CodeVetter · Repo Unpack · Risk map
typescript-eslint/typescript-eslint
These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities or reproduced failures. Sensitive boundaries include filesystem-backed compiler services, third-party browser code, shell-based integration tooling, and privileged workflow artifacts. Several playground call sites expose concrete inconsistencies suitable for targeted verification. Compiler internals and process-wide caches also require compatibility-focused review.
- ProjectService inherits tsserver.sys filesystem access and stubs watchers rather than confining reads to the repository; TypeScript plugin loading is blocked by default but can be enabled, and a custom host is supported.
- throttleOpenedFileCleanup replaces undocumented cleanup methods and openClientFileWithNormalizedPath; compatibility depends on TypeScript internal method names and signatures, while inspected tests use a fake service.
- The playground executes an external loader script and loads Monaco/sandbox code from TypeScript-hosted domains; loadSandbox handles HEAD/module failures but its inspected implementation installs no script onerror handler.
- Potential fix-action failure: LoadedEditor passes editor.getValue() to triggerFix, but triggerFix treats that argument as a filename and reads it from the virtual filesystem; ordinary source text therefore appears unable to select the input file. (inferred)
- applyEslintConfig pushes resolved presets into a persistent eslintExtendedConfig array without clearing it on configuration changes; the watcher repeatedly calls this function before relinting.
- Local-state restoration checks fileType against the literal 'true' although the writer stores newState.fileType; sourceType is written but not restored by the inspected reader, and localStorage.setItem is outside a try/catch.
- Apply Review Labels runs with pull-requests:write, downloads review-intent from a completed workflow, appends its contents directly to GITHUB_OUTPUT, and uses the resulting pr_number/intent outputs for label actions; the artifact boundary deserves validation review.
- Integration execution writes beneath os.tmpdir() or the home-directory fallback, packs packages and installs dependencies with shell-enabled child processes; it is materially broader than a read-only source check.