ts-vitest@1.0.9

A Jest transformer with source map support for TypeScript projects

AI Security Review

scanned 1h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The explicit CLI command can create a local Jest config, and runtime transformer reads tsconfig.json to compile test files.

Static reason

No blocking static signals were detected.

Trigger

User runs ts-vitest config:init or Jest invokes the transformer.

Impact

Creates jest.config.js only on explicit CLI invocation; otherwise reads project TypeScript configuration and returns compiled code.

Mechanism

Local Jest configuration generation and TypeScript transpilation.

Rationale

Direct inspection shows a small CommonJS Jest/TypeScript transformer with no install-time execution or concrete exfiltration, persistence, remote payload, or destructive behavior. The CLI file write is explicit, guarded against overwrite, and package-aligned.

Evidence

package.jsondist/index.jsdist/cli.jsdist/transformer.jsdist/preset.jsjest.config.jstsconfig.json

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no install, postinstall, or preinstall hook; prepublishOnly only verifies dist files.
dist/index.js exports a Jest transformer without import-time side effects.
dist/transformer.js only reads TypeScript configuration and transpiles test source.
dist/cli.js writes jest.config.js only for explicit ts-vitest config:init.
No network, subprocess, eval/vm, environment harvesting, or agent-control writes found.

Behavioral surface

Source

CryptoFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 9.10 KB of source

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

3 Low

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem