registry / vitest-snapshot-tools / 0.1.0

vitest-snapshot-tools@0.1.0

Safely capture, review, and apply Vitest snapshot updates

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 325 file(s), 10.7 MB of source, external domains: github.com, json-schema.org, react.dev, www.w3.org

Source & flagged code

5 flagged

dist/cli.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2import { P as VsnapError } from "./dist-6RmQ5Mfu.js";

3import { r as SessionStore } from "./environment-DU0vX_08-BHduQBj9.js";

4import "./dist-BuW8b8he.js";

5import { t as createSnapshotApplication } from "./dist-CBDJ8Ylh.js";

6import { t as createSnapshotServer } from "./dist-Dbu28bEC.js";

7import fs, { constants, cp, mkdir, rm, stat } from "node:fs/promises";

8import path, { dirname, join, resolve, sep } from "node:path";

9import os from "node:os";

10import { fileURLToPath } from "node:url";

11import { formatWithOptions, promisify } from "node:util";

12import process$1 from "node:process";

13import * as tty from "node:tty";

14import { Buffer } from "node:buffer";

15import childProcess, { execFile } from "node:child_process";

16import fs$1 from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L14

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L14

18//#region ../../node_modules/.pnpm/consola@3.4.2/node_modules/consola/dist/core.mjs

19const LogLevels = {

20 silent: Number.NEGATIVE_INFINITY,

21 fatal: 0,

22 error: 0,

23 warn: 1,

24 log: 2,

25 info: 3,

26 success: 3,

27 fail: 3,

28 ready: 3,

29 start: 3,

30 box: 3,

31 debug: 4,

32 trace: 5,

33 verbose: Number.POSITIVE_INFINITY

34};

Lines 1030-1070javascript

1030//#region ../../node_modules/.pnpm/wsl-utils@0.1.0/node_modules/wsl-utils/index.js

1031const wslDrivesMountPoint = (() => {

1032 const defaultMountPoint = "/mnt/";

1033 let mountPoint;

1034 return async function() {

1035 if (mountPoint) return mountPoint;

dist/dist-6RmQ5Mfu.jsView file

Lines 5979-6019javascript

5979 const mergedDescriptors = {};

5980 for (const def of defs) {

5981 const descriptors = Object.getOwnPropertyDescriptors(def);

5982 Object.assign(mergedDescriptors, descriptors);

5983 }

dist/dist-BuW8b8he.jsView file

Lines 89-129javascript

89 errors: module.errors()

90 });

91 }

92 async onTestRunEnd(modules, errors, reason) {

93 await this.onModuleComplete?.();

94 await this.emit(reason === "interrupted"

Source & flagged code

5 flagged · loading source

dist/cli.jsView file

14import { Buffer } from "node:buffer"; L15: import childProcess, { execFile } from "node:child_process"; L16: import fs$1 from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L14

1050})(); L1051: const powerShellPathFromWsl = async () => { L1052: return `${await wslDrivesMountPoint()}[redacted].0/powershell.exe`;

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L1050

14Cross-file remote execution chain: dist/cli.js spawns dist/dist-6RmQ5Mfu.js; helper contains network access plus dynamic code execution. L14: import { Buffer } from "node:buffer"; L15: import childProcess, { execFile } from "node:child_process"; L16: import fs$1 from "node:fs"; ... L257: wrapStd() { L258: this._wrapStream(this.options.stdout, "log"); L259: this._wrapStream(this.options.stderr, "log"); ... L405: function parseStack(stack, message) { L406: const cwd = process.cwd() + sep; L407: return stack.split("\n").splice(message.split("\n").length).map((l$1) => l$1.trim().replace("file://", "").replace(cwd, "")); ... L470: const isCompatibleTerminal = tty && tty.isatty && tty.isatty(1) && env.TERM && !isDumbTerminal; L471: const isCI = "CI" in env && ("GITHUB_ACTIONS" in env || "GITLAB_CI" in env || "CIRCLECI" in env); L472: const isColorSupported = !isDisabled && (isForced || isWindows && !isDumbTerminal || isCompatibleTerminal || isCI);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L14

dist/dist-6RmQ5Mfu.jsView file

5999try { L6000: new Function(""); L6001: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-6RmQ5Mfu.jsView on unpkg · L5999

dist/dist-BuW8b8he.jsView file

109async function importTargetVitest(repositoryRoot) { L110: const require = createRequire(join(repositoryRoot, "package.json")); L111: let nodePath;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/dist-BuW8b8he.jsView on unpkg · L109

Findings

3 High4 Medium5 Low

HighChild Processdist/cli.js

HighShelldist/cli.js

HighCross File Remote Execution Contextdist/cli.js

MediumDynamic Requiredist/dist-BuW8b8he.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/dist-6RmQ5Mfu.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/cli.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2import { P as VsnapError } from "./dist-6RmQ5Mfu.js";

3import { r as SessionStore } from "./environment-DU0vX_08-BHduQBj9.js";

4import "./dist-BuW8b8he.js";

5import { t as createSnapshotApplication } from "./dist-CBDJ8Ylh.js";

6import { t as createSnapshotServer } from "./dist-Dbu28bEC.js";

7import fs, { constants, cp, mkdir, rm, stat } from "node:fs/promises";

8import path, { dirname, join, resolve, sep } from "node:path";

9import os from "node:os";

10import { fileURLToPath } from "node:url";

11import { formatWithOptions, promisify } from "node:util";

12import process$1 from "node:process";

13import * as tty from "node:tty";

14import { Buffer } from "node:buffer";

15import childProcess, { execFile } from "node:child_process";

16import fs$1 from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L14

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L14

18//#region ../../node_modules/.pnpm/consola@3.4.2/node_modules/consola/dist/core.mjs

19const LogLevels = {

20 silent: Number.NEGATIVE_INFINITY,

21 fatal: 0,

22 error: 0,

23 warn: 1,

24 log: 2,

25 info: 3,

26 success: 3,

27 fail: 3,

28 ready: 3,

29 start: 3,

30 box: 3,

31 debug: 4,

32 trace: 5,

33 verbose: Number.POSITIVE_INFINITY

34};

Lines 1030-1070javascript

1030//#region ../../node_modules/.pnpm/wsl-utils@0.1.0/node_modules/wsl-utils/index.js

1031const wslDrivesMountPoint = (() => {

1032 const defaultMountPoint = "/mnt/";

1033 let mountPoint;

1034 return async function() {

1035 if (mountPoint) return mountPoint;

dist/dist-6RmQ5Mfu.jsView file

Lines 5979-6019javascript

5979 const mergedDescriptors = {};

5980 for (const def of defs) {

5981 const descriptors = Object.getOwnPropertyDescriptors(def);

5982 Object.assign(mergedDescriptors, descriptors);

5983 }

dist/dist-BuW8b8he.jsView file

Lines 89-129javascript

89 errors: module.errors()

90 });

91 }

92 async onTestRunEnd(modules, errors, reason) {

93 await this.onModuleComplete?.();

94 await this.emit(reason === "interrupted"