registry / vitest-snapshot-tools / 0.1.0

vitest-snapshot-tools@0.1.0

Safely capture, review, and apply Vitest snapshot updates

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 325 file(s), 10.7 MB of source, external domains: github.com, json-schema.org, react.dev, www.w3.org

Source & flagged code

5 flagged

dist/cli.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2import { P as VsnapError } from "./dist-6RmQ5Mfu.js";

3import { r as SessionStore } from "./environment-DU0vX_08-BHduQBj9.js";

4import "./dist-BuW8b8he.js";

5import { t as createSnapshotApplication } from

Source & flagged code

5 flagged · loading source

dist/cli.jsView file

14import { Buffer } from "node:buffer"; L15: import childProcess, { execFile } from "node:child_process"; L16: import fs$1 from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L14

1050})(); L1051: const powerShellPathFromWsl = async () => { L1052: return `${await wslDrivesMountPoint()}[redacted].0/powershell.exe`;

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L1050

14Cross-file remote execution chain: dist/cli.js spawns dist/dist-6RmQ5Mfu.js; helper contains network access plus dynamic code execution. L14: import { Buffer } from "node:buffer"; L15: import childProcess, { execFile } from "node:child_process"; L16: import fs$1 from "node:fs"; ... L257: wrapStd() { L258: this._wrapStream(this.options.stdout, "log"); L259: this._wrapStream(this.options.stderr, "log"); ... L405: function parseStack(stack, message) { L406: const cwd = process.cwd() + sep; L407: return stack.split("\n").splice(message.split("\n").length).map((l$1) => l$1.trim().replace("file://", "").replace(cwd, "")); ... L470: const isCompatibleTerminal = tty && tty.isatty && tty.isatty(1) && env.TERM && !isDumbTerminal; L471: const isCI = "CI" in env && ("GITHUB_ACTIONS" in env || "GITLAB_CI" in env || "CIRCLECI" in env); L472: const isColorSupported = !isDisabled && (isForced || isWindows && !isDumbTerminal || isCompatibleTerminal || isCI);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L14

dist/dist-6RmQ5Mfu.jsView file

5999try { L6000: new Function(""); L6001: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-6RmQ5Mfu.jsView on unpkg · L5999

dist/dist-BuW8b8he.jsView file

109async function importTargetVitest(repositoryRoot) { L110: const require = createRequire(join(repositoryRoot, "package.json")); L111: let nodePath;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/dist-BuW8b8he.jsView on unpkg · L109

Findings

3 High4 Medium5 Low

HighChild Processdist/cli.js

HighShelldist/cli.js

HighCross File Remote Execution Contextdist/cli.js

MediumDynamic Requiredist/dist-BuW8b8he.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/dist-6RmQ5Mfu.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 1030-1070javascript

1030//#region ../../node_modules/.pnpm/wsl-utils@0.1.0/node_modules/wsl-utils/index.js

1031const wslDrivesMountPoint = (() => {

1032 const defaultMountPoint = "/mnt/";

1033 let mountPoint;

1034 return async function() {

1035 if (mountPoint) return mountPoint;

1036 const configFilePath = "/etc/wsl.conf";

1037 let isConfigFileExists = false;

1038 try {

1039 await fs.access(configFilePath, constants.F_OK);

1040 isConfigFileExists = true;

1041 } catch {}

1042 if (!isConfigFileExists) return defaultMountPoint;

1043 const configContent = await fs.readFile(configFilePath, { encoding: "utf8" });

1044 const configMountPoint = /(?<!#.*)root\s*=\s*(?<mountPoint>.*)/g.exec(configContent);

1045 if (!configMountPoint) return defaultMountPoint;

1046 mountPoint = configMountPoint.groups.mountPoint.trim();

1047 mountPoint = mountPoint.endsWith("/") ? mountPoint : `${mountPoint}/`;

1048 return mountPoint;

1049 };

1050})();

1051const powerShellPathFromWsl = async () => {

1052 return `${await wslDrivesMountPoint()}c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe`;

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L1050

1053};

1054const powerShellPath = async () => {

1055 if (is_wsl_default) return powerShellPathFromWsl();

1056 return `${process$1.env.SYSTEMROOT || process$1.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`;

1057};

