_DEVICE_PROFILE = 'medium_phone';

46/** Map the host architecture to the matching emulator image ABI. */

47export function defaultAbi(arch = process.arch) {

48 return arch === 'arm64' ? 'arm64-v8a' : 'x86_64';

49}

50export function defaultAvdName(api) {

51 return `Tapsmith_Phone_API_${api}`;

52}

53/** sdkmanager package path for the Google APIs (rootable) system image. */

54export function systemImagePackage(api, abi) {

55 return `system-images;android-${api};google_apis;${abi}`;

56}

57// avdmanager rejects names outside this set.

58const AVD_NAME_RE = /^[a-zA-Z0-9._-]+$/;

59// Real avdmanager device ids include spaces and parens ("Nexus 5",

60// "7in WSVGA (Tablet)"), so allow those — but nothing that cmd.exe or a

61// shell could interpret (the tools are spawned with shell:true on Windows).

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/create-avd.jsView on unpkg · L26

High

Shell

Package source references shell execution.

dist/create-avd.jsView on unpkg · L59

62const DEVICE_PROFILE_RE = /^[a-zA-Z0-9 ._()-]+$/;

63const ABI_RE = /^[a-zA-Z0-9._-]+$/;

64export function parseCreateAvdArgs(argv) {

65 let api = DEFAULT_API_LEVEL;

66 let name;

67 let device = DEFAULT_DEVICE_PROFILE;

68 let abi;

69 let force = false;

70 let installTools = false;

71 let help = false;

72 const take = (i, flag) => {

73 const value = argv[i];

74 if (value === undefined)

75 throw new Error(`Missing value for ${flag}`);

76 return value;

77 };

78 let i = 0;

79 while (i < argv.length) {

dist/verify-ios-network.jsView file

Lines 23-63javascript

23 * for one URL is faster than spinning up an agent session.

24 */

25import { spawn } from 'node:child_process';

26import * as fs from 'node:fs';

27import * as readline from 'node:readline';

28import { findDaemonBin } from './daemon-bin.js';

29import { TapsmithGrpcClient } from './grpc-client.js';

30import { pickFreePort } from './port-utils.js';

31import { readDeviceSidecar } from './ios-host-ip-check.js';

32const DIM = '\x1b[2m';

33const BOLD = '\x1b[1m';

34const GREEN = '\x1b[32m';

35const YELLOW = '\x1b[33m';

36const RED = '\x1b[31m';

37const RESET = '\x1b[0m';

38const bold = (s) => `${BOLD}${s}${RESET}`;

39const dim = (s) => `${DIM}${s}${RESET}`;

40const green = (s) => `${GREEN}${s}${RESET}`;

41const yellow = (s) => `${YELLOW}${s}${RESET}`;

42const red = (s) => `${RED}${s}${RESET}`;

43/** A known HTTPS endpoint with a small, predictable body. */

44const PROBE_URL = 'https://example.com/';

45// ─── Daemon lifecycle ───────────────────────────────────────────────────

46async function withDaemon(fn) {

47 const port = String(await pickFreePort());

48 const bin = findDaemonBin();

49 // Optional: redirect daemon stdout/stderr to a file when TAPSMITH_DAEMON_LOG

50 // is set. Matches the same env var honored by `tapsmith test` for walkthrough

51 // observability. Off by default.

52 let daemonStdio = 'ignore';

53 const daemonLogPath = process.env.TAPSMITH_DAEMON_LOG;

54 if (daemonLogPath) {

55 const fd = fs.openSync(daemonLogPath, 'a');

56 daemonStdio = ['ignore', fd, fd];

57 }

58 const child = spawn(bin, ['--port', port, '--platform', 'ios'], {

59 stdio: daemonStdio,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/verify-ios-network.jsView on unpkg · L43

60 });

61 child.unref();

62 const client = new TapsmithGrpcClient(`127.0.0.1:${port}`);

63 const ready = await client.waitForReady(5_000);