← Home

as-test

Testing framework for AssemblyScript. Compatible with WASI or Bindings

39
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

jairussw

Keywords

assemblyscripttestingtestas-pectaspect

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:as-variant AI (phantom-deps): Phantom-dep heuristic; config-file reference only. ai
phantom-deps phantom-dep:gradient-string AI (phantom-deps): Phantom-dep heuristic; config-file reference only. ai
phantom-deps phantom-dep:wipc-js AI (phantom-deps): Declared in config but not directly imported; heuristic false positive for this build tool. ai
semgrep semgrep:silent-process-exec AI (semgrep): Spawns 'open [url]' to launch browser for dev web session; standard dev-tool pattern. ai
semgrep semgrep:silent-process-exec-var AI (semgrep): Same browser-open spawn; not a background malicious process. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Standard Proxy trap delegation pattern; not obfuscation. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): 127.0.0.1 loopback address used to launch local browser for web-based test runner; not a remote exfiltration endpoint. ai
semgrep semgrep:env-bulk-read AI (semgrep): Part of the same env snapshot/restore pattern for test isolation; not a data-leak risk. ai
semgrep semgrep:env-spread AI (semgrep): Used in snapshotEnv/applyEnv for test isolation, not exfiltration. Stable pattern for this test-runner package. ai

Versions (showing 39 of 39)

Version Deps Published
1.6.0 5 / 14
1.5.2 5 / 14
1.5.1 5 / 14
1.5.0 5 / 14
1.4.1 5 / 14
1.4.0 4 / 14
1.3.0 4 / 15
1.2.0 4 / 14
1.1.10 4 / 13
1.1.9 4 / 13
1.1.8 4 / 13
1.1.7 4 / 13
1.1.6 4 / 13
1.1.5 4 / 13
1.1.4 4 / 13
1.1.3 4 / 13
1.1.2 4 / 12
1.1.1 4 / 12
1.1.0 6 / 12
1.0.16 6 / 12
1.0.15 6 / 12
1.0.14 6 / 12
1.0.13 6 / 12
1.0.12 6 / 12
1.0.11 6 / 12
1.0.10 6 / 12
1.0.9 6 / 12
1.0.7 6 / 12
1.0.6 6 / 12
1.0.5 6 / 12
1.0.4 6 / 12
1.0.3 6 / 12
1.0.1 5 / 11
1.0.0 5 / 11
0.5.4 5 / 11
0.5.3 5 / 11
0.5.2 5 / 10
0.5.1 8 / 11
0.5.0 8 / 11

v1.6.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.5.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.5.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.5.0

21 findings
HIGH silent-process-exec: bin/commands/web-session.js:448 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/6ce1d8f6d2b0aaa93abe6dd86e19d4efae59855d/bin/commands/web-session.js#L448 446 | if (process.platform == "darwin") { 447 | if (!hasExecutable("open")) return null; > 448 | return spawn("open", [url], { stdio: "ignore", detached: true }); 449 | } 450 | if (process.platform == "win32") {

HIGH silent-process-exec-var: bin/commands/web-session.js:448 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/6ce1d8f6d2b0aaa93abe6dd86e19d4efae59855d/bin/commands/web-session.js#L448 446 | if (process.platform == "darwin") { 447 | if (!hasExecutable("open")) return null; > 448 | return spawn("open", [url], { stdio: "ignore", detached: true }); 449 | } 450 | if (process.platform == "win32") {

HIGH silent-process-exec: bin/commands/web-session.js:452 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/6ce1d8f6d2b0aaa93abe6dd86e19d4efae59855d/bin/commands/web-session.js#L452 450 | if (process.platform == "win32") { 451 | if (!hasExecutable("cmd")) return null; > 452 | return spawn("cmd", ["/c", "start", "", url], { 453 | stdio: "ignore", 454 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:452 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/6ce1d8f6d2b0aaa93abe6dd86e19d4efae59855d/bin/commands/web-session.js#L452 450 | if (process.platform == "win32") { 451 | if (!hasExecutable("cmd")) return null; > 452 | return spawn("cmd", ["/c", "start", "", url], { 453 | stdio: "ignore", 454 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:458 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/6ce1d8f6d2b0aaa93abe6dd86e19d4efae59855d/bin/commands/web-session.js#L458 456 | } 457 | if (!hasExecutable("xdg-open")) return null; > 458 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 459 | } 460 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec-var: bin/commands/web-session.js:458 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/6ce1d8f6d2b0aaa93abe6dd86e19d4efae59855d/bin/commands/web-session.js#L458 456 | } 457 | if (!hasExecutable("xdg-open")) return null; > 458 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 459 | } 460 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec: bin/commands/web-session.js:472 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/6ce1d8f6d2b0aaa93abe6dd86e19d4efae59855d/bin/commands/web-session.js#L472 470 | for (const candidate of candidates) { 471 | if (!hasExecutable(candidate.command)) continue; > 472 | return spawn( 473 | candidate.command, 474 | [...(headless ? candidate.headless : []), url],

HIGH silent-process-exec-var: bin/commands/web-session.js:472 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/6ce1d8f6d2b0aaa93abe6dd86e19d4efae59855d/bin/commands/web-session.js#L472 470 | for (const candidate of candidates) { 471 | if (!hasExecutable(candidate.command)) continue; > 472 | return spawn( 473 | candidate.command, 474 | [...(headless ? candidate.headless : []), url],

HIGH silent-process-exec: bin/commands/web-session.js:485 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/6ce1d8f6d2b0aaa93abe6dd86e19d4efae59855d/bin/commands/web-session.js#L485 483 | const args = headless ? resolveHeadlessFlags(direct) : []; 484 | args.push(url); > 485 | return spawn(direct, args, { 486 | stdio: "ignore", 487 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:485 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/6ce1d8f6d2b0aaa93abe6dd86e19d4efae59855d/bin/commands/web-session.js#L485 483 | const args = headless ? resolveHeadlessFlags(direct) : []; 484 | args.push(url); > 485 | return spawn(direct, args, { 486 | stdio: "ignore", 487 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:499 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/6ce1d8f6d2b0aaa93abe6dd86e19d4efae59855d/bin/commands/web-session.js#L499 497 | } 498 | args.push(url); > 499 | return spawn(command, args, { 500 | stdio: "ignore", 501 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:499 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/6ce1d8f6d2b0aaa93abe6dd86e19d4efae59855d/bin/commands/web-session.js#L499 497 | } 498 | args.push(url); > 499 | return spawn(command, args, { 500 | stdio: "ignore", 501 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:933 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/6ce1d8f6d2b0aaa93abe6dd86e19d4efae59855d/lib/src/index.ts#L933 931 | const script = buildMacBrowserOpenScript(browserApp, url); 932 | if (!script.length) return null; > 933 | return spawn( 934 | "osascript", 935 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec-var: lib/src/index.ts:933 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/6ce1d8f6d2b0aaa93abe6dd86e19d4efae59855d/lib/src/index.ts#L933 931 | const script = buildMacBrowserOpenScript(browserApp, url); 932 | if (!script.length) return null; > 933 | return spawn( 934 | "osascript", 935 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec: lib/src/index.ts:948 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/6ce1d8f6d2b0aaa93abe6dd86e19d4efae59855d/lib/src/index.ts#L948 946 | if (process.platform == "darwin") { 947 | if (!hasExecutable("open")) return null; > 948 | return spawn("open", [url], { stdio: "ignore", detached: true }); 949 | } 950 | if (process.platform == "win32") {

HIGH silent-process-exec-var: lib/src/index.ts:948 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/6ce1d8f6d2b0aaa93abe6dd86e19d4efae59855d/lib/src/index.ts#L948 946 | if (process.platform == "darwin") { 947 | if (!hasExecutable("open")) return null; > 948 | return spawn("open", [url], { stdio: "ignore", detached: true }); 949 | } 950 | if (process.platform == "win32") {

HIGH silent-process-exec: lib/src/index.ts:952 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/6ce1d8f6d2b0aaa93abe6dd86e19d4efae59855d/lib/src/index.ts#L952 950 | if (process.platform == "win32") { 951 | if (!hasExecutable("cmd")) return null; > 952 | return spawn("cmd", ["/c", "start", "", url], { 953 | stdio: "ignore", 954 | detached: true,

HIGH silent-process-exec-var: lib/src/index.ts:952 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/6ce1d8f6d2b0aaa93abe6dd86e19d4efae59855d/lib/src/index.ts#L952 950 | if (process.platform == "win32") { 951 | if (!hasExecutable("cmd")) return null; > 952 | return spawn("cmd", ["/c", "start", "", url], { 953 | stdio: "ignore", 954 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:958 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/6ce1d8f6d2b0aaa93abe6dd86e19d4efae59855d/lib/src/index.ts#L958 956 | } 957 | if (!hasExecutable("xdg-open")) return null; > 958 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 959 | } 960 |

HIGH silent-process-exec-var: lib/src/index.ts:958 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/6ce1d8f6d2b0aaa93abe6dd86e19d4efae59855d/lib/src/index.ts#L958 956 | } 957 | if (!hasExecutable("xdg-open")) return null; > 958 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 959 | } 960 |

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.1

21 findings
HIGH silent-process-exec: bin/commands/web-session.js:428 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5bb5ae69ab21cbe02e4ca8457179540406bb8482/bin/commands/web-session.js#L428 426 | if (process.platform == "darwin") { 427 | if (!hasExecutable("open")) return null; > 428 | return spawn("open", [url], { stdio: "ignore", detached: true }); 429 | } 430 | if (process.platform == "win32") {

