# Risk map — stryker-mutator/stryker-js

> Canonical page: https://codevetter.com/unpack/stryker-js/risk-map

# Risk map — stryker-mutator/stryker-js

Scanned commit f2a49ff02437e3b7fe2682dba808ac93039895bf (2026-09-11). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The inspected sensitive boundaries are imported project code, shell commands, inherited worker environments, filesystem writes, JSON-RPC, and dashboard uploads. The sandbox is a project execution directory with dependency links and an optional in-place mode. Observations here describe source behavior and review hotspots, not confirmed vulnerabilities. Partial inspection does not establish a repository-wide absence of authentication, validation, or security tests.
- JavaScript configuration and plugin descriptors execute through dynamic module imports, including resolved absolute/relative paths; configuration or plugin selection therefore crosses a trusted-code execution boundary. — [packages/core/src/config/config-reader.ts#L168-L175](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/core/src/config/config-reader.ts#L168-L175) [packages/core/src/di/plugin-loader.ts#L104-L120](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/core/src/di/plugin-loader.ts#L104-L120) [packages/core/src/di/plugin-loader.ts#L169-L177](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/core/src/di/plugin-loader.ts#L169-L177)
- CommandTestRunner passes configured command text to child_process.exec with the current environment; Sandbox also executes buildCommand. These are intentional shell/process execution surfaces requiring trusted project configuration. — [packages/core/src/test-runner/command-test-runner.ts#L94-L106](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/core/src/test-runner/command-test-runner.ts#L94-L106) [packages/core/src/sandbox/sandbox.ts#L102-L114](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/core/src/sandbox/sandbox.ts#L102-L114)
- inPlace selects cwd, backs up changed files, overwrites originals, and restores backups on disposal; original-file recovery is a high-impact lifecycle boundary. — [packages/core/src/sandbox/sandbox.ts#L55-L64](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/core/src/sandbox/sandbox.ts#L55-L64) [packages/core/src/sandbox/sandbox.ts#L166-L195](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/core/src/sandbox/sandbox.ts#L166-L195) [packages/core/src/fs/project-file.ts#L69-L94](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/core/src/fs/project-file.ts#L69-L94)
- Sandbox shares node_modules through symlinks and may locate dependencies in parent directories, while worker forks inherit process.env; the inspected mechanisms provide execution separation without removing host dependencies or environment access. — [packages/core/src/sandbox/sandbox.ts#L118-L156](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/core/src/sandbox/sandbox.ts#L118-L156) [packages/core/src/child-proxy/child-process-proxy.ts#L75-L84](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/core/src/child-proxy/child-process-proxy.ts#L75-L84)
- The inspected server start path registers configure/discover/mutationTest directly and accepts socket connections without an authentication check there; CLI defaults to localhost but permits an address override. — [packages/core/src/stryker-server.ts#L127-L149](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/core/src/stryker-server.ts#L127-L149) [packages/core/src/stryker-server.ts#L188-L199](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/core/src/stryker-server.ts#L188-L199) [packages/core/src/stryker-cli.ts#L111-L119](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/core/src/stryker-cli.ts#L111-L119)
- Incremental reports are JSON-parsed without schema/version validation, explicitly noted by a TODO, and their configured path is written with recursive parent-directory creation; malformed cache input can propagate errors beyond simple parsing. — [packages/core/src/fs/project-reader.ts#L412-L432](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/core/src/fs/project-reader.ts#L412-L432) [packages/core/src/fs/project-reader.ts#L453-L465](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/core/src/fs/project-reader.ts#L453-L465) [packages/core/src/reporters/mutation-test-report-helper.ts#L189-L199](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/core/src/reporters/mutation-test-report-helper.ts#L189-L199)
- Full dashboard uploads can include original sources, tests, configuration, and projectRoot; DashboardReporterClient sends an X-Api-Key from STRYKER_DASHBOARD_API_KEY to configured baseUrl and trace-logs the serialized report. — [packages/core/src/reporters/dashboard-reporter/dashboard-reporter.ts#L56-L66](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/core/src/reporters/dashboard-reporter/dashboard-reporter.ts#L56-L66) [packages/core/src/reporters/mutation-test-report-helper.ts#L243-L254](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/core/src/reporters/mutation-test-report-helper.ts#L243-L254) [packages/core/src/reporters/dashboard-reporter/dashboard-reporter-client.ts#L41-L57](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/core/src/reporters/dashboard-reporter/dashboard-reporter-client.ts#L41-L57) [packages/core/src/reporters/dashboard-reporter/dashboard-reporter-client.ts#L73-L82](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/core/src/reporters/dashboard-reporter/dashboard-reporter-client.ts#L73-L82)
- Vitest integration branches on framework versions, accesses ctx.state internals, and clears filesMap as an acknowledged hack; baseline path remapping separately assumes type-check suppression shifts test lines by exactly one. — [packages/vitest-runner/src/vitest-test-runner.ts#L94-L118](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/vitest-runner/src/vitest-test-runner.ts#L94-L118) [packages/vitest-runner/src/vitest-test-runner.ts#L290-L294](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/vitest-runner/src/vitest-test-runner.ts#L290-L294) [packages/core/src/process/3-dry-run-executor.ts#L196-L204](https://github.com/stryker-mutator/stryker-js/blob/f2a49ff02437e3b7fe2682dba808ac93039895bf/packages/core/src/process/3-dry-run-executor.ts#L196-L204)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)