registry / @bigbinary/neeto-playwright-reporter / 3.3.2
@bigbinary/neeto-playwright-reporter@3.3.2
The custom playwright reporter for neeto-playwright-dashboard.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe scanner's credential and command findings correspond to an explicit Playwright reporting and orchestration integration, not automatic install-time behavior. No malicious chain, harvesting, persistence, or payload execution was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the neetoplaydash CLI or configures the Playwright reporter.
Impact
Test metadata and caller-supplied authentication values are sent to the configured NeetoPlaydash service as part of the requested integration.
Mechanism
Authenticated test-reporting and shard-distribution requests.
AI rationale
The scanner's credential and command findings correspond to an explicit Playwright reporting and orchestration integration, not automatic install-time behavior. No malicious chain, harvesting, persistence, or payload execution was found.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The explicit CLI sends shard test metadata and caller-provided API credentials to the NeetoPlaydash endpoint.
- The CLI invokes Playwright through a shell, but only after the user runs the neetoplaydash command.
- The reporter obtains its project key, API key, and CI build ID from explicit configuration or environment variables.
Evidence against
- The manifest has no preinstall, install, or postinstall hook; its only lifecycle script is prepare for Husky.
- The network request is a named smart-orchestration API call using the supplied project and API keys.
- The temporary test-list file is created only during the explicit CLI run and is deleted afterward.
- No source evidence shows secret harvesting, persistence, remote payload loading, or destructive behavior.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
8 flaggedindex.cjs.jsView file
1"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
High
1"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
index.cjs.jsView on unpkg · L11"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
Findings
2 Critical6 High4 Medium5 Low
CriticalCredential Exfiltrationbin/smartOrchestration.js
CriticalTrigger Reachable Dangerous Capabilitybin/smartOrchestration.js
HighChild Processindex.cjs.js
HighShell
HighSame File Env Network Executionindex.cjs.js
HighCommand Output Exfiltrationindex.cjs.js
HighTrigger Reachable Credential Exfiltrationbin/smartOrchestration.js
HighTrigger Reachable Command Output Exfiltrationindex.cjs.js
MediumDynamic Requireindex.cjs.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @bigbinary/neeto-playwright-reporter@3.3.2.
See all versions of @bigbinary/neeto-playwright-reporter for other recorded verdicts.
- Review the evidence and your use of @bigbinary/neeto-playwright-reporter@3.3.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.