HIGH silent-process-exec-var: bin/commands/web-session.js:428 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5bb5ae69ab21cbe02e4ca8457179540406bb8482/bin/commands/web-session.js#L428 426 | if (process.platform == "darwin") { 427 | if (!hasExecutable("open")) return null; > 428 | return spawn("open", [url], { stdio: "ignore", detached: true }); 429 | } 430 | if (process.platform == "win32") {

HIGH silent-process-exec: bin/commands/web-session.js:432 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5bb5ae69ab21cbe02e4ca8457179540406bb8482/bin/commands/web-session.js#L432 430 | if (process.platform == "win32") { 431 | if (!hasExecutable("cmd")) return null; > 432 | return spawn("cmd", ["/c", "start", "", url], { 433 | stdio: "ignore", 434 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:432 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5bb5ae69ab21cbe02e4ca8457179540406bb8482/bin/commands/web-session.js#L432 430 | if (process.platform == "win32") { 431 | if (!hasExecutable("cmd")) return null; > 432 | return spawn("cmd", ["/c", "start", "", url], { 433 | stdio: "ignore", 434 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:438 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5bb5ae69ab21cbe02e4ca8457179540406bb8482/bin/commands/web-session.js#L438 436 | } 437 | if (!hasExecutable("xdg-open")) return null; > 438 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 439 | } 440 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec-var: bin/commands/web-session.js:438 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5bb5ae69ab21cbe02e4ca8457179540406bb8482/bin/commands/web-session.js#L438 436 | } 437 | if (!hasExecutable("xdg-open")) return null; > 438 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 439 | } 440 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec: bin/commands/web-session.js:452 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5bb5ae69ab21cbe02e4ca8457179540406bb8482/bin/commands/web-session.js#L452 450 | for (const candidate of candidates) { 451 | if (!hasExecutable(candidate.command)) continue; > 452 | return spawn( 453 | candidate.command, 454 | [...(headless ? candidate.headless : []), url],

HIGH silent-process-exec-var: bin/commands/web-session.js:452 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5bb5ae69ab21cbe02e4ca8457179540406bb8482/bin/commands/web-session.js#L452 450 | for (const candidate of candidates) { 451 | if (!hasExecutable(candidate.command)) continue; > 452 | return spawn( 453 | candidate.command, 454 | [...(headless ? candidate.headless : []), url],

HIGH silent-process-exec: bin/commands/web-session.js:465 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5bb5ae69ab21cbe02e4ca8457179540406bb8482/bin/commands/web-session.js#L465 463 | const args = headless ? resolveHeadlessFlags(direct) : []; 464 | args.push(url); > 465 | return spawn(direct, args, { 466 | stdio: "ignore", 467 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:465 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5bb5ae69ab21cbe02e4ca8457179540406bb8482/bin/commands/web-session.js#L465 463 | const args = headless ? resolveHeadlessFlags(direct) : []; 464 | args.push(url); > 465 | return spawn(direct, args, { 466 | stdio: "ignore", 467 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:479 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5bb5ae69ab21cbe02e4ca8457179540406bb8482/bin/commands/web-session.js#L479 477 | } 478 | args.push(url); > 479 | return spawn(command, args, { 480 | stdio: "ignore", 481 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:479 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5bb5ae69ab21cbe02e4ca8457179540406bb8482/bin/commands/web-session.js#L479 477 | } 478 | args.push(url); > 479 | return spawn(command, args, { 480 | stdio: "ignore", 481 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5bb5ae69ab21cbe02e4ca8457179540406bb8482/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec-var: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5bb5ae69ab21cbe02e4ca8457179540406bb8482/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5bb5ae69ab21cbe02e4ca8457179540406bb8482/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec-var: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5bb5ae69ab21cbe02e4ca8457179540406bb8482/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5bb5ae69ab21cbe02e4ca8457179540406bb8482/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec-var: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5bb5ae69ab21cbe02e4ca8457179540406bb8482/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5bb5ae69ab21cbe02e4ca8457179540406bb8482/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

HIGH silent-process-exec-var: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5bb5ae69ab21cbe02e4ca8457179540406bb8482/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.0

21 findings
HIGH silent-process-exec: bin/commands/web-session.js:428 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5fa69c399b7760b079ae6d158432ab548f2213df/bin/commands/web-session.js#L428 426 | if (process.platform == "darwin") { 427 | if (!hasExecutable("open")) return null; > 428 | return spawn("open", [url], { stdio: "ignore", detached: true }); 429 | } 430 | if (process.platform == "win32") {

HIGH silent-process-exec-var: bin/commands/web-session.js:428 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5fa69c399b7760b079ae6d158432ab548f2213df/bin/commands/web-session.js#L428 426 | if (process.platform == "darwin") { 427 | if (!hasExecutable("open")) return null; > 428 | return spawn("open", [url], { stdio: "ignore", detached: true }); 429 | } 430 | if (process.platform == "win32") {

HIGH silent-process-exec: bin/commands/web-session.js:432 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5fa69c399b7760b079ae6d158432ab548f2213df/bin/commands/web-session.js#L432 430 | if (process.platform == "win32") { 431 | if (!hasExecutable("cmd")) return null; > 432 | return spawn("cmd", ["/c", "start", "", url], { 433 | stdio: "ignore", 434 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:432 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5fa69c399b7760b079ae6d158432ab548f2213df/bin/commands/web-session.js#L432 430 | if (process.platform == "win32") { 431 | if (!hasExecutable("cmd")) return null; > 432 | return spawn("cmd", ["/c", "start", "", url], { 433 | stdio: "ignore", 434 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:438 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5fa69c399b7760b079ae6d158432ab548f2213df/bin/commands/web-session.js#L438 436 | } 437 | if (!hasExecutable("xdg-open")) return null; > 438 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 439 | } 440 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec-var: bin/commands/web-session.js:438 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5fa69c399b7760b079ae6d158432ab548f2213df/bin/commands/web-session.js#L438 436 | } 437 | if (!hasExecutable("xdg-open")) return null; > 438 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 439 | } 440 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec: bin/commands/web-session.js:452 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5fa69c399b7760b079ae6d158432ab548f2213df/bin/commands/web-session.js#L452 450 | for (const candidate of candidates) { 451 | if (!hasExecutable(candidate.command)) continue; > 452 | return spawn( 453 | candidate.command, 454 | [...(headless ? candidate.headless : []), url],

HIGH silent-process-exec-var: bin/commands/web-session.js:452 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5fa69c399b7760b079ae6d158432ab548f2213df/bin/commands/web-session.js#L452 450 | for (const candidate of candidates) { 451 | if (!hasExecutable(candidate.command)) continue; > 452 | return spawn( 453 | candidate.command, 454 | [...(headless ? candidate.headless : []), url],

HIGH silent-process-exec: bin/commands/web-session.js:465 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5fa69c399b7760b079ae6d158432ab548f2213df/bin/commands/web-session.js#L465 463 | const args = headless ? resolveHeadlessFlags(direct) : []; 464 | args.push(url); > 465 | return spawn(direct, args, { 466 | stdio: "ignore", 467 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:465 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5fa69c399b7760b079ae6d158432ab548f2213df/bin/commands/web-session.js#L465 463 | const args = headless ? resolveHeadlessFlags(direct) : []; 464 | args.push(url); > 465 | return spawn(direct, args, { 466 | stdio: "ignore", 467 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:479 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5fa69c399b7760b079ae6d158432ab548f2213df/bin/commands/web-session.js#L479 477 | } 478 | args.push(url); > 479 | return spawn(command, args, { 480 | stdio: "ignore", 481 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:479 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5fa69c399b7760b079ae6d158432ab548f2213df/bin/commands/web-session.js#L479 477 | } 478 | args.push(url); > 479 | return spawn(command, args, { 480 | stdio: "ignore", 481 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5fa69c399b7760b079ae6d158432ab548f2213df/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec-var: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5fa69c399b7760b079ae6d158432ab548f2213df/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5fa69c399b7760b079ae6d158432ab548f2213df/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec-var: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5fa69c399b7760b079ae6d158432ab548f2213df/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5fa69c399b7760b079ae6d158432ab548f2213df/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec-var: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5fa69c399b7760b079ae6d158432ab548f2213df/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5fa69c399b7760b079ae6d158432ab548f2213df/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

HIGH silent-process-exec-var: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/5fa69c399b7760b079ae6d158432ab548f2213df/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.0

21 findings
HIGH silent-process-exec: bin/commands/web-session.js:428 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/8714ea06a0d1747c1a898eb291cf5db3e4db1541/bin/commands/web-session.js#L428 426 | if (process.platform == "darwin") { 427 | if (!hasExecutable("open")) return null; > 428 | return spawn("open", [url], { stdio: "ignore", detached: true }); 429 | } 430 | if (process.platform == "win32") {

HIGH silent-process-exec-var: bin/commands/web-session.js:428 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/8714ea06a0d1747c1a898eb291cf5db3e4db1541/bin/commands/web-session.js#L428 426 | if (process.platform == "darwin") { 427 | if (!hasExecutable("open")) return null; > 428 | return spawn("open", [url], { stdio: "ignore", detached: true }); 429 | } 430 | if (process.platform == "win32") {

