# Risk map — istanbuljs/nyc

> Canonical page: https://codevetter.com/unpack/nyc/risk-map

# Risk map — istanbuljs/nyc

Scanned commit 908620475199fa7b9ea0ea8b21d6d8ad6921e3ae (2026-05-17). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The sensitive boundaries inspected are local module execution, environment propagation, process hooks, and filesystem operations. Findings below are source observations, not confirmed vulnerabilities. Coverage can become incomplete through permissive instrumentation failures or suppressed artifact-loading errors. Cleanup, tree copying, and global hook state deserve focused review because their effects extend beyond a single transformed file.
- Configuration can select a dynamically required instrumenter, and --require modules execute in the parent or child setup paths; these are executable trust boundaries rather than data-only configuration. — [index.js#L45-L47](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/index.js#L45-L47) [index.js#L122-L132](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/index.js#L122-L132) [bin/nyc.js#L56-L70](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/bin/nyc.js#L56-L70) [lib/commands/instrument.js#L53-L58](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/lib/commands/instrument.js#L53-L58)
- reset() recursively removes the resolved temporary directory when NYC_CWD is absent; configured temporary/report paths are resolved without a containment check, while instrument --delete has a separate working-directory guard. — [index.js#L352-L357](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/index.js#L352-L357) [index.js#L532-L537](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/index.js#L532-L537) [lib/commands/instrument.js#L34-L40](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/lib/commands/instrument.js#L34-L40)
- complete-copy globs dotfiles and copies files beyond the instrumentation selection, excluding .git and the output tree; docs explicitly state symlinks are dereferenced, so copy scope is broader than coverage scope. — [index.js#L239-L261](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/index.js#L239-L261) [docs/instrument.md#L25-L28](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/docs/instrument.md#L25-L28) [test/instrument.js#L90-L106](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/test/instrument.js#L90-L106)
- _transformFactory() returns original source after instrumentation errors unless exitOnError is set; parser-plugin tests explicitly expect a successful uninstrumented result when the required plugin is unset. — [index.js#L299-L308](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/index.js#L299-L308) [test/parser-plugins.js#L21-L28](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/test/parser-plugins.js#L21-L28)
- coverageFiles() lists every directory entry, and coverageFileLoad() converts any read, parse, or cached-map reload error into {}; cached source-map read failures are also suppressed and remembered. — [index.js#L508-L519](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/index.js#L508-L519) [lib/source-maps.js#L64-L76](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/lib/source-maps.js#L64-L76)
- NYC_CONFIG and NYC_CONFIG_OVERRIDE are parsed without local validation in the child bootstrap, and overrides are serialized back into NYC_CONFIG; environment configuration controls the constructed NYC instance. — [lib/wrap.js#L5-L28](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/lib/wrap.js#L5-L28) [index.js#L42-L69](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/index.js#L42-L69)
- wrap() documents a spawn-wrap limitation in forcing NYC_PROCESS_ID propagation; hook installation, global coverage, and require-extension state are process-wide, and tests explicitly reset require caches/loaders between cases. — [index.js#L34-L38](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/index.js#L34-L38) [index.js#L325-L340](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/index.js#L325-L340) [index.js#L374-L384](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/index.js#L374-L384) [test/helpers/reset-state.js#L14-L29](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/test/helpers/reset-state.js#L14-L29)
- Legacy guidance remains alongside current implementation: coverageData() still carries a 'Remove from nyc v16' TODO, profiling docs discuss index.covered.js, and .travis.yml lists Node 8/10 despite the current Node 20/>=22 engine range. — [index.js#L522-L529](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/index.js#L522-L529) [docs/profiling.md#L67-L79](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/docs/profiling.md#L67-L79) [.travis.yml#L5-L8](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/.travis.yml#L5-L8) [package.json#L99-L101](https://github.com/istanbuljs/nyc/blob/908620475199fa7b9ea0ea8b21d6d8ad6921e3ae/package.json#L99-L101)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)