twintest@1.0.0

⚠ Under review

Windows desktop application test automation framework — Appium 2.x + appium-windows-driver + WebDriverIO + Cucumber-js.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 19 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 115 KB of source

Source & flagged code

13 flagged

package.jsonView file

Lines 34-74json

34 "./wdio.conf": {

35 "types": "./dist/wdio.conf.d.ts",

36 "import": "./dist/wdio.conf.js",

37 "default": "./dist/wdio.conf.js"

38 }

39 },

40 "typesVersions": {

41 "*": {

42 "config": ["dist/config.d.ts"],

43 "hooks": ["dist/hooks.d.ts"],

44 "steps/common": ["dist/steps/common.steps.d.ts"],

45 "steps/database": ["dist/steps/database.steps.d.ts"]

46 }

47 },

48 "scripts": {

49 "test": "wdio run wdio.conf.ts",

50 "test:repair": "node bin/self-repair.mjs",

51 "appium:setup": "ts-node scripts/setup-appium.ts",

52 "appium:start": "appium --address 127.0.0.1 --port 4723 --allow-cors",

53 "appium:doctor": "appium driver doctor windows",

54 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L54

55 "build": "tsc -p tsconfig.build.json",

56 "prepublishOnly": "npm run build"

57 },

58 "bin": {

59 "twintest-self-repair": "bin/self-repair.mjs"

60 },

61 "files": [

62 "dist",

63 "bin",

64 "hooks",

65 "skills",

66 "schemas",

67 "scripts/postinstall.cjs",

68 "README.md"

69 ],

70 "dependencies": {

71 "@types/node": "^20.0.0",

72 "@wdio/appium-service": "^9.0.0",

73 "@wdio/cli": "^9.0.0",

74 "@wdio/cucumber-framework": "^9.0.0",

bin/self-repair.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2// self-repair.mjs — external driver for autonomous desktop suite repair.

3//

4// Adapted from achilles self-repair: baselines the suite, classifies failures,

5// spawns one repair worker per red feature file, verifies heals, and writes

6// an audit-grade report.

7//

8// Consumers reach this through `npm run test:repair`.

9//

10// Exit codes: 0 = every test green or explained, 2 = unresolved, 1 = driver error.

dist/config.jsView file

Lines 1-46javascript

1/**

2 * twintest base WDIO configuration.

3 *

4 * Consumers extend this in their own `wdio.conf.ts`:

5 *

6 * import { baseConfig } from 'twintest/config';

7 * export const config = {

8 * ...baseConfig,

9 * specs: ['./tests/**\/*.feature'],

10 * cucumberOpts: {

11 * ...baseConfig.cucumberOpts,

dist/wdio.conf.jsView file

Lines 4-44javascript

4 * Consumers run tests without creating their own wdio.conf.ts:

5 *

6 * npx wdio run node_modules/twintest/dist/wdio.conf.js

7 *

8 * Or add a script to package.json:

9 *

scripts/postinstall.cjsView file

Lines 1-26javascript

1#!/usr/bin/env node

3/**

4 * postinstall.js — auto-install twintest skills and hooks.

5 *

6 * Adapted from the achilles postinstall pattern:

7 * - Copies skills to ~/.claude/skills/ and <project>/.claude/skills/

8 * - Copies hooks to ~/.claude/hooks/ and registers them in settings.json

9 * - Idempotent: safe to run multiple times

10 */

hooks/winappdriver-session-guard.shView file

•path = hooks/winappdriver-session-guard.sh kind = build_helper sizeBytes = 1758 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/winappdriver-session-guard.shView on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/self-repair.mjsView file

11L12: import { spawn, execSync } from 'node:child_process'; L13: import {

High

Child Process

Package source references child process execution.

bin/self-repair.mjsView on unpkg · L11

•

Findings

3 Critical7 High5 Medium4 Low

CriticalReverse Shelldist/config.js

CriticalAi Agent Control Hijackscripts/postinstall.cjs

CriticalTrigger Reachable Dangerous Capabilitydist/config.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/self-repair.mjs

HighShelldist/config.js

HighSame File Env Network Executiondist/config.js

HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/postinstall.cjs

HighKnown Malware Source Similaritybin/self-repair.mjs

HighKnown Malware Source Similaritydist/config.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

Affected versions and remediation

This report applies to twintest@1.0.0.

See all versions of twintest for other recorded verdicts.

Review the evidence and your use of twintest@1.0.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 15:59:01.222Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.