HIGH silent-process-exec: bin/commands/web-session.js:432 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/8714ea06a0d1747c1a898eb291cf5db3e4db1541/bin/commands/web-session.js#L432 430 | if (process.platform == "win32") { 431 | if (!hasExecutable("cmd")) return null; > 432 | return spawn("cmd", ["/c", "start", "", url], { 433 | stdio: "ignore", 434 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:432 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/8714ea06a0d1747c1a898eb291cf5db3e4db1541/bin/commands/web-session.js#L432 430 | if (process.platform == "win32") { 431 | if (!hasExecutable("cmd")) return null; > 432 | return spawn("cmd", ["/c", "start", "", url], { 433 | stdio: "ignore", 434 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:438 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/8714ea06a0d1747c1a898eb291cf5db3e4db1541/bin/commands/web-session.js#L438 436 | } 437 | if (!hasExecutable("xdg-open")) return null; > 438 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 439 | } 440 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec-var: bin/commands/web-session.js:438 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/8714ea06a0d1747c1a898eb291cf5db3e4db1541/bin/commands/web-session.js#L438 436 | } 437 | if (!hasExecutable("xdg-open")) return null; > 438 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 439 | } 440 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec: bin/commands/web-session.js:452 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/8714ea06a0d1747c1a898eb291cf5db3e4db1541/bin/commands/web-session.js#L452 450 | for (const candidate of candidates) { 451 | if (!hasExecutable(candidate.command)) continue; > 452 | return spawn( 453 | candidate.command, 454 | [...(headless ? candidate.headless : []), url],

HIGH silent-process-exec-var: bin/commands/web-session.js:452 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/8714ea06a0d1747c1a898eb291cf5db3e4db1541/bin/commands/web-session.js#L452 450 | for (const candidate of candidates) { 451 | if (!hasExecutable(candidate.command)) continue; > 452 | return spawn( 453 | candidate.command, 454 | [...(headless ? candidate.headless : []), url],

HIGH silent-process-exec: bin/commands/web-session.js:465 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/8714ea06a0d1747c1a898eb291cf5db3e4db1541/bin/commands/web-session.js#L465 463 | const args = headless ? resolveHeadlessFlags(direct) : []; 464 | args.push(url); > 465 | return spawn(direct, args, { 466 | stdio: "ignore", 467 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:465 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/8714ea06a0d1747c1a898eb291cf5db3e4db1541/bin/commands/web-session.js#L465 463 | const args = headless ? resolveHeadlessFlags(direct) : []; 464 | args.push(url); > 465 | return spawn(direct, args, { 466 | stdio: "ignore", 467 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:479 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/8714ea06a0d1747c1a898eb291cf5db3e4db1541/bin/commands/web-session.js#L479 477 | } 478 | args.push(url); > 479 | return spawn(command, args, { 480 | stdio: "ignore", 481 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:479 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/8714ea06a0d1747c1a898eb291cf5db3e4db1541/bin/commands/web-session.js#L479 477 | } 478 | args.push(url); > 479 | return spawn(command, args, { 480 | stdio: "ignore", 481 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/8714ea06a0d1747c1a898eb291cf5db3e4db1541/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec-var: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/8714ea06a0d1747c1a898eb291cf5db3e4db1541/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/8714ea06a0d1747c1a898eb291cf5db3e4db1541/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec-var: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/8714ea06a0d1747c1a898eb291cf5db3e4db1541/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/8714ea06a0d1747c1a898eb291cf5db3e4db1541/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec-var: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/8714ea06a0d1747c1a898eb291cf5db3e4db1541/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/8714ea06a0d1747c1a898eb291cf5db3e4db1541/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

HIGH silent-process-exec-var: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/8714ea06a0d1747c1a898eb291cf5db3e4db1541/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.0

21 findings
HIGH silent-process-exec: bin/commands/web-session.js:428 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/d4de4e04e02a9017e6a9f7d97c3e6dbb0cde7ba8/bin/commands/web-session.js#L428 426 | if (process.platform == "darwin") { 427 | if (!hasExecutable("open")) return null; > 428 | return spawn("open", [url], { stdio: "ignore", detached: true }); 429 | } 430 | if (process.platform == "win32") {

HIGH silent-process-exec-var: bin/commands/web-session.js:428 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/d4de4e04e02a9017e6a9f7d97c3e6dbb0cde7ba8/bin/commands/web-session.js#L428 426 | if (process.platform == "darwin") { 427 | if (!hasExecutable("open")) return null; > 428 | return spawn("open", [url], { stdio: "ignore", detached: true }); 429 | } 430 | if (process.platform == "win32") {

HIGH silent-process-exec: bin/commands/web-session.js:432 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/d4de4e04e02a9017e6a9f7d97c3e6dbb0cde7ba8/bin/commands/web-session.js#L432 430 | if (process.platform == "win32") { 431 | if (!hasExecutable("cmd")) return null; > 432 | return spawn("cmd", ["/c", "start", "", url], { 433 | stdio: "ignore", 434 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:432 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/d4de4e04e02a9017e6a9f7d97c3e6dbb0cde7ba8/bin/commands/web-session.js#L432 430 | if (process.platform == "win32") { 431 | if (!hasExecutable("cmd")) return null; > 432 | return spawn("cmd", ["/c", "start", "", url], { 433 | stdio: "ignore", 434 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:438 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/d4de4e04e02a9017e6a9f7d97c3e6dbb0cde7ba8/bin/commands/web-session.js#L438 436 | } 437 | if (!hasExecutable("xdg-open")) return null; > 438 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 439 | } 440 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec-var: bin/commands/web-session.js:438 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/d4de4e04e02a9017e6a9f7d97c3e6dbb0cde7ba8/bin/commands/web-session.js#L438 436 | } 437 | if (!hasExecutable("xdg-open")) return null; > 438 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 439 | } 440 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec: bin/commands/web-session.js:452 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/d4de4e04e02a9017e6a9f7d97c3e6dbb0cde7ba8/bin/commands/web-session.js#L452 450 | for (const candidate of candidates) { 451 | if (!hasExecutable(candidate.command)) continue; > 452 | return spawn( 453 | candidate.command, 454 | [...(headless ? candidate.headless : []), url],

HIGH silent-process-exec-var: bin/commands/web-session.js:452 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/d4de4e04e02a9017e6a9f7d97c3e6dbb0cde7ba8/bin/commands/web-session.js#L452 450 | for (const candidate of candidates) { 451 | if (!hasExecutable(candidate.command)) continue; > 452 | return spawn( 453 | candidate.command, 454 | [...(headless ? candidate.headless : []), url],

HIGH silent-process-exec: bin/commands/web-session.js:465 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/d4de4e04e02a9017e6a9f7d97c3e6dbb0cde7ba8/bin/commands/web-session.js#L465 463 | const args = headless ? resolveHeadlessFlags(direct) : []; 464 | args.push(url); > 465 | return spawn(direct, args, { 466 | stdio: "ignore", 467 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:465 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/d4de4e04e02a9017e6a9f7d97c3e6dbb0cde7ba8/bin/commands/web-session.js#L465 463 | const args = headless ? resolveHeadlessFlags(direct) : []; 464 | args.push(url); > 465 | return spawn(direct, args, { 466 | stdio: "ignore", 467 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:479 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/d4de4e04e02a9017e6a9f7d97c3e6dbb0cde7ba8/bin/commands/web-session.js#L479 477 | } 478 | args.push(url); > 479 | return spawn(command, args, { 480 | stdio: "ignore", 481 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:479 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/d4de4e04e02a9017e6a9f7d97c3e6dbb0cde7ba8/bin/commands/web-session.js#L479 477 | } 478 | args.push(url); > 479 | return spawn(command, args, { 480 | stdio: "ignore", 481 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/d4de4e04e02a9017e6a9f7d97c3e6dbb0cde7ba8/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec-var: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/d4de4e04e02a9017e6a9f7d97c3e6dbb0cde7ba8/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/d4de4e04e02a9017e6a9f7d97c3e6dbb0cde7ba8/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec-var: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/d4de4e04e02a9017e6a9f7d97c3e6dbb0cde7ba8/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/d4de4e04e02a9017e6a9f7d97c3e6dbb0cde7ba8/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec-var: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/d4de4e04e02a9017e6a9f7d97c3e6dbb0cde7ba8/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/d4de4e04e02a9017e6a9f7d97c3e6dbb0cde7ba8/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

HIGH silent-process-exec-var: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/d4de4e04e02a9017e6a9f7d97c3e6dbb0cde7ba8/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.10

21 findings
HIGH silent-process-exec: bin/commands/web-session.js:424 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/68e788f4f28e4d3fb50f5105e869a7a17e30ad54/bin/commands/web-session.js#L424 422 | if (process.platform == "darwin") { 423 | if (!hasExecutable("open")) return null; > 424 | return spawn("open", [url], { stdio: "ignore", detached: true }); 425 | } 426 | if (process.platform == "win32") {

HIGH silent-process-exec-var: bin/commands/web-session.js:424 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/68e788f4f28e4d3fb50f5105e869a7a17e30ad54/bin/commands/web-session.js#L424 422 | if (process.platform == "darwin") { 423 | if (!hasExecutable("open")) return null; > 424 | return spawn("open", [url], { stdio: "ignore", detached: true }); 425 | } 426 | if (process.platform == "win32") {

HIGH silent-process-exec: bin/commands/web-session.js:428 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/68e788f4f28e4d3fb50f5105e869a7a17e30ad54/bin/commands/web-session.js#L428 426 | if (process.platform == "win32") { 427 | if (!hasExecutable("cmd")) return null; > 428 | return spawn("cmd", ["/c", "start", "", url], { 429 | stdio: "ignore", 430 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:428 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/68e788f4f28e4d3fb50f5105e869a7a17e30ad54/bin/commands/web-session.js#L428 426 | if (process.platform == "win32") { 427 | if (!hasExecutable("cmd")) return null; > 428 | return spawn("cmd", ["/c", "start", "", url], { 429 | stdio: "ignore", 430 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:434 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/68e788f4f28e4d3fb50f5105e869a7a17e30ad54/bin/commands/web-session.js#L434 432 | } 433 | if (!hasExecutable("xdg-open")) return null; > 434 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 435 | } 436 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec-var: bin/commands/web-session.js:434 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/68e788f4f28e4d3fb50f5105e869a7a17e30ad54/bin/commands/web-session.js#L434 432 | } 433 | if (!hasExecutable("xdg-open")) return null; > 434 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 435 | } 436 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec: bin/commands/web-session.js:448 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/68e788f4f28e4d3fb50f5105e869a7a17e30ad54/bin/commands/web-session.js#L448 446 | for (const candidate of candidates) { 447 | if (!hasExecutable(candidate.command)) continue; > 448 | return spawn( 449 | candidate.command, 450 | [...(headless ? candidate.headless : []), url],

