This is a test script that runs the project's own test files one by one. The list of files to run is fixed in the code, and no outside input is used to build the command, so there is no security risk here.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.node-shell in this repository.
Contextual assessment: The matched execSync call is in a test-runner script. The command string is built from a hardcoded list of test file names joined with the script's own directory path. No external or user-controlled input reaches the command argument, so there is no command injection surface. Running child node processes to execute test files is the normal purpose of a test harness.
Hardcoded test file list used for child process execution
low risk · high confidence
The script only runs a fixed set of test files from its own folder. Nothing a user could influence ends up in the command, so this is safe.
Technical assessment
The tests array is a static list of file names. The only variable interpolated into the execSync command is testPath, derived from join(__dirname, test) where test comes from that static array. There is no path traversal or injection vector because no attacker-controlled data participates.