registry / vitest-pool-assemblyscript / 0.15.0

vitest-pool-assemblyscript@0.15.0

AssemblyScript testing with Vitest - Simple, fast, familiar, AS-native, with full coverage output

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 34 file(s), 350 KB of source, external domains: github.com

Source & flagged code

6 flagged

package.jsonView file

Lines 99-139json

99 "ae4test": "npm run ep4test && npm run test:ext:meta:verify",

100 "//---- external v3 test shortcuts ----": "",

101 "ep3test": "npm run test:ext:setup:v3 && npm run test:ext:pass",

102 "em3test": "npm run test:ext:setup:v3 && npm run test:ext:meta",

103 "emv3test": "npm run test:ext:setup:v3 && npm run test:ext:meta:verify",

104 "ae3test": "npm run ep3test && npm run test:ext:meta:verify",

105 "//---- external global test shortcuts ----": "",

106 "eetest": "npm run aetest && npm run ae4test && npm run ae3test",

107 "//---- compile & test shortcuts ----": "",

108 "tcptest": "npm run tc && npm run build && npm run ptest",

109 "cptest": "npm run build && npm run ptest",

110 "cmtest": "npm run build && npm run mtest",

111 "cmvtest": "npm run build && npm run mvtest",

112 "//------------ Compile/Build TypeScript Pool ------------": "",

113 "build": "tsdown",

114 "//------------ Compile/Build Native Addon ------------": "",

115 "setup-binaryen": "node scripts/setup-binaryen.js",

116 "build:native": "node-gyp rebuild",

117 "build:prebuild": "prebuildify --napi --strip --tag-libc",

118 "//------------ npm Lifecycle (native build fallback) ------------": "",

119 "install": "node scripts/install-native-addon.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L119

120 },

121 "dependencies": {

122 "birpc": "^4.0.0",

123 "node-addon-api": "^8.8.0",

124 "node-gyp-build": "^4.8.4",

125 "source-map": "~0.7.6",

126 "tinyglobby": "~0.2.15",

127 "tinyhighlight": "^0.3.2",

128 "tinypool": "^2.1.0",

129 "tinyrainbow": "^3.1.0"

130 },

131 "peerDependencies": {

132 "@vitest/coverage-v8": "^3.2.0 || ^4.0.0 || ^5.0.0-0",

133 "@vitest/runner": "^3.2.0 || ^4.0.0 || ^5.0.0-0",

134 "@vitest/utils": "^3.2.0 || ^4.0.0 || ^5.0.0-0",

135 "assemblyscript": "~0.28.9",

136 "istanbul-lib-coverage": "^3.2.2",

137 "vitest": "^3.2.0 || ^4.0.0 || ^5.0.0-0"

138 },

139 "devDependencies": {

scripts/setup-binaryen.jsView file

Lines 1-24javascript

1import fs from 'fs';

2import os from 'os';

3import path from 'path';

4import https from 'https';

5import { execSync } from 'child_process';

dist/load-user-imports-0kVlLG94.mjsView file

Lines 791-826javascript

791 taskId: task.id,

792 origin: task.id

793 };

794 const reportPromises = [];

795 if (stdContent.length > 0) reportPromises.push(rpc.onUserConsoleLog(stdLog));

796

scripts/install-native-addon.jsView file

Lines 104-139javascript

104console.log('No prebuilt native addon found for this platform. Building from source...');

105console.log('');

106

107try {

108 console.log('Downloading Binaryen dependencies...');

109 execSync('node scripts/setup-binaryen.js', {

110 cwd: packageRoot,

prebuilds/win32-arm64/vitest-pool-assemblyscript.glibc.nodeView file

•path = prebuilds/win32-arm64/vitest-pool-assemblyscript.glibc.node kind = native_binary sizeBytes = 10151424 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilds/win32-arm64/vitest-pool-assemblyscript.glibc.nodeView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 2336 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.install = node scripts/install-native-addon.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/setup-binaryen.jsView file

4import https from 'https'; L5: import { execSync } from 'child_process'; L6:

High

Child Process

Package source references child process execution.