HIGH silent-process-exec-var: bin/commands/web-session.js:448 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/68e788f4f28e4d3fb50f5105e869a7a17e30ad54/bin/commands/web-session.js#L448 446 | for (const candidate of candidates) { 447 | if (!hasExecutable(candidate.command)) continue; > 448 | return spawn( 449 | candidate.command, 450 | [...(headless ? candidate.headless : []), url],

HIGH silent-process-exec: bin/commands/web-session.js:461 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/68e788f4f28e4d3fb50f5105e869a7a17e30ad54/bin/commands/web-session.js#L461 459 | const args = headless ? resolveHeadlessFlags(direct) : []; 460 | args.push(url); > 461 | return spawn(direct, args, { 462 | stdio: "ignore", 463 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:461 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/68e788f4f28e4d3fb50f5105e869a7a17e30ad54/bin/commands/web-session.js#L461 459 | const args = headless ? resolveHeadlessFlags(direct) : []; 460 | args.push(url); > 461 | return spawn(direct, args, { 462 | stdio: "ignore", 463 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:475 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/68e788f4f28e4d3fb50f5105e869a7a17e30ad54/bin/commands/web-session.js#L475 473 | } 474 | args.push(url); > 475 | return spawn(command, args, { 476 | stdio: "ignore", 477 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:475 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/68e788f4f28e4d3fb50f5105e869a7a17e30ad54/bin/commands/web-session.js#L475 473 | } 474 | args.push(url); > 475 | return spawn(command, args, { 476 | stdio: "ignore", 477 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/68e788f4f28e4d3fb50f5105e869a7a17e30ad54/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec-var: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/68e788f4f28e4d3fb50f5105e869a7a17e30ad54/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/68e788f4f28e4d3fb50f5105e869a7a17e30ad54/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec-var: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/68e788f4f28e4d3fb50f5105e869a7a17e30ad54/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/68e788f4f28e4d3fb50f5105e869a7a17e30ad54/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec-var: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/68e788f4f28e4d3fb50f5105e869a7a17e30ad54/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/68e788f4f28e4d3fb50f5105e869a7a17e30ad54/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

HIGH silent-process-exec-var: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/68e788f4f28e4d3fb50f5105e869a7a17e30ad54/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.9

21 findings
HIGH silent-process-exec: bin/commands/web-session.js:424 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/489289f0b1793ef3e4fd45515a61ee578a224e55/bin/commands/web-session.js#L424 422 | if (process.platform == "darwin") { 423 | if (!hasExecutable("open")) return null; > 424 | return spawn("open", [url], { stdio: "ignore", detached: true }); 425 | } 426 | if (process.platform == "win32") {

HIGH silent-process-exec-var: bin/commands/web-session.js:424 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/489289f0b1793ef3e4fd45515a61ee578a224e55/bin/commands/web-session.js#L424 422 | if (process.platform == "darwin") { 423 | if (!hasExecutable("open")) return null; > 424 | return spawn("open", [url], { stdio: "ignore", detached: true }); 425 | } 426 | if (process.platform == "win32") {

HIGH silent-process-exec: bin/commands/web-session.js:428 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/489289f0b1793ef3e4fd45515a61ee578a224e55/bin/commands/web-session.js#L428 426 | if (process.platform == "win32") { 427 | if (!hasExecutable("cmd")) return null; > 428 | return spawn("cmd", ["/c", "start", "", url], { 429 | stdio: "ignore", 430 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:428 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/489289f0b1793ef3e4fd45515a61ee578a224e55/bin/commands/web-session.js#L428 426 | if (process.platform == "win32") { 427 | if (!hasExecutable("cmd")) return null; > 428 | return spawn("cmd", ["/c", "start", "", url], { 429 | stdio: "ignore", 430 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:434 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/489289f0b1793ef3e4fd45515a61ee578a224e55/bin/commands/web-session.js#L434 432 | } 433 | if (!hasExecutable("xdg-open")) return null; > 434 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 435 | } 436 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec-var: bin/commands/web-session.js:434 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/489289f0b1793ef3e4fd45515a61ee578a224e55/bin/commands/web-session.js#L434 432 | } 433 | if (!hasExecutable("xdg-open")) return null; > 434 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 435 | } 436 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec: bin/commands/web-session.js:448 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/489289f0b1793ef3e4fd45515a61ee578a224e55/bin/commands/web-session.js#L448 446 | for (const candidate of candidates) { 447 | if (!hasExecutable(candidate.command)) continue; > 448 | return spawn( 449 | candidate.command, 450 | [...(headless ? candidate.headless : []), url],

HIGH silent-process-exec-var: bin/commands/web-session.js:448 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/489289f0b1793ef3e4fd45515a61ee578a224e55/bin/commands/web-session.js#L448 446 | for (const candidate of candidates) { 447 | if (!hasExecutable(candidate.command)) continue; > 448 | return spawn( 449 | candidate.command, 450 | [...(headless ? candidate.headless : []), url],

HIGH silent-process-exec: bin/commands/web-session.js:461 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/489289f0b1793ef3e4fd45515a61ee578a224e55/bin/commands/web-session.js#L461 459 | const args = headless ? resolveHeadlessFlags(direct) : []; 460 | args.push(url); > 461 | return spawn(direct, args, { 462 | stdio: "ignore", 463 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:461 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/489289f0b1793ef3e4fd45515a61ee578a224e55/bin/commands/web-session.js#L461 459 | const args = headless ? resolveHeadlessFlags(direct) : []; 460 | args.push(url); > 461 | return spawn(direct, args, { 462 | stdio: "ignore", 463 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:475 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/489289f0b1793ef3e4fd45515a61ee578a224e55/bin/commands/web-session.js#L475 473 | } 474 | args.push(url); > 475 | return spawn(command, args, { 476 | stdio: "ignore", 477 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:475 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/489289f0b1793ef3e4fd45515a61ee578a224e55/bin/commands/web-session.js#L475 473 | } 474 | args.push(url); > 475 | return spawn(command, args, { 476 | stdio: "ignore", 477 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/489289f0b1793ef3e4fd45515a61ee578a224e55/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec-var: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/489289f0b1793ef3e4fd45515a61ee578a224e55/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/489289f0b1793ef3e4fd45515a61ee578a224e55/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec-var: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/489289f0b1793ef3e4fd45515a61ee578a224e55/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/489289f0b1793ef3e4fd45515a61ee578a224e55/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec-var: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/489289f0b1793ef3e4fd45515a61ee578a224e55/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/489289f0b1793ef3e4fd45515a61ee578a224e55/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

HIGH silent-process-exec-var: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/489289f0b1793ef3e4fd45515a61ee578a224e55/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.8

21 findings
HIGH silent-process-exec: bin/commands/web-session.js:424 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L424 422 | if (process.platform == "darwin") { 423 | if (!hasExecutable("open")) return null; > 424 | return spawn("open", [url], { stdio: "ignore", detached: true }); 425 | } 426 | if (process.platform == "win32") {

HIGH silent-process-exec-var: bin/commands/web-session.js:424 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L424 422 | if (process.platform == "darwin") { 423 | if (!hasExecutable("open")) return null; > 424 | return spawn("open", [url], { stdio: "ignore", detached: true }); 425 | } 426 | if (process.platform == "win32") {

HIGH silent-process-exec: bin/commands/web-session.js:428 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L428 426 | if (process.platform == "win32") { 427 | if (!hasExecutable("cmd")) return null; > 428 | return spawn("cmd", ["/c", "start", "", url], { 429 | stdio: "ignore", 430 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:428 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L428 426 | if (process.platform == "win32") { 427 | if (!hasExecutable("cmd")) return null; > 428 | return spawn("cmd", ["/c", "start", "", url], { 429 | stdio: "ignore", 430 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:434 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L434 432 | } 433 | if (!hasExecutable("xdg-open")) return null; > 434 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 435 | } 436 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec-var: bin/commands/web-session.js:434 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L434 432 | } 433 | if (!hasExecutable("xdg-open")) return null; > 434 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 435 | } 436 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec: bin/commands/web-session.js:448 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L448 446 | for (const candidate of candidates) { 447 | if (!hasExecutable(candidate.command)) continue; > 448 | return spawn( 449 | candidate.command, 450 | [...(headless ? candidate.headless : []), url],

HIGH silent-process-exec-var: bin/commands/web-session.js:448 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L448 446 | for (const candidate of candidates) { 447 | if (!hasExecutable(candidate.command)) continue; > 448 | return spawn( 449 | candidate.command, 450 | [...(headless ? candidate.headless : []), url],

