registry / Credential exfiltration / @bigbinary/neeto-playwright-reporter
@bigbinary/neeto-playwright-reporter
The custom playwright reporter for neeto-playwright-dashboard.
This report shows the evidence for @bigbinary/neeto-playwright-reporter@4.0.7. 2 of 13 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe reporter places the NeetoPlaydash API key in Honeybadger context and sends that context with runtime error notices to Honeybadger. This is credential disclosure to a host outside the key’s service.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Reporter initialization followed by a runtime error that reaches the error-reporting helper.
Impact
A third-party service receives a credential belonging to the NeetoPlaydash service.
Mechanism
Configuration, including the API key read from NEETO_API_KEY, is stored as Honeybadger context. Reportable errors trigger Honeybadger notices, which include stored context and are posted to api.honeybadger.io.
Attack narrative
The reporter reads NEETO_API_KEY (or an explicitly supplied API key), then stores its configuration in Honeybadger context during initialization. When a reportable runtime error occurs, it creates a Honeybadger notice; stored context is merged into the notice and sent to api.honeybadger.io. This exposes the NeetoPlaydash credential to a separate service.
AI rationale
The reporter places the NeetoPlaydash API key in Honeybadger context and sends that context with runtime error notices to Honeybadger. This is credential disclosure to a host outside the key’s service.
Evidence
index.cjs.js
Network endpoints1
api.honeybadger.io/v1/notices/js
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The reporter reads NEETO_API_KEY into its configuration.
- On initialization, it configures Honeybadger and adds the full reporter configuration, including apiKey, to Honeybadger context.
- On runtime errors, the reporter adds error details to context and calls notifyAsync for reportable errors.
- Honeybadger merges its stored context into notices and sends notices to its configured endpoint.
Evidence against
- The package is a Playwright reporter for the NeetoPlaydash dashboard.
- Its shell command execution is used to obtain Git commit and branch metadata for reports.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flaggedindex.cjs.jsView file
1"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
High
1"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
index.cjs.jsView on unpkg · L11"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
...
L7: */
L8: function(e){var t,n,o,a=qe.exports,r=i.extname,s=/^\s*([^;\s]*)(?:;|\s|$)/,c=/^text\//i;function u(e){if(!e||"string"!=typeof e)return!1;var t=s.exec(e),n=t&&a[t[1].toLowerCase()];...
L9: /*! https://mths.be/wtf8 v1.0.1 by @mathias */Wp=Jp,Vp=Jp.exports,function(e){var t=Vp,n=Wp&&Wp.exports==t&&Wp,i="object"==typeof F&&F;i.global!==i&&i.window!==i||(e=i);var o,a,r,s...
Findings
10 High3 Medium6 Low
HighChild Processindex.cjs.js
HighShell
HighSame File Env Network Executionindex.cjs.js
HighCommand Output Exfiltrationindex.cjs.js
HighCross File Remote Execution Contextbin/neetoplaydash.mjs
HighTrigger Reachable Command Output Exfiltrationindex.cjs.js
HighKnown Malware Source Similarityindex.cjs.js
HighKnown Malware Source Similarityindex.js
HighKnown Malware Source Similaritybin/neetoplaydash.mjs
HighKnown Malware Source Fingerprint Signatureindex.cjs.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @bigbinary/neeto-playwright-reporter@4.0.7.
The versions list below shows the verdict for each recorded version.
- Avoid installing @bigbinary/neeto-playwright-reporter@4.0.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.