Loading npm security reports…

ts-vitest@1.0.8: Clean npm security report (Allow) | LPM Firewall

registry / ts-vitest / 1.0.8

ts-vitest@1.0.8

A Jest transformer with source map support for TypeScript projects

AI Security Review

scanned 1h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The only project write is an explicit CLI command that creates a Jest configuration file.

Static reason

No blocking static signals were detected.

Trigger

User runs ts-vitest config:init or Jest invokes the transformer.

Impact

config:init may create ./jest.config.js when it does not already exist; transformer reads the selected tsconfig and supplied test source.

Mechanism

TypeScript/Jest transformation plus opt-in config scaffolding.

Rationale

Source inspection shows a conventional TypeScript Jest transformer and an explicit, guarded config generator. No install-time execution or concrete exfiltration, persistence, remote execution, or destructive behavior is present.

Evidence

package.jsondist/index.jsdist/transformer.jsdist/cli.jsdist/preset.jsREADME.md./jest.config.jstsconfig.json

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/cli.js writes jest.config.js, but only for explicit config:init.
dist/transformer.js reads tsconfig.json and transpiles Jest-provided source.

Evidence against

package.json has no preinstall, install, postinstall, or prepare hook.
dist/index.js only exports the local transformer.
No network, shell, eval/vm, environment harvesting, or binary-loading code found.
dist/cli.js refuses to overwrite an existing jest.config.js.

Behavioral surface

Source

CryptoFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 9.10 KB of source

Source & flagged code

2 flagged

dist/cli.jsView file

•Published source reference

Low

Ai Review Evidence

dist/cli.js writes jest.config.js, but only for explicit config:init.

dist/cli.jsView on unpkg

dist/transformer.jsView file

•Published source reference

Low

Ai Review Evidence

dist/transformer.js reads tsconfig.json and transpiles Jest-provided source.

dist/transformer.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/cli.jsView file

•Published source reference

Low

Ai Review Evidence

dist/cli.js writes jest.config.js, but only for explicit config:init.

dist/cli.jsView on unpkg

dist/transformer.jsView file

•Published source reference

Low

Ai Review Evidence

dist/transformer.js reads tsconfig.json and transpiles Jest-provided source.

dist/transformer.jsView on unpkg

Findings

5 Low

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowAi Review Evidencedist/cli.js

LowAi Review Evidencedist/transformer.js