HIGH silent-process-exec: bin/commands/web-session.js:461 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L461 459 | const args = headless ? resolveHeadlessFlags(direct) : []; 460 | args.push(url); > 461 | return spawn(direct, args, { 462 | stdio: "ignore", 463 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:461 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L461 459 | const args = headless ? resolveHeadlessFlags(direct) : []; 460 | args.push(url); > 461 | return spawn(direct, args, { 462 | stdio: "ignore", 463 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:475 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L475 473 | } 474 | args.push(url); > 475 | return spawn(command, args, { 476 | stdio: "ignore", 477 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:475 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L475 473 | } 474 | args.push(url); > 475 | return spawn(command, args, { 476 | stdio: "ignore", 477 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec-var: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec-var: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec-var: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

HIGH silent-process-exec-var: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.7

21 findings
HIGH silent-process-exec: bin/commands/web-session.js:424 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L424 422 | if (process.platform == "darwin") { 423 | if (!hasExecutable("open")) return null; > 424 | return spawn("open", [url], { stdio: "ignore", detached: true }); 425 | } 426 | if (process.platform == "win32") {

HIGH silent-process-exec-var: bin/commands/web-session.js:424 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L424 422 | if (process.platform == "darwin") { 423 | if (!hasExecutable("open")) return null; > 424 | return spawn("open", [url], { stdio: "ignore", detached: true }); 425 | } 426 | if (process.platform == "win32") {

HIGH silent-process-exec: bin/commands/web-session.js:428 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L428 426 | if (process.platform == "win32") { 427 | if (!hasExecutable("cmd")) return null; > 428 | return spawn("cmd", ["/c", "start", "", url], { 429 | stdio: "ignore", 430 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:428 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L428 426 | if (process.platform == "win32") { 427 | if (!hasExecutable("cmd")) return null; > 428 | return spawn("cmd", ["/c", "start", "", url], { 429 | stdio: "ignore", 430 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:434 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L434 432 | } 433 | if (!hasExecutable("xdg-open")) return null; > 434 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 435 | } 436 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec-var: bin/commands/web-session.js:434 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L434 432 | } 433 | if (!hasExecutable("xdg-open")) return null; > 434 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 435 | } 436 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec: bin/commands/web-session.js:448 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L448 446 | for (const candidate of candidates) { 447 | if (!hasExecutable(candidate.command)) continue; > 448 | return spawn( 449 | candidate.command, 450 | [...(headless ? candidate.headless : []), url],

HIGH silent-process-exec-var: bin/commands/web-session.js:448 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L448 446 | for (const candidate of candidates) { 447 | if (!hasExecutable(candidate.command)) continue; > 448 | return spawn( 449 | candidate.command, 450 | [...(headless ? candidate.headless : []), url],

HIGH silent-process-exec: bin/commands/web-session.js:461 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L461 459 | const args = headless ? resolveHeadlessFlags(direct) : []; 460 | args.push(url); > 461 | return spawn(direct, args, { 462 | stdio: "ignore", 463 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:461 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L461 459 | const args = headless ? resolveHeadlessFlags(direct) : []; 460 | args.push(url); > 461 | return spawn(direct, args, { 462 | stdio: "ignore", 463 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:475 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L475 473 | } 474 | args.push(url); > 475 | return spawn(command, args, { 476 | stdio: "ignore", 477 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:475 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/bin/commands/web-session.js#L475 473 | } 474 | args.push(url); > 475 | return spawn(command, args, { 476 | stdio: "ignore", 477 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec-var: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec-var: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec-var: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

HIGH silent-process-exec-var: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c9527d26d50bf7d4f48a5a6a75ff507b01c63958/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.6

21 findings
HIGH silent-process-exec: bin/commands/web-session.js:430 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/418726007346c1215a43f593e31ff0b9639af99a/bin/commands/web-session.js#L430 428 | if (!hasExecutable("open")) 429 | return null; > 430 | return spawn("open", [url], { stdio: "ignore", detached: true }); 431 | } 432 | if (process.platform == "win32") {

HIGH silent-process-exec-var: bin/commands/web-session.js:430 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/418726007346c1215a43f593e31ff0b9639af99a/bin/commands/web-session.js#L430 428 | if (!hasExecutable("open")) 429 | return null; > 430 | return spawn("open", [url], { stdio: "ignore", detached: true }); 431 | } 432 | if (process.platform == "win32") {

HIGH silent-process-exec: bin/commands/web-session.js:435 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/418726007346c1215a43f593e31ff0b9639af99a/bin/commands/web-session.js#L435 433 | if (!hasExecutable("cmd")) 434 | return null; > 435 | return spawn("cmd", ["/c", "start", "", url], { 436 | stdio: "ignore", 437 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:435 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/418726007346c1215a43f593e31ff0b9639af99a/bin/commands/web-session.js#L435 433 | if (!hasExecutable("cmd")) 434 | return null; > 435 | return spawn("cmd", ["/c", "start", "", url], { 436 | stdio: "ignore", 437 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:442 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/418726007346c1215a43f593e31ff0b9639af99a/bin/commands/web-session.js#L442 440 | if (!hasExecutable("xdg-open")) 441 | return null; > 442 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 443 | } 444 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec-var: bin/commands/web-session.js:442 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/418726007346c1215a43f593e31ff0b9639af99a/bin/commands/web-session.js#L442 440 | if (!hasExecutable("xdg-open")) 441 | return null; > 442 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 443 | } 444 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec: bin/commands/web-session.js:457 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/418726007346c1215a43f593e31ff0b9639af99a/bin/commands/web-session.js#L457 455 | if (!hasExecutable(candidate.command)) 456 | continue; > 457 | return spawn(candidate.command, [...(headless ? candidate.headless : []), url], { stdio: "ignore", detached: tru 458 | } 459 | return null;

HIGH silent-process-exec-var: bin/commands/web-session.js:457 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/418726007346c1215a43f593e31ff0b9639af99a/bin/commands/web-session.js#L457 455 | if (!hasExecutable(candidate.command)) 456 | continue; > 457 | return spawn(candidate.command, [...(headless ? candidate.headless : []), url], { stdio: "ignore", detached: tru 458 | } 459 | return null;

HIGH silent-process-exec: bin/commands/web-session.js:466 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/418726007346c1215a43f593e31ff0b9639af99a/bin/commands/web-session.js#L466 464 | const args = headless ? resolveHeadlessFlags(direct) : []; 465 | args.push(url); > 466 | return spawn(direct, args, { 467 | stdio: "ignore", 468 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:466 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/418726007346c1215a43f593e31ff0b9639af99a/bin/commands/web-session.js#L466 464 | const args = headless ? resolveHeadlessFlags(direct) : []; 465 | args.push(url); > 466 | return spawn(direct, args, { 467 | stdio: "ignore", 468 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:482 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/418726007346c1215a43f593e31ff0b9639af99a/bin/commands/web-session.js#L482 480 | } 481 | args.push(url); > 482 | return spawn(command, args, { 483 | stdio: "ignore", 484 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:482 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/418726007346c1215a43f593e31ff0b9639af99a/bin/commands/web-session.js#L482 480 | } 481 | args.push(url); > 482 | return spawn(command, args, { 483 | stdio: "ignore", 484 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/418726007346c1215a43f593e31ff0b9639af99a/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec-var: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/418726007346c1215a43f593e31ff0b9639af99a/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/418726007346c1215a43f593e31ff0b9639af99a/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec-var: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/418726007346c1215a43f593e31ff0b9639af99a/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/418726007346c1215a43f593e31ff0b9639af99a/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec-var: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/418726007346c1215a43f593e31ff0b9639af99a/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/418726007346c1215a43f593e31ff0b9639af99a/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

HIGH silent-process-exec-var: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/418726007346c1215a43f593e31ff0b9639af99a/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.5

21 findings
HIGH silent-process-exec: bin/commands/web-session.js:430 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c64f2466516af58ede62a7cedcba6714e6f5616a/bin/commands/web-session.js#L430 428 | if (!hasExecutable("open")) 429 | return null; > 430 | return spawn("open", [url], { stdio: "ignore", detached: true }); 431 | } 432 | if (process.platform == "win32") {

HIGH silent-process-exec-var: bin/commands/web-session.js:430 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c64f2466516af58ede62a7cedcba6714e6f5616a/bin/commands/web-session.js#L430 428 | if (!hasExecutable("open")) 429 | return null; > 430 | return spawn("open", [url], { stdio: "ignore", detached: true }); 431 | } 432 | if (process.platform == "win32") {

HIGH silent-process-exec: bin/commands/web-session.js:435 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c64f2466516af58ede62a7cedcba6714e6f5616a/bin/commands/web-session.js#L435 433 | if (!hasExecutable("cmd")) 434 | return null; > 435 | return spawn("cmd", ["/c", "start", "", url], { 436 | stdio: "ignore", 437 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:435 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c64f2466516af58ede62a7cedcba6714e6f5616a/bin/commands/web-session.js#L435 433 | if (!hasExecutable("cmd")) 434 | return null; > 435 | return spawn("cmd", ["/c", "start", "", url], { 436 | stdio: "ignore", 437 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:442 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c64f2466516af58ede62a7cedcba6714e6f5616a/bin/commands/web-session.js#L442 440 | if (!hasExecutable("xdg-open")) 441 | return null; > 442 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 443 | } 444 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec-var: bin/commands/web-session.js:442 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c64f2466516af58ede62a7cedcba6714e6f5616a/bin/commands/web-session.js#L442 440 | if (!hasExecutable("xdg-open")) 441 | return null; > 442 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 443 | } 444 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec: bin/commands/web-session.js:457 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c64f2466516af58ede62a7cedcba6714e6f5616a/bin/commands/web-session.js#L457 455 | if (!hasExecutable(candidate.command)) 456 | continue; > 457 | return spawn(candidate.command, [...(headless ? candidate.headless : []), url], { stdio: "ignore", detached: tru 458 | } 459 | return null;