1058

1059//#endregion

1060//#region ../../node_modules/.pnpm/define-lazy-prop@3.0.0/node_modules/define-lazy-prop/index.js

1061function defineLazyProperty(object, propertyName, valueGetter) {

1062 const define = (value) => Object.defineProperty(object, propertyName, {

1063 value,

1064 enumerable: true,

1065 writable: true

1066 });

1067 Object.defineProperty(object, propertyName, {

1068 configurable: true,

1069 enumerable: true,

1070 get() {

dist/dist-6RmQ5Mfu.jsView file

Lines 5979-6019javascript

5979 const mergedDescriptors = {};

5980 for (const def of defs) {

5981 const descriptors = Object.getOwnPropertyDescriptors(def);

5982 Object.assign(mergedDescriptors, descriptors);

5983 }

5984 return Object.defineProperties({}, mergedDescriptors);

5985}

5986function esc(str) {

5987 return JSON.stringify(str);

5988}

5989function slugify(input) {

5990 return input.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");

5991}

5992const captureStackTrace = "captureStackTrace" in Error ? Error.captureStackTrace : (..._args) => {};

5993function isObject(data$1) {

5994 return typeof data$1 === "object" && data$1 !== null && !Array.isArray(data$1);

5995}

5996const allowsEval = /* @__PURE__ */ cached(() => {

5997 if (globalConfig.jitless) return false;

5998 if (typeof navigator !== "undefined" && navigator?.userAgent?.includes("Cloudflare")) return false;

5999 try {

6000 new Function("");

6001 return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-6RmQ5Mfu.jsView on unpkg · L5999

6002 } catch (_) {

6003 return false;

6004 }

6005});

6006function isPlainObject(o) {

6007 if (isObject(o) === false) return false;

6008 const ctor = o.constructor;

6009 if (ctor === void 0) return true;

6010 if (typeof ctor !== "function") return true;

6011 const prot = ctor.prototype;

6012 if (isObject(prot) === false) return false;

6013 if (Object.prototype.hasOwnProperty.call(prot, "isPrototypeOf") === false) return false;

6014 return true;

6015}

6016function shallowClone(o) {

6017 if (isPlainObject(o)) return { ...o };

6018 if (Array.isArray(o)) return [...o];

6019 if (o instanceof Map) return new Map(o);

dist/dist-BuW8b8he.jsView file

Lines 89-129javascript

89 errors: module.errors()

90 });

91 }

92 async onTestRunEnd(modules, errors, reason) {

93 await this.onModuleComplete?.();

94 await this.emit(reason === "interrupted" ? "run.interrupted" : reason === "failed" ? "run.failed" : "run.finished", {

95 reason,

96 modules: modules.length,

97 errors

98 });

99 }

100};

101const activeRuns = /* @__PURE__ */ new Map();

102let runnerBusy = false;

103function snapshotKind(relativePath, baseline, candidate) {

104 if (relativePath.endsWith(".snap")) return "external";

105 const source = `${baseline ?? ""}\n${candidate ?? ""}`;

106 if (/\.(?:[cm]?[jt]sx?)$/i.test(relativePath) && /\b(?:toMatchInlineSnapshot|toThrowErrorMatchingInlineSnapshot)\s*\(/.test(source)) return "inline-unsupported";

107 return "file";

108}

109async function importTargetVitest(repositoryRoot) {

110 const require = createRequire(join(repositoryRoot, "package.json"));

111 let nodePath;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/dist-BuW8b8he.jsView on unpkg · L109

112 let packagePath;

113 try {

114 nodePath = require.resolve("vitest/node");

115 packagePath = require.resolve("vitest/package.json");

116 } catch {

117 throw new VsnapError("VITEST_NOT_FOUND", `Could not resolve the target project's Vitest installation from ${repositoryRoot}`);

118 }

119 const pkg = require(packagePath);

120 if (!pkg.version.startsWith("4.")) throw new VsnapError("UNSUPPORTED_VITEST", `Vitest ${pkg.version} is unsupported; install Vitest 4.x`);

121 return {

122 ...await import(pathToFileURL(nodePath).href),

123 version: pkg.version

124 };

125}

126async function rebuildReviewIndex(session, store, emit) {

127 const overlay = await listOverlay(session, store.sessionDirectory(session));

128 const decisions = await store.readDecisions(session);

129 const index = {