CodeVetter · Repo Unpack · Risk map
istanbuljs/nyc
The sensitive boundaries inspected are local module execution, environment propagation, process hooks, and filesystem operations. Findings below are source observations, not confirmed vulnerabilities. Coverage can become incomplete through permissive instrumentation failures or suppressed artifact-loading errors. Cleanup, tree copying, and global hook state deserve focused review because their effects extend beyond a single transformed file.
- Configuration can select a dynamically required instrumenter, and --require modules execute in the parent or child setup paths; these are executable trust boundaries rather than data-only configuration.
- reset() recursively removes the resolved temporary directory when NYC_CWD is absent; configured temporary/report paths are resolved without a containment check, while instrument --delete has a separate working-directory guard.
- complete-copy globs dotfiles and copies files beyond the instrumentation selection, excluding .git and the output tree; docs explicitly state symlinks are dereferenced, so copy scope is broader than coverage scope.
- _transformFactory() returns original source after instrumentation errors unless exitOnError is set; parser-plugin tests explicitly expect a successful uninstrumented result when the required plugin is unset.
- coverageFiles() lists every directory entry, and coverageFileLoad() converts any read, parse, or cached-map reload error into {}; cached source-map read failures are also suppressed and remembered.
- NYC_CONFIG and NYC_CONFIG_OVERRIDE are parsed without local validation in the child bootstrap, and overrides are serialized back into NYC_CONFIG; environment configuration controls the constructed NYC instance.
- wrap() documents a spawn-wrap limitation in forcing NYC_PROCESS_ID propagation; hook installation, global coverage, and require-extension state are process-wide, and tests explicitly reset require caches/loaders between cases.
- Legacy guidance remains alongside current implementation: coverageData() still carries a 'Remove from nyc v16' TODO, profiling docs discuss index.covered.js, and .travis.yml lists Node 8/10 despite the current Node 20/>=22 engine range.