HIGH silent-process-exec-var: bin/commands/web-session.js:457 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c64f2466516af58ede62a7cedcba6714e6f5616a/bin/commands/web-session.js#L457 455 | if (!hasExecutable(candidate.command)) 456 | continue; > 457 | return spawn(candidate.command, [...(headless ? candidate.headless : []), url], { stdio: "ignore", detached: tru 458 | } 459 | return null;

HIGH silent-process-exec: bin/commands/web-session.js:466 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c64f2466516af58ede62a7cedcba6714e6f5616a/bin/commands/web-session.js#L466 464 | const args = headless ? resolveHeadlessFlags(direct) : []; 465 | args.push(url); > 466 | return spawn(direct, args, { 467 | stdio: "ignore", 468 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:466 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c64f2466516af58ede62a7cedcba6714e6f5616a/bin/commands/web-session.js#L466 464 | const args = headless ? resolveHeadlessFlags(direct) : []; 465 | args.push(url); > 466 | return spawn(direct, args, { 467 | stdio: "ignore", 468 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:482 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c64f2466516af58ede62a7cedcba6714e6f5616a/bin/commands/web-session.js#L482 480 | } 481 | args.push(url); > 482 | return spawn(command, args, { 483 | stdio: "ignore", 484 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:482 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c64f2466516af58ede62a7cedcba6714e6f5616a/bin/commands/web-session.js#L482 480 | } 481 | args.push(url); > 482 | return spawn(command, args, { 483 | stdio: "ignore", 484 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c64f2466516af58ede62a7cedcba6714e6f5616a/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec-var: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c64f2466516af58ede62a7cedcba6714e6f5616a/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c64f2466516af58ede62a7cedcba6714e6f5616a/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec-var: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c64f2466516af58ede62a7cedcba6714e6f5616a/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c64f2466516af58ede62a7cedcba6714e6f5616a/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec-var: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c64f2466516af58ede62a7cedcba6714e6f5616a/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c64f2466516af58ede62a7cedcba6714e6f5616a/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

HIGH silent-process-exec-var: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/c64f2466516af58ede62a7cedcba6714e6f5616a/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.4

21 findings
HIGH silent-process-exec: bin/commands/web-session.js:430 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3cda557bdd3f5e31a0d0449e5e5d5af5a1e99b0c/bin/commands/web-session.js#L430 428 | if (!hasExecutable("open")) 429 | return null; > 430 | return spawn("open", [url], { stdio: "ignore", detached: true }); 431 | } 432 | if (process.platform == "win32") {

HIGH silent-process-exec-var: bin/commands/web-session.js:430 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3cda557bdd3f5e31a0d0449e5e5d5af5a1e99b0c/bin/commands/web-session.js#L430 428 | if (!hasExecutable("open")) 429 | return null; > 430 | return spawn("open", [url], { stdio: "ignore", detached: true }); 431 | } 432 | if (process.platform == "win32") {

HIGH silent-process-exec: bin/commands/web-session.js:435 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3cda557bdd3f5e31a0d0449e5e5d5af5a1e99b0c/bin/commands/web-session.js#L435 433 | if (!hasExecutable("cmd")) 434 | return null; > 435 | return spawn("cmd", ["/c", "start", "", url], { 436 | stdio: "ignore", 437 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:435 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3cda557bdd3f5e31a0d0449e5e5d5af5a1e99b0c/bin/commands/web-session.js#L435 433 | if (!hasExecutable("cmd")) 434 | return null; > 435 | return spawn("cmd", ["/c", "start", "", url], { 436 | stdio: "ignore", 437 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:442 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3cda557bdd3f5e31a0d0449e5e5d5af5a1e99b0c/bin/commands/web-session.js#L442 440 | if (!hasExecutable("xdg-open")) 441 | return null; > 442 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 443 | } 444 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec-var: bin/commands/web-session.js:442 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3cda557bdd3f5e31a0d0449e5e5d5af5a1e99b0c/bin/commands/web-session.js#L442 440 | if (!hasExecutable("xdg-open")) 441 | return null; > 442 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 443 | } 444 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec: bin/commands/web-session.js:457 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3cda557bdd3f5e31a0d0449e5e5d5af5a1e99b0c/bin/commands/web-session.js#L457 455 | if (!hasExecutable(candidate.command)) 456 | continue; > 457 | return spawn(candidate.command, [...(headless ? candidate.headless : []), url], { stdio: "ignore", detached: tru 458 | } 459 | return null;

HIGH silent-process-exec-var: bin/commands/web-session.js:457 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3cda557bdd3f5e31a0d0449e5e5d5af5a1e99b0c/bin/commands/web-session.js#L457 455 | if (!hasExecutable(candidate.command)) 456 | continue; > 457 | return spawn(candidate.command, [...(headless ? candidate.headless : []), url], { stdio: "ignore", detached: tru 458 | } 459 | return null;

HIGH silent-process-exec: bin/commands/web-session.js:466 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3cda557bdd3f5e31a0d0449e5e5d5af5a1e99b0c/bin/commands/web-session.js#L466 464 | const args = headless ? resolveHeadlessFlags(direct) : []; 465 | args.push(url); > 466 | return spawn(direct, args, { 467 | stdio: "ignore", 468 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:466 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3cda557bdd3f5e31a0d0449e5e5d5af5a1e99b0c/bin/commands/web-session.js#L466 464 | const args = headless ? resolveHeadlessFlags(direct) : []; 465 | args.push(url); > 466 | return spawn(direct, args, { 467 | stdio: "ignore", 468 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:482 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3cda557bdd3f5e31a0d0449e5e5d5af5a1e99b0c/bin/commands/web-session.js#L482 480 | } 481 | args.push(url); > 482 | return spawn(command, args, { 483 | stdio: "ignore", 484 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:482 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3cda557bdd3f5e31a0d0449e5e5d5af5a1e99b0c/bin/commands/web-session.js#L482 480 | } 481 | args.push(url); > 482 | return spawn(command, args, { 483 | stdio: "ignore", 484 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3cda557bdd3f5e31a0d0449e5e5d5af5a1e99b0c/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec-var: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3cda557bdd3f5e31a0d0449e5e5d5af5a1e99b0c/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3cda557bdd3f5e31a0d0449e5e5d5af5a1e99b0c/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec-var: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3cda557bdd3f5e31a0d0449e5e5d5af5a1e99b0c/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3cda557bdd3f5e31a0d0449e5e5d5af5a1e99b0c/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec-var: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3cda557bdd3f5e31a0d0449e5e5d5af5a1e99b0c/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3cda557bdd3f5e31a0d0449e5e5d5af5a1e99b0c/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

HIGH silent-process-exec-var: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3cda557bdd3f5e31a0d0449e5e5d5af5a1e99b0c/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.3

24 findings
HIGH env-spread: bin/commands/build-core.js:410 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/bin/commands/build-core.js#L410 408 | } 409 | function snapshotEnv() { > 410 | return { ...process.env }; 411 | } 412 | function applyEnv(nextEnv) {

HIGH silent-process-exec: bin/commands/web-session.js:430 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/bin/commands/web-session.js#L430 428 | if (!hasExecutable("open")) 429 | return null; > 430 | return spawn("open", [url], { stdio: "ignore", detached: true }); 431 | } 432 | if (process.platform == "win32") {

HIGH silent-process-exec-var: bin/commands/web-session.js:430 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/bin/commands/web-session.js#L430 428 | if (!hasExecutable("open")) 429 | return null; > 430 | return spawn("open", [url], { stdio: "ignore", detached: true }); 431 | } 432 | if (process.platform == "win32") {

HIGH silent-process-exec: bin/commands/web-session.js:435 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/bin/commands/web-session.js#L435 433 | if (!hasExecutable("cmd")) 434 | return null; > 435 | return spawn("cmd", ["/c", "start", "", url], { 436 | stdio: "ignore", 437 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:435 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/bin/commands/web-session.js#L435 433 | if (!hasExecutable("cmd")) 434 | return null; > 435 | return spawn("cmd", ["/c", "start", "", url], { 436 | stdio: "ignore", 437 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:442 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/bin/commands/web-session.js#L442 440 | if (!hasExecutable("xdg-open")) 441 | return null; > 442 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 443 | } 444 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec-var: bin/commands/web-session.js:442 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/bin/commands/web-session.js#L442 440 | if (!hasExecutable("xdg-open")) 441 | return null; > 442 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 443 | } 444 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec: bin/commands/web-session.js:457 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/bin/commands/web-session.js#L457 455 | if (!hasExecutable(candidate.command)) 456 | continue; > 457 | return spawn(candidate.command, [...(headless ? candidate.headless : []), url], { stdio: "ignore", detached: tru 458 | } 459 | return null;

HIGH silent-process-exec-var: bin/commands/web-session.js:457 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/bin/commands/web-session.js#L457 455 | if (!hasExecutable(candidate.command)) 456 | continue; > 457 | return spawn(candidate.command, [...(headless ? candidate.headless : []), url], { stdio: "ignore", detached: tru 458 | } 459 | return null;

HIGH silent-process-exec: bin/commands/web-session.js:466 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/bin/commands/web-session.js#L466 464 | const args = headless ? resolveHeadlessFlags(direct) : []; 465 | args.push(url); > 466 | return spawn(direct, args, { 467 | stdio: "ignore", 468 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:466 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/bin/commands/web-session.js#L466 464 | const args = headless ? resolveHeadlessFlags(direct) : []; 465 | args.push(url); > 466 | return spawn(direct, args, { 467 | stdio: "ignore", 468 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:482 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/bin/commands/web-session.js#L482 480 | } 481 | args.push(url); > 482 | return spawn(command, args, { 483 | stdio: "ignore", 484 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:482 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/bin/commands/web-session.js#L482 480 | } 481 | args.push(url); > 482 | return spawn(command, args, { 483 | stdio: "ignore", 484 | detached: true,

