registry / vitest-snapshot-tools / 0.5.0

vitest-snapshot-tools@0.5.0

Safely capture, review, and apply Vitest snapshot updates

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 2.21 MB of source, external domains: github.com, json-schema.org, react.dev, www.w3.org

Source & flagged code

5 flagged

dist/dist-BIbuXxdB.jsView file

Lines 49-89javascript

49 if (addPath) {

50 const addPathNewPos = addPath.oldPos - diagonalPath;

51 canAdd = addPath && 0 <= addPathNewPos && addPathNewPos < newLen;

52 }

53 const canRemove = removePath && removePath.oldPos + 1 < oldLen;

54 if (!canAdd && !canRemove) {

55 bestPath[diagonalPath] = void 0;

56 continue;

57 }

58 if (!canRemove || canAdd && removePath.oldPos < addPath.oldPos) basePath = this.addToPath(addPath, true, false, 0, options);

59 else basePath = this.addToPath(removePath, false, true, 1, options);

60 newPos = this.extractCommon(basePath, newTokens, oldTokens, diagonalPath, options);

61 if (basePath.oldPos + 1 >= oldLen && newPos + 1 >= newLen) return done(this.buildValues(basePath.lastComponent, newTokens, oldTokens)) || true;

62 else {

63 bestPath[diagonalPath] = basePath;

64 if (basePath.oldPos + 1 >= oldLen) maxDiagonalToConsider = Math.min(maxDiagonalToConsider, diagonalPath - 1);

65 if (newPos + 1 >= newLen) minDiagonalToConsider = Math.max(minDiagonalToConsider, diagonalPath + 1);

66 }

67 }

68 editLength++;

69 };

70 if (callback) (function exec() {

71 setTimeout(function() {

High

Child Process

Package source references child process execution.

dist/dist-BIbuXxdB.jsView on unpkg · L69

72 if (editLength > maxEditLength || Date.now() > abortAfterTimestamp) return callback(void 0);

73 if (!execEditLength()) exec();

74 }, 0);

75 })();

76 else while (editLength <= maxEditLength && Date.now() <= abortAfterTimestamp) {

77 const ret = execEditLength();

78 if (ret) return ret;

79 }

80 }

81 addToPath(path$1, added, removed, oldPosInc, options) {

82 const last = path$1.lastComponent;

83 if (last && !options.oneChangePerToken && last.added === added && last.removed === removed) return {

84 oldPos: path$1.oldPos + oldPosInc,

85 lastComponent: {

86 count: last.count + 1,

87 added,

88 removed,

89 previousComponent: last.previousComponent

Lines 5979-6019javascript

5979 const mergedDescriptors = {};

5980 for (const def of defs) {

5981 const descriptors = Object.getOwnPropertyDescriptors(def);

5982 Object.assign(mergedDescriptors, descriptors);

5983 }

5984 return Object.defineProperties({}, mergedDescriptors);

dist/cli.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2import { R as VsnapError } from "./dist-BIbuXxdB.js";

3import { t as createSnapshotServer } from "./dist-_WJ9CgKA.js";

4import { r as SessionStore } from "./environment-DU0vX_08-Dqqceuu-.js";

5import "./dist-CVtwDEs_.js";

6import

dist/dist-CVtwDEs_.jsView file

Lines 159-199javascript

159}

160async function mapConcurrent(values, concurrency, visit) {

161 const results = new Array(values.length);

162 let next = 0;

Source & flagged code

5 flagged · loading source

dist/dist-BIbuXxdB.jsView file

69}; L70: if (callback) (function exec() { L71: setTimeout(function() {

High

Child Process

Package source references child process execution.

dist/dist-BIbuXxdB.jsView on unpkg · L69

5999try { L6000: new Function(""); L6001: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-BIbuXxdB.jsView on unpkg · L5999

dist/cli.jsView file

1050})(); L1051: const powerShellPathFromWsl = async () => { L1052: return `${await wslDrivesMountPoint()}[redacted].0/powershell.exe`;

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L1050

14Cross-file remote execution chain: dist/cli.js spawns dist/dist-BIbuXxdB.js; helper contains network access plus dynamic code execution. L14: import { Buffer } from "node:buffer"; L15: import childProcess, { execFile } from "node:child_process"; L16: import fs$1 from "node:fs"; ... L257: wrapStd() { L258: this._wrapStream(this.options.stdout, "log"); L259: this._wrapStream(this.options.stderr, "log"); ... L405: function parseStack(stack, message) { L406: const cwd = process.cwd() + sep; L407: return stack.split("\n").splice(message.split("\n").length).map((l$1) => l$1.trim().replace("file://", "").replace(cwd, "")); ... L470: const isCompatibleTerminal = tty && tty.isatty && tty.isatty(1) && env.TERM && !isDumbTerminal; L471: const isCI = "CI" in env && ("GITHUB_ACTIONS" in env || "GITLAB_CI" in env || "CIRCLECI" in env); L472: const isColorSupported = !isDisabled && (isForced || isWindows && !isDumbTerminal || isCompatibleTerminal || isCI);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L14

dist/dist-CVtwDEs_.jsView file

179async function importTargetVitest(repositoryRoot) { L180: const require = createRequire(join(repositoryRoot, "package.json")); L181: let nodePath;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/dist-CVtwDEs_.jsView on unpkg · L179

