Spawning verdaccio with detached: true without calling unref() will prevent the parent process from exiting until the child exits, defeating the purpose of background execution. Additionally, calling kill() on line 67 may not properly terminate a detached process.

Fix by either:

1. Removing detached: true if the process should be tied to parent lifecycle
2. Or calling verdaccioProcess.unref() after spawn and using process.kill(-verdaccioProcess.pid) to kill the process group:

verdaccioProcess = spawn(..., { stdio: 'ignore', detached: true });
verdaccioProcess.unref();

// In teardown:
if (verdaccioProcess && verdaccioProcess.pid) {
  process.kill(-verdaccioProcess.pid);
}

Spotted by Graphite



Is this helpful? React 👍 or 👎 to let us know.

Race condition: Multiple overlapping fetch requests can occur if the async fetch takes longer than 50ms. Each interval tick starts a new async operation without waiting for previous ones to complete. This could spam the registry with requests during startup.

const interval = setInterval(async () => {
  try {
    const response = await fetch(registryUrl);
    if (response.ok) {
      clearInterval(interval);
      clearTimeout(timeout);
      console.log('Local registry is ready.');
      resolve();
    }
  } catch {
    // Registry not up yet
  }
}, 50);

Fix by using a flag to prevent concurrent checks:

let checking = false;
const interval = setInterval(async () => {
  if (checking) return;
  checking = true;
  try {
    const response = await fetch(registryUrl);
    if (response.ok) {
      clearInterval(interval);
      clearTimeout(timeout);
      console.log('Local registry is ready.');
      resolve();
    }
  } catch {
    // Registry not up yet
  } finally {
    checking = false;
  }
}, 50);

Spotted by Graphite



Is this helpful? React 👍 or 👎 to let us know.

Command string injection vulnerability: publishVersion comes from process.env.PUBLISHED_VERSION without validation and is directly interpolated into a shell command. If an attacker controls this environment variable, they can execute arbitrary commands.

const releaseCommand = `pnpm nx-release --local ${publishVersion}`;

Fix by passing as a proper argument array or validating the input:

const publishVersion = process.env.PUBLISHED_VERSION ?? 'major';
if (!/^(major|minor|patch|\d+\.\d+\.\d+)$/.test(publishVersion)) {
  throw new Error(`Invalid PUBLISHED_VERSION: ${publishVersion}`);
}
const releaseCommand = `pnpm nx-release --local ${publishVersion}`;

Spotted by Graphite



Is this helpful? React 👍 or 👎 to let us know.