HIGH env-spread: bin/util.js:1235 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/bin/util.js#L1235 1233 | merged.fuzz.crashDir = appendPathSegment(config.fuzz.crashDir, "default"); 1234 | merged.fuzz.corpusDir = appendPathSegment(config.fuzz.corpusDir, "default"); > 1235 | const env = { 1236 | ...process.env, 1237 | ...config.env,

HIGH env-spread: bin/util.js:1255 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/bin/util.js#L1255 1253 | const merged = mergeRootConfig(config, modeOverride); 1254 | applyPerModeOutputDefaults(config, merged, modeOverride, modeName); > 1255 | const env = { 1256 | ...process.env, 1257 | ...merged.env,

HIGH silent-process-exec: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec-var: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec-var: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec-var: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

HIGH silent-process-exec-var: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/9525bd214f08272016724fc30fdc59207ad47ef7/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.1.2

24 findings
HIGH env-spread: bin/commands/build-core.js:410 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/bin/commands/build-core.js#L410 408 | } 409 | function snapshotEnv() { > 410 | return { ...process.env }; 411 | } 412 | function applyEnv(nextEnv) {

HIGH silent-process-exec: bin/commands/web-session.js:430 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/bin/commands/web-session.js#L430 428 | if (!hasExecutable("open")) 429 | return null; > 430 | return spawn("open", [url], { stdio: "ignore", detached: true }); 431 | } 432 | if (process.platform == "win32") {

HIGH silent-process-exec-var: bin/commands/web-session.js:430 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/bin/commands/web-session.js#L430 428 | if (!hasExecutable("open")) 429 | return null; > 430 | return spawn("open", [url], { stdio: "ignore", detached: true }); 431 | } 432 | if (process.platform == "win32") {

HIGH silent-process-exec: bin/commands/web-session.js:435 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/bin/commands/web-session.js#L435 433 | if (!hasExecutable("cmd")) 434 | return null; > 435 | return spawn("cmd", ["/c", "start", "", url], { 436 | stdio: "ignore", 437 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:435 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/bin/commands/web-session.js#L435 433 | if (!hasExecutable("cmd")) 434 | return null; > 435 | return spawn("cmd", ["/c", "start", "", url], { 436 | stdio: "ignore", 437 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:442 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/bin/commands/web-session.js#L442 440 | if (!hasExecutable("xdg-open")) 441 | return null; > 442 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 443 | } 444 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec-var: bin/commands/web-session.js:442 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/bin/commands/web-session.js#L442 440 | if (!hasExecutable("xdg-open")) 441 | return null; > 442 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 443 | } 444 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec: bin/commands/web-session.js:457 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/bin/commands/web-session.js#L457 455 | if (!hasExecutable(candidate.command)) 456 | continue; > 457 | return spawn(candidate.command, [...(headless ? candidate.headless : []), url], { stdio: "ignore", detached: tru 458 | } 459 | return null;

HIGH silent-process-exec-var: bin/commands/web-session.js:457 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/bin/commands/web-session.js#L457 455 | if (!hasExecutable(candidate.command)) 456 | continue; > 457 | return spawn(candidate.command, [...(headless ? candidate.headless : []), url], { stdio: "ignore", detached: tru 458 | } 459 | return null;

HIGH silent-process-exec: bin/commands/web-session.js:466 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/bin/commands/web-session.js#L466 464 | const args = headless ? resolveHeadlessFlags(direct) : []; 465 | args.push(url); > 466 | return spawn(direct, args, { 467 | stdio: "ignore", 468 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:466 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/bin/commands/web-session.js#L466 464 | const args = headless ? resolveHeadlessFlags(direct) : []; 465 | args.push(url); > 466 | return spawn(direct, args, { 467 | stdio: "ignore", 468 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:482 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/bin/commands/web-session.js#L482 480 | } 481 | args.push(url); > 482 | return spawn(command, args, { 483 | stdio: "ignore", 484 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:482 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/bin/commands/web-session.js#L482 480 | } 481 | args.push(url); > 482 | return spawn(command, args, { 483 | stdio: "ignore", 484 | detached: true,

HIGH env-spread: bin/util.js:1235 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/bin/util.js#L1235 1233 | merged.fuzz.crashDir = appendPathSegment(config.fuzz.crashDir, "default"); 1234 | merged.fuzz.corpusDir = appendPathSegment(config.fuzz.corpusDir, "default"); > 1235 | const env = { 1236 | ...process.env, 1237 | ...config.env,

HIGH env-spread: bin/util.js:1255 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/bin/util.js#L1255 1253 | const merged = mergeRootConfig(config, modeOverride); 1254 | applyPerModeOutputDefaults(config, merged, modeOverride, modeName); > 1255 | const env = { 1256 | ...process.env, 1257 | ...merged.env,

HIGH silent-process-exec: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec-var: lib/src/index.ts:896 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/lib/src/index.ts#L896 894 | const script = buildMacBrowserOpenScript(browserApp, url); 895 | if (!script.length) return null; > 896 | return spawn( 897 | "osascript", 898 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec-var: lib/src/index.ts:911 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/lib/src/index.ts#L911 909 | if (process.platform == "darwin") { 910 | if (!hasExecutable("open")) return null; > 911 | return spawn("open", [url], { stdio: "ignore", detached: true }); 912 | } 913 | if (process.platform == "win32") {

HIGH silent-process-exec: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec-var: lib/src/index.ts:915 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/lib/src/index.ts#L915 913 | if (process.platform == "win32") { 914 | if (!hasExecutable("cmd")) return null; > 915 | return spawn("cmd", ["/c", "start", "", url], { 916 | stdio: "ignore", 917 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

HIGH silent-process-exec-var: lib/src/index.ts:921 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/338a9ba61ffc4c3bed2e6a92d747cdeb538afcba/lib/src/index.ts#L921 919 | } 920 | if (!hasExecutable("xdg-open")) return null; > 921 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 922 | } 923 |

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.1.1

24 findings
HIGH env-spread: bin/commands/build-core.js:405 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/bin/commands/build-core.js#L405 403 | } 404 | function snapshotEnv() { > 405 | return { ...process.env }; 406 | } 407 | function applyEnv(nextEnv) {

HIGH silent-process-exec: bin/commands/web-session.js:430 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/bin/commands/web-session.js#L430 428 | if (!hasExecutable("open")) 429 | return null; > 430 | return spawn("open", [url], { stdio: "ignore", detached: true }); 431 | } 432 | if (process.platform == "win32") {

HIGH silent-process-exec-var: bin/commands/web-session.js:430 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/bin/commands/web-session.js#L430 428 | if (!hasExecutable("open")) 429 | return null; > 430 | return spawn("open", [url], { stdio: "ignore", detached: true }); 431 | } 432 | if (process.platform == "win32") {

HIGH silent-process-exec: bin/commands/web-session.js:435 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/bin/commands/web-session.js#L435 433 | if (!hasExecutable("cmd")) 434 | return null; > 435 | return spawn("cmd", ["/c", "start", "", url], { 436 | stdio: "ignore", 437 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:435 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/bin/commands/web-session.js#L435 433 | if (!hasExecutable("cmd")) 434 | return null; > 435 | return spawn("cmd", ["/c", "start", "", url], { 436 | stdio: "ignore", 437 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:442 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/bin/commands/web-session.js#L442 440 | if (!hasExecutable("xdg-open")) 441 | return null; > 442 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 443 | } 444 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec-var: bin/commands/web-session.js:442 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/bin/commands/web-session.js#L442 440 | if (!hasExecutable("xdg-open")) 441 | return null; > 442 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 443 | } 444 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec: bin/commands/web-session.js:457 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/bin/commands/web-session.js#L457 455 | if (!hasExecutable(candidate.command)) 456 | continue; > 457 | return spawn(candidate.command, [...(headless ? candidate.headless : []), url], { stdio: "ignore", detached: tru 458 | } 459 | return null;

HIGH silent-process-exec-var: bin/commands/web-session.js:457 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/bin/commands/web-session.js#L457 455 | if (!hasExecutable(candidate.command)) 456 | continue; > 457 | return spawn(candidate.command, [...(headless ? candidate.headless : []), url], { stdio: "ignore", detached: tru 458 | } 459 | return null;

HIGH silent-process-exec: bin/commands/web-session.js:466 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/bin/commands/web-session.js#L466 464 | const args = headless ? resolveHeadlessFlags(direct) : []; 465 | args.push(url); > 466 | return spawn(direct, args, { 467 | stdio: "ignore", 468 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:466 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/bin/commands/web-session.js#L466 464 | const args = headless ? resolveHeadlessFlags(direct) : []; 465 | args.push(url); > 466 | return spawn(direct, args, { 467 | stdio: "ignore", 468 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:482 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/bin/commands/web-session.js#L482 480 | } 481 | args.push(url); > 482 | return spawn(command, args, { 483 | stdio: "ignore", 484 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:482 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/bin/commands/web-session.js#L482 480 | } 481 | args.push(url); > 482 | return spawn(command, args, { 483 | stdio: "ignore", 484 | detached: true,

HIGH env-spread: bin/util.js:1210 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/bin/util.js#L1210 1208 | merged.fuzz.crashDir = appendPathSegment(config.fuzz.crashDir, "default"); 1209 | merged.fuzz.corpusDir = appendPathSegment(config.fuzz.corpusDir, "default"); > 1210 | const env = { 1211 | ...process.env, 1212 | ...config.env,