scripts/setup-binaryen.jsView on unpkg · L4

dist/load-user-imports-0kVlLG94.mjsView file

811const start = performance.now(); L812: const createWasmImports = (await import(safeUrl)).default; L813: debug(`[${logModule}] Imported user WasmImportsFactory "${safeUrl}" | TIMING ${(performance.now() - start).toFixed(2)} ms`);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/load-user-imports-0kVlLG94.mjsView on unpkg · L811

scripts/install-native-addon.jsView file

124console.log('Compiling native addon...'); L125: execSync('npx node-gyp rebuild', { L126: cwd: packageRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/install-native-addon.jsView on unpkg · L124

prebuilds/win32-arm64/vitest-pool-assemblyscript.glibc.nodeView file

•path = prebuilds/win32-arm64/vitest-pool-assemblyscript.glibc.node kind = native_binary sizeBytes = 10151424 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilds/win32-arm64/vitest-pool-assemblyscript.glibc.nodeView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 2336 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

Findings

4 High6 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/setup-binaryen.js

HighShell

HighRuntime Package Installscripts/install-native-addon.js

MediumDynamic Requiredist/load-user-imports-0kVlLG94.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryprebuilds/win32-arm64/vitest-pool-assemblyscript.glibc.node

MediumShips Build Helperbinding.gyp

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 99-139json

99 "ae4test": "npm run ep4test && npm run test:ext:meta:verify",

100 "//---- external v3 test shortcuts ----": "",

101 "ep3test": "npm run test:ext:setup:v3 && npm run test:ext:pass",

102 "em3test": "npm run test:ext:setup:v3 && npm run test:ext:meta",

103 "emv3test": "npm run test:ext:setup:v3 && npm run test:ext:meta:verify",

104 "ae3test": "npm run ep3test && npm run test:ext:meta:verify",

105 "//---- external global test shortcuts ----": "",

106 "eetest": "npm run aetest && npm run ae4test && npm run ae3test",

107 "//---- compile & test shortcuts ----": "",

108 "tcptest": "npm run tc && npm run build && npm run ptest",

109 "cptest": "npm run build && npm run ptest",

110 "cmtest": "npm run build && npm run mtest",

111 "cmvtest": "npm run build && npm run mvtest",

112 "//------------ Compile/Build TypeScript Pool ------------": "",

113 "build": "tsdown",

114 "//------------ Compile/Build Native Addon ------------": "",

115 "setup-binaryen": "node scripts/setup-binaryen.js",

116 "build:native": "node-gyp rebuild",

117 "build:prebuild": "prebuildify --napi --strip --tag-libc",

118 "//------------ npm Lifecycle (native build fallback) ------------": "",

119 "install": "node scripts/install-native-addon.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L119

120 },

121 "dependencies": {

122 "birpc": "^4.0.0",

123 "node-addon-api": "^8.8.0",

124 "node-gyp-build": "^4.8.4",

125 "source-map": "~0.7.6",

126 "tinyglobby": "~0.2.15",

127 "tinyhighlight": "^0.3.2",

128 "tinypool": "^2.1.0",

129 "tinyrainbow": "^3.1.0"

130 },

131 "peerDependencies": {

132 "@vitest/coverage-v8": "^3.2.0 || ^4.0.0 || ^5.0.0-0",

133 "@vitest/runner": "^3.2.0 || ^4.0.0 || ^5.0.0-0",

134 "@vitest/utils": "^3.2.0 || ^4.0.0 || ^5.0.0-0",

135 "assemblyscript": "~0.28.9",

136 "istanbul-lib-coverage": "^3.2.2",

137 "vitest": "^3.2.0 || ^4.0.0 || ^5.0.0-0"

138 },

139 "devDependencies": {

scripts/setup-binaryen.jsView file

Lines 1-24javascript

1import fs from 'fs';

2import os from 'os';

3import path from 'path';

4import https from 'https';

5import { execSync } from 'child_process';

dist/load-user-imports-0kVlLG94.mjsView file

Lines 791-826javascript

791 taskId: task.id,

792 origin: task.id

793 };

794 const reportPromises = [];

795 if (stdContent.length > 0) reportPromises.push(rpc.onUserConsoleLog(stdLog));

796

scripts/install-native-addon.jsView file

Lines 104-139javascript

104console.log('No prebuilt native addon found for this platform. Building from source...');

105console.log('');

106

107try {

108 console.log('Downloading Binaryen dependencies...');

109 execSync('node scripts/setup-binaryen.js', {

110 cwd: packageRoot,

prebuilds/win32-arm64/vitest-pool-assemblyscript.glibc.nodeView file

•path = prebuilds/win32-arm64/vitest-pool-assemblyscript.glibc.node kind = native_binary sizeBytes = 10151424 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilds/win32-arm64/vitest-pool-assemblyscript.glibc.nodeView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 2336 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg