registry / testaro / 75.2.2

testaro@75.2.2

Run 1300 web accessibility tests from 10 tools and get a standardized report

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

WildcardDependency

scanned 98 file(s), 1.13 MB of source, external domains: accessibility.princeton.edu, cdn.jsdelivr.net, docs.google, fontawesome.com, github.com, itmaybejj.github.io, squizlabs.github.io, support.google.com, support.microsoft.com, validator.w3.org, webaim.org, www.google.com, www.w3.org

Source & flagged code

3 flagged

procs/testaro.jsView file

Lines 26-66javascript

26 withItems,

27 ruleID,

28 candidateSelector,

29 whats,

30 severity,

31 getBadWhatString

32) => {

33 const ruleData = await page.evaluate(async args => {

34 // Get the arguments.

35 const [

36 withItems,

37 candidateSelector,

38 severity,

39 getBadWhatString

40 ] = args;

41 // Get all violator candidates.

42 const candidates = document.querySelectorAll(candidateSelector);

43 let violationCount = 0;

44 // Initialize proto-instances.

45 const protoInstances = [];

46 // Parse the supplied string to get the classifier.

47 const getBadWhat = eval(`(${getBadWhatString})`);

48 // Initialize data on the rule.

Low

Eval

Package source references a known benign dynamic code generation pattern.

procs/testaro.jsView on unpkg · L46

49 let data = {};

50 const totals = [0, 0, 0, 0];

51 // For each candidate:

52 for (const candidate of candidates) {

53 // Classify it as and get a violation description if a violator or undefined if not.

54 const violationWhat = await getBadWhat(candidate);

55 // If the candidate violates the rule:

56 if (violationWhat) {

57 // Increment the violation count.

58 violationCount++;

59 let ruleWhat;

60 const violationType = typeof violationWhat;

61 // If data on the violation were provided (unusual):

62 if (violationType === 'object') {

63 // Get the description and add the data to the rule data.

64 ruleWhat = violationWhat.description;

65 data[violationCount - 1] = violationWhat.data;

66 }

validation/tests/targets/nonTable/gong.m4aView file

•path = [redacted].m4a kind = high_entropy_blob sizeBytes = 15075 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

validation/tests/targets/nonTable/gong.m4aView on unpkg

•path = [redacted].m4a kind = payload_in_excluded_dir sizeBytes = 15075 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

validation/tests/targets/nonTable/gong.m4aView on unpkg

Source & flagged code

3 flagged · loading source

procs/testaro.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code