registry / testomatio-reporter-cli / 2.9.5

testomatio-reporter-cli@2.9.5

Yarn Berry compatible standalone CLI for @testomatio/reporter

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 60 file(s), 415 KB of source, external domains: api.bitbucket.org, app.testomat.io, avatars.githubusercontent.com, bit.ly, bitbucket.org, github.com, gitlab.com, testomat.io

Source & flagged code

3 flagged

src/pipe/index.jsView file

Lines 10-50javascript

10import CoveragePipe from './coverage.js';

11import { BitbucketPipe } from './bitbucket.js';

12import { DebugPipe } from './debug.js';

13import { log } from '../utils/log.js';

Source & flagged code

3 flagged · loading source

src/pipe/index.jsView file

30try { L31: PipeClass = await import(pipeDef); L32: } catch (err) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/pipe/index.jsView on unpkg · L30

src/data-storage.jsView file

54if (!context) { L55: // debug(`No context provided for "${dataType}" data:`, data); L56: return; ... L195: const hash = md5.digest('hex'); L196: return `${process.env.runId || 'run'}_${hash}`; L197: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/data-storage.jsView on unpkg · L54

src/pipe/gitlab.jsView file

1import createDebugMessages from 'debug'; L2: import { Gaxios } from 'gaxios'; L3: import pc from 'picocolors'; ... L24: this.isEnabled = false; L25: this.ENV = process.env; L26: this.store = store; ... L30: this.description = params.description || process.env.TESTOMATIO_DESCRIPTION; L31: this.hiddenCommentData = ``; L32: ... L127: L128: if (t.artifacts && t.artifacts.length && !this.ENV.TESTOMATIO_PRIVATE_ARTIFACTS) { L129: t.artifacts

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/pipe/gitlab.jsView on unpkg · L1

Findings

1 High3 Medium5 Low

HighSandbox Evasion Gated Capabilitysrc/pipe/gitlab.js

MediumDynamic Requiresrc/pipe/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/data-storage.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

src/data-storage.jsView file

Lines 34-74javascript

34 * ! Also the class which will use data storage should be singleton (to avoid data loss).

35 */

36 constructor() {

37 // some frameworks use global variable to store data, some use file storage

38 this.isFileStorage = true;

39 }

41 /**

42 * Puts any data to storage (file or global variable).

43 * If file: stores data as text, if global variable – stores as array of data.

44 * @param {'log' | 'artifact' | 'keyvalue' | 'links'} dataType

45 * @param {*} data anything you want to store (string, object, array, etc)

46 * @param {*} context could be testId or any context (test name, suite name, including their IDs etc)

47 * suite name + test name is used by default

48 * @returns

49 */

50 putData(dataType, data, context = null) {

51 if (!dataType || !data) return;

53 context = context || this.context || testRunnerHelper.getNameOfCurrentlyRunningTest();

54 if (!context) {

55 // debug(`No context provided for "${dataType}" data:`, data);

56 return;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/data-storage.jsView on unpkg · L54

57 }

58 const contextHash = stringToMD5Hash(context);

60 if (this.isFileStorage) {

61 const dataDirPath = path.join(TESTOMAT_TMP_STORAGE_DIR, dataType);

62 fileSystem.createDir(dataDirPath);

63 this.#putDataToFile(dataType, data, contextHash);

64 } else {

65 this.#putDataToGlobalVar(dataType, data, contextHash);

66 }

67 }

69 /**

70 * Returns data, stored for specific test/context (or data which was stored without test id specified).

71 * This method will get data from global variable and/or from from file (previosly saved with put method).

72 *

73 * @param {'log' | 'artifact' | 'keyvalue' | 'links'} dataType

74 * @param {string} context

src/pipe/gitlab.jsView file

Lines 1-21javascript

1import createDebugMessages from 'debug';

2import { Gaxios } from 'gaxios';

3import pc from 'picocolors';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/pipe/gitlab.jsView on unpkg · L1

4import humanizeDuration from 'humanize-duration';

5import merge from 'lodash.merge';

6import path from 'path';

7import { APP_PREFIX, testomatLogoURL } from '../constants.js';

8import { ansiRegExp, isSameTest, truncate } from '../utils/utils.js';

9import { statusEmoji, fullName } from '../utils/pipe_utils.js';

10import { log } from '../utils/log.js';

12const debug = createDebugMessages('@testomatio/reporter:pipe:gitlab');

14//! GITLAB_PAT environment variable is required for this functionality to work

15//! and your pipeline trigger should be merge_request

17/**

18 * @class GitLabPipe

19 * @typedef {import('../../types/types.js').Pipe} Pipe

20 * @typedef {import('../../types/types.js').TestData} TestData

21 */