HIGH env-spread: bin/util.js:1230 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/bin/util.js#L1230 1228 | const merged = mergeRootConfig(config, modeOverride); 1229 | applyPerModeOutputDefaults(config, merged, modeOverride, modeName); > 1230 | const env = { 1231 | ...process.env, 1232 | ...merged.env,

HIGH silent-process-exec: lib/src/index.ts:838 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/lib/src/index.ts#L838 836 | const script = buildMacBrowserOpenScript(browserApp, url); 837 | if (!script.length) return null; > 838 | return spawn( 839 | "osascript", 840 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec-var: lib/src/index.ts:838 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/lib/src/index.ts#L838 836 | const script = buildMacBrowserOpenScript(browserApp, url); 837 | if (!script.length) return null; > 838 | return spawn( 839 | "osascript", 840 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec: lib/src/index.ts:851 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/lib/src/index.ts#L851 849 | if (process.platform == "darwin") { 850 | if (!hasExecutable("open")) return null; > 851 | return spawn("open", [url], { stdio: "ignore", detached: true }); 852 | } 853 | if (process.platform == "win32") {

HIGH silent-process-exec-var: lib/src/index.ts:851 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/lib/src/index.ts#L851 849 | if (process.platform == "darwin") { 850 | if (!hasExecutable("open")) return null; > 851 | return spawn("open", [url], { stdio: "ignore", detached: true }); 852 | } 853 | if (process.platform == "win32") {

HIGH silent-process-exec: lib/src/index.ts:855 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/lib/src/index.ts#L855 853 | if (process.platform == "win32") { 854 | if (!hasExecutable("cmd")) return null; > 855 | return spawn("cmd", ["/c", "start", "", url], { 856 | stdio: "ignore", 857 | detached: true,

HIGH silent-process-exec-var: lib/src/index.ts:855 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/lib/src/index.ts#L855 853 | if (process.platform == "win32") { 854 | if (!hasExecutable("cmd")) return null; > 855 | return spawn("cmd", ["/c", "start", "", url], { 856 | stdio: "ignore", 857 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:861 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/lib/src/index.ts#L861 859 | } 860 | if (!hasExecutable("xdg-open")) return null; > 861 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 862 | } 863 |

HIGH silent-process-exec-var: lib/src/index.ts:861 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/635ff4275df9d962aa44fba2fcb31e5a55bd410f/lib/src/index.ts#L861 859 | } 860 | if (!hasExecutable("xdg-open")) return null; > 861 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 862 | } 863 |

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.1.0

21 findings
HIGH silent-process-exec: bin/commands/web-session.js:430 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3a8330b33e378a2faf1e49aa0ecbd9d8c3cd6c3a/bin/commands/web-session.js#L430 428 | if (!hasExecutable("open")) 429 | return null; > 430 | return spawn("open", [url], { stdio: "ignore", detached: true }); 431 | } 432 | if (process.platform == "win32") {

HIGH silent-process-exec-var: bin/commands/web-session.js:430 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3a8330b33e378a2faf1e49aa0ecbd9d8c3cd6c3a/bin/commands/web-session.js#L430 428 | if (!hasExecutable("open")) 429 | return null; > 430 | return spawn("open", [url], { stdio: "ignore", detached: true }); 431 | } 432 | if (process.platform == "win32") {

HIGH silent-process-exec: bin/commands/web-session.js:435 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3a8330b33e378a2faf1e49aa0ecbd9d8c3cd6c3a/bin/commands/web-session.js#L435 433 | if (!hasExecutable("cmd")) 434 | return null; > 435 | return spawn("cmd", ["/c", "start", "", url], { 436 | stdio: "ignore", 437 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:435 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3a8330b33e378a2faf1e49aa0ecbd9d8c3cd6c3a/bin/commands/web-session.js#L435 433 | if (!hasExecutable("cmd")) 434 | return null; > 435 | return spawn("cmd", ["/c", "start", "", url], { 436 | stdio: "ignore", 437 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:442 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3a8330b33e378a2faf1e49aa0ecbd9d8c3cd6c3a/bin/commands/web-session.js#L442 440 | if (!hasExecutable("xdg-open")) 441 | return null; > 442 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 443 | } 444 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec-var: bin/commands/web-session.js:442 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3a8330b33e378a2faf1e49aa0ecbd9d8c3cd6c3a/bin/commands/web-session.js#L442 440 | if (!hasExecutable("xdg-open")) 441 | return null; > 442 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 443 | } 444 | function openWithInstalledBrowser(url, headless) {

HIGH silent-process-exec: bin/commands/web-session.js:457 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3a8330b33e378a2faf1e49aa0ecbd9d8c3cd6c3a/bin/commands/web-session.js#L457 455 | if (!hasExecutable(candidate.command)) 456 | continue; > 457 | return spawn(candidate.command, [...(headless ? candidate.headless : []), url], { stdio: "ignore", detached: tru 458 | } 459 | return null;

HIGH silent-process-exec-var: bin/commands/web-session.js:457 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3a8330b33e378a2faf1e49aa0ecbd9d8c3cd6c3a/bin/commands/web-session.js#L457 455 | if (!hasExecutable(candidate.command)) 456 | continue; > 457 | return spawn(candidate.command, [...(headless ? candidate.headless : []), url], { stdio: "ignore", detached: tru 458 | } 459 | return null;

HIGH silent-process-exec: bin/commands/web-session.js:466 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3a8330b33e378a2faf1e49aa0ecbd9d8c3cd6c3a/bin/commands/web-session.js#L466 464 | const args = headless ? resolveHeadlessFlags(direct) : []; 465 | args.push(url); > 466 | return spawn(direct, args, { 467 | stdio: "ignore", 468 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:466 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3a8330b33e378a2faf1e49aa0ecbd9d8c3cd6c3a/bin/commands/web-session.js#L466 464 | const args = headless ? resolveHeadlessFlags(direct) : []; 465 | args.push(url); > 466 | return spawn(direct, args, { 467 | stdio: "ignore", 468 | detached: true,

HIGH silent-process-exec: bin/commands/web-session.js:482 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3a8330b33e378a2faf1e49aa0ecbd9d8c3cd6c3a/bin/commands/web-session.js#L482 480 | } 481 | args.push(url); > 482 | return spawn(command, args, { 483 | stdio: "ignore", 484 | detached: true,

HIGH silent-process-exec-var: bin/commands/web-session.js:482 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3a8330b33e378a2faf1e49aa0ecbd9d8c3cd6c3a/bin/commands/web-session.js#L482 480 | } 481 | args.push(url); > 482 | return spawn(command, args, { 483 | stdio: "ignore", 484 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:820 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3a8330b33e378a2faf1e49aa0ecbd9d8c3cd6c3a/lib/src/index.ts#L820 818 | const script = buildMacBrowserOpenScript(browserApp, url); 819 | if (!script.length) return null; > 820 | return spawn( 821 | "osascript", 822 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec-var: lib/src/index.ts:820 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3a8330b33e378a2faf1e49aa0ecbd9d8c3cd6c3a/lib/src/index.ts#L820 818 | const script = buildMacBrowserOpenScript(browserApp, url); 819 | if (!script.length) return null; > 820 | return spawn( 821 | "osascript", 822 | script.flatMap((line) => ["-e", line]),

HIGH silent-process-exec: lib/src/index.ts:833 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3a8330b33e378a2faf1e49aa0ecbd9d8c3cd6c3a/lib/src/index.ts#L833 831 | if (process.platform == "darwin") { 832 | if (!hasExecutable("open")) return null; > 833 | return spawn("open", [url], { stdio: "ignore", detached: true }); 834 | } 835 | if (process.platform == "win32") {

HIGH silent-process-exec-var: lib/src/index.ts:833 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3a8330b33e378a2faf1e49aa0ecbd9d8c3cd6c3a/lib/src/index.ts#L833 831 | if (process.platform == "darwin") { 832 | if (!hasExecutable("open")) return null; > 833 | return spawn("open", [url], { stdio: "ignore", detached: true }); 834 | } 835 | if (process.platform == "win32") {

HIGH silent-process-exec: lib/src/index.ts:837 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3a8330b33e378a2faf1e49aa0ecbd9d8c3cd6c3a/lib/src/index.ts#L837 835 | if (process.platform == "win32") { 836 | if (!hasExecutable("cmd")) return null; > 837 | return spawn("cmd", ["/c", "start", "", url], { 838 | stdio: "ignore", 839 | detached: true,

HIGH silent-process-exec-var: lib/src/index.ts:837 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3a8330b33e378a2faf1e49aa0ecbd9d8c3cd6c3a/lib/src/index.ts#L837 835 | if (process.platform == "win32") { 836 | if (!hasExecutable("cmd")) return null; > 837 | return spawn("cmd", ["/c", "start", "", url], { 838 | stdio: "ignore", 839 | detached: true,

HIGH silent-process-exec: lib/src/index.ts:843 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3a8330b33e378a2faf1e49aa0ecbd9d8c3cd6c3a/lib/src/index.ts#L843 841 | } 842 | if (!hasExecutable("xdg-open")) return null; > 843 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 844 | } 845 |

HIGH silent-process-exec-var: lib/src/index.ts:843 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/JairusSW/as-test/blob/3a8330b33e378a2faf1e49aa0ecbd9d8c3cd6c3a/lib/src/index.ts#L843 841 | } 842 | if (!hasExecutable("xdg-open")) return null; > 843 | return spawn("xdg-open", [url], { stdio: "ignore", detached: true }); 844 | } 845 |

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.16

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.15

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.14

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.13

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.11

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.5.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.5.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.5.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.5.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.5.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.