CodeVetter · Repo Unpack · Risk map
trekhleb/javascript-algorithms
Security exposure is minimal — no network, auth, secrets, or shell-out; the only file IO is the seam-carving test reading local PNG fixtures. The real risks are correctness and maintainability quirks: deliberately simplified primitives (char-sum hash, first-element pivot), mutating APIs, a missing package entrypoint, mixed test-dir naming, and a coverage gate that only runs in CI. Educational intent means several implementations trade robustness for clarity.
- package.json declares "main": "index.js" but no index.js exists at the root, and there is no "private" flag or exports map — the package cannot actually be require()'d as published; consumers must deep-import module files.
- HashTable.hash uses a naive sum of char codes mod bucket count with a tiny default size of 32, so real-world key sets collide heavily; the code comments acknowledge this and point to polynomial hashing as the better approach.
- QuickSort shifts elements out of the array in a while loop (array.shift() is O(n) per call) and always picks the first element as pivot — clean for teaching but quadratic on already-sorted input; SortTester's sortedArr/reverseArr fixtures exercise exactly that worst case.
- Several APIs mutate in place, which can surprise consumers: Graph.reverse() deletes and re-adds every edge mutating the graph, resizeImageWidth rewrites img.data in place while reporting a smaller logical size, and LinkedList.reverse() rewrites node links.
- Graph.addVertex and addEdge throw generic Errors on duplicates ('Vertex has already been added before', 'Edge has already been added before') — callers must wrap or pre-check, and the error type gives no distinguishing subclass.
- depthFirstSearch uses unbounded recursion (depthFirstSearchRecursive), so pathological deep graphs can hit the Node call-stack limit; the iterative alternative is not provided. (inferred)
- Test-directory naming is inconsistent (`__test__` vs `__tests__`) and helper files rely on precise filename conventions to avoid being executed as specs — a misplaced rename could silently drop or break tests. (inferred)
- The only filesystem access in the codebase is the seam-carving spec's fs.createReadStream of repo-relative PNG fixtures (./src/algorithms/image-processing/seam-carving/__tests__/test-image-*.png), so tests are CWD-sensitive — running jest from another directory breaks that spec.
- Coverage enforcement (100/95/100/100) runs only via `npm run coverage` in CI; local `npm test` skips coverage and pre-commit runs only lint, so coverage regressions are caught late.
- .eslintrc carries a react version setting and airbnb's jsx-a11y plugin chain despite zero JSX/React code in the repo — dead config that could confuse tooling choices.