Loading npm security reports…

ts-vitest@1.0.7: Clean npm security report (Allow) | LPM Firewall

registry / ts-vitest / 1.0.7

ts-vitest@1.0.7

A Jest transformer with source map support for TypeScript projects

AI Security Review

scanned 1h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The only filesystem mutation is an explicit CLI command that creates a non-overwriting `jest.config.js` template; runtime transformation reads TypeScript configuration and emits in-memory code.

Static reason

No blocking static signals were detected.

Trigger

User runs `ts-vitest config:init` or Jest invokes the transformer.

Impact

Explicit CLI use may create `jest.config.js`; no unconsented install-time or network behavior is present.

Mechanism

TypeScript-to-JavaScript Jest transformation plus opt-in config scaffolding.

Rationale

Direct inspection shows a conventional local TypeScript/Jest transformer and an opt-in configuration generator. No concrete malicious behavior or unresolved risky execution chain was found.

Evidence

package.jsondist/index.jsdist/preset.jsdist/transformer.jsdist/cli.jsREADME.mdjest.config.js

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/cli.js can write `jest.config.js`, but only after explicit `ts-vitest config:init` invocation.
package.json contains only a `prepublishOnly` verification hook; no install-time hook is declared.

Evidence against

package.json exposes a Jest/TypeScript transformer and CLI; no preinstall/install/postinstall scripts.
dist/index.js only exports `createTransformer`.
dist/transformer.js reads TypeScript configuration and transpiles supplied test source locally.
dist/cli.js writes a fixed Jest config only for explicit `config:init` and refuses overwrites.
No network, child-process, eval/vm, dynamic loading, credential harvesting, or persistence primitives found in distributed JavaScript.
README.md describes the same transformer and explicit config-init behavior.

Behavioral surface

Source

CryptoFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 9.10 KB of source

Source & flagged code

2 flagged

dist/cli.jsView file

•Published source reference

Low

Ai Review Evidence

dist/cli.js can write `jest.config.js`, but only after explicit `ts-vitest config:init` invocation.

dist/cli.jsView on unpkg

package.jsonView file

•Published source reference

Low

Ai Review Evidence

package.json contains only a `prepublishOnly` verification hook; no install-time hook is declared.

package.jsonView on unpkg

Source & flagged code

2 flagged · loading source

dist/cli.jsView file

•Published source reference

Low

Ai Review Evidence

dist/cli.js can write `jest.config.js`, but only after explicit `ts-vitest config:init` invocation.

dist/cli.jsView on unpkg

package.jsonView file

•Published source reference

Low

Ai Review Evidence

package.json contains only a `prepublishOnly` verification hook; no install-time hook is declared.

package.jsonView on unpkg

Findings

5 Low

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowAi Review Evidencedist/cli.js

LowAi Review Evidencepackage.json