CodeVetter · Repo Unpack · Risk map
eslint/eslint
These observations identify execution and persistence boundaries requiring care; they are not confirmed vulnerabilities. Configuration and extension modules execute within the host process, and convenience commands can invoke external package tooling. Filesystem destinations are resolved from caller-controlled paths rather than constrained to a repository root. Fixing, caching, suppressions, and concurrency have conditions that can materially change results or side effects.
- Configuration discovery searches upward from target directories and imports executable modules; explicit config paths resolve against cwd, so config loading can cross the repository boundary.
- CLI parser/plugin selection and formatter loading import caller-selected modules; imported code therefore participates in the host runtime rather than a separate analysis sandbox.
- --init and --mcp synchronously spawn npm/npx with inherited stdio and propagate status/signals; --inspect-config similarly invokes npx. These paths delegate package acquisition/execution to external tools.
- outputFixes() writes any result containing string output and an absolute filePath; report output resolves against process.cwd() and creates parent directories. Neither shown writer enforces a repository-root boundary.
- lintFiles() can delete the resolved cache file when caching is disabled; getCacheFile() accepts absolute or cwd-relative destinations, making cacheLocation relevant even outside cache-enabled runs.
- Autofix convergence is bounded and detects return to text from two iterations earlier; fix-range application rejects conflicts. The implementation does not establish general convergence or semantic equivalence of rule-provided fixes.
- Suppression loading performs JSON.parse() without shape validation in load(), and save() directly overwrites the file. Hypothesis: malformed-but-valid JSON or interrupted/concurrent writes merit focused robustness checks; these were not demonstrated failures. (inferred)
- The low-overhead visitor branch tags listener functions with rule IDs and falls back to wrappers when functions are shared across rules; changes here must preserve attribution for shared visitors, timing, and statistics.