Findings

3 High4 Medium5 Low

HighChild Processdist/dist-BIbuXxdB.js

HighShelldist/cli.js

HighCross File Remote Execution Contextdist/cli.js

MediumDynamic Requiredist/dist-CVtwDEs_.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/dist-BIbuXxdB.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/dist-BIbuXxdB.jsView file

Lines 49-89javascript

49 if (addPath) {

50 const addPathNewPos = addPath.oldPos - diagonalPath;

51 canAdd = addPath && 0 <= addPathNewPos && addPathNewPos < newLen;

52 }

53 const canRemove = removePath && removePath.oldPos + 1 < oldLen;

54 if (!canAdd && !canRemove) {

55 bestPath[diagonalPath] = void 0;

56 continue;

57 }

58 if (!canRemove || canAdd && removePath.oldPos < addPath.oldPos) basePath = this.addToPath(addPath, true, false, 0, options);

59 else basePath = this.addToPath(removePath, false, true, 1, options);

60 newPos = this.extractCommon(basePath, newTokens, oldTokens, diagonalPath, options);

61 if (basePath.oldPos + 1 >= oldLen && newPos + 1 >= newLen) return done(this.buildValues(basePath.lastComponent, newTokens, oldTokens)) || true;

62 else {

63 bestPath[diagonalPath] = basePath;

64 if (basePath.oldPos + 1 >= oldLen) maxDiagonalToConsider = Math.min(maxDiagonalToConsider, diagonalPath - 1);

65 if (newPos + 1 >= newLen) minDiagonalToConsider = Math.max(minDiagonalToConsider, diagonalPath + 1);

66 }

67 }

68 editLength++;

69 };

70 if (callback) (function exec() {

71 setTimeout(function() {

High

Child Process

Package source references child process execution.

dist/dist-BIbuXxdB.jsView on unpkg · L69

72 if (editLength > maxEditLength || Date.now() > abortAfterTimestamp) return callback(void 0);

73 if (!execEditLength()) exec();

74 }, 0);

75 })();

76 else while (editLength <= maxEditLength && Date.now() <= abortAfterTimestamp) {

77 const ret = execEditLength();

78 if (ret) return ret;

79 }

80 }

81 addToPath(path$1, added, removed, oldPosInc, options) {

82 const last = path$1.lastComponent;

83 if (last && !options.oneChangePerToken && last.added === added && last.removed === removed) return {

84 oldPos: path$1.oldPos + oldPosInc,

85 lastComponent: {

86 count: last.count + 1,

87 added,

88 removed,

89 previousComponent: last.previousComponent

Lines 5979-6019javascript

5979 const mergedDescriptors = {};

5980 for (const def of defs) {

5981 const descriptors = Object.getOwnPropertyDescriptors(def);

5982 Object.assign(mergedDescriptors, descriptors);

5983 }

5984 return Object.defineProperties({}, mergedDescriptors);

dist/cli.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2import { R as VsnapError } from "./dist-BIbuXxdB.js";

3import { t as createSnapshotServer } from "./dist-_WJ9CgKA.js";

4import { r as SessionStore } from "./environment-DU0vX_08-Dqqceuu-.js";

5import "./dist-CVtwDEs_.js";

6import

dist/dist-CVtwDEs_.jsView file

Lines 159-199javascript

159}

160async function mapConcurrent(values, concurrency, visit) {

161 const results = new Array(values.length);

162 let next = 0;

Lines 1030-1070javascript

1030//#region ../../node_modules/.pnpm/wsl-utils@0.1.0/node_modules/wsl-utils/index.js

1031const wslDrivesMountPoint = (() => {

1032 const defaultMountPoint = "/mnt/";

1033 let mountPoint;

1034 return async function() {

1035 if (mountPoint) return mountPoint;

1036 const configFilePath = "/etc/wsl.conf";

1037 let isConfigFileExists = false;

1038 try {

1039 await fs.access(configFilePath, constants.F_OK);

1040 isConfigFileExists = true;

1041 } catch {}

1042 if (!isConfigFileExists) return defaultMountPoint;

1043 const configContent = await fs.readFile(configFilePath, { encoding: "utf8" });

1044 const configMountPoint = /(?<!#.*)root\s*=\s*(?<mountPoint>.*)/g.exec(configContent);

1045 if (!configMountPoint) return defaultMountPoint;

1046 mountPoint = configMountPoint.groups.mountPoint.trim();

1047 mountPoint = mountPoint.endsWith("/") ? mountPoint : `${mountPoint}/`;

1048 return mountPoint;

1049 };

1050})();

1051const powerShellPathFromWsl = async () => {

1052 return `${await wslDrivesMountPoint()}c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe`;

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L1050

1053};

1054const powerShellPath = async () => {

1055 if (is_wsl_default) return powerShellPathFromWsl();

1056 return `${process$1.env.SYSTEMROOT || process$1.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`;

1057};

1058

1059//#endregion

1060//#region ../../node_modules/.pnpm/define-lazy-prop@3.0.0/node_modules/define-lazy-prop/index.js

1061function defineLazyProperty(object, propertyName, valueGetter) {

1062 const define = (value) => Object.defineProperty(object, propertyName, {

1063 value,

1064 enumerable: true,

1065 writable: true

1066 });

1067 Object.defineProperty(object, propertyName, {

1068 configurable: true,

1069 enumerable: true,

1070 get() {