registry / @bigbinary/neeto-playwright-reporter / 3.3.3
@bigbinary/neeto-playwright-reporter@3.3.3
The custom playwright reporter for neeto-playwright-dashboard.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe scanner findings correspond to an explicit Playwright reporting and sharding workflow, not covert credential theft or install-time execution. Source inspection found no automatic registry-install hook or other concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the neetoplaydash CLI with Playwright and shard settings.
Impact
Test identifiers and shard metadata are sent to the configured reporting service; no unconsented install-time behavior was found.
Mechanism
Authenticated test-sharding request to the configured Neeto dashboard service.
AI rationale
The scanner findings correspond to an explicit Playwright reporting and sharding workflow, not covert credential theft or install-time execution. Source inspection found no automatic registry-install hook or other concrete malicious behavior.
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The optional CLI posts test-sharding data to the Neeto service using an API key and project key supplied by the user.
- The bundled reporter includes child-process support, while the CLI uses process execution to run Playwright.
- The package has a prepare hook, but it is a development Husky hook rather than an npm install lifecycle hook.
Evidence against
- No preinstall, install, or postinstall hook is present.
- The network call is reached only through the user-invoked neetoplaydash CLI and requires explicit configuration.
- The endpoint and transmitted keys are aligned with the stated Playwright dashboard reporter function.
- No self-dependency, hidden payload download, persistence, or broad project mutation was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
MinifiedUrlStrings
Source & flagged code
8 flaggedindex.cjs.jsView file
1"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
High
1"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
index.cjs.jsView on unpkg · L11"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
...
L7: */
L8: function(e){var t,n,o,a=Le.exports,r=i.extname,s=/^\s*([^;\s]*)(?:;|\s|$)/,c=/^text\//i;function u(e){if(!e||"string"!=typeof e)return!1;var t=s.exec(e),n=t&&a[t[1].toLowerCase()];...
L9: /*! https://mths.be/wtf8 v1.0.1 by @mathias */qp=Hp,Mp=Hp.exports,function(e){var t=Mp,n=qp&&qp.exports==t&&qp,i="object"==typeof E&&E;i.global!==i&&i.window!==i||(e=i);var o,a,r,s...
Findings
2 Critical6 High4 Medium4 Low
CriticalCredential Exfiltrationbin/smartOrchestration.js
CriticalTrigger Reachable Dangerous Capabilitybin/smartOrchestration.js
HighChild Processindex.cjs.js
HighShell
HighSame File Env Network Executionindex.cjs.js
HighCommand Output Exfiltrationindex.cjs.js
HighTrigger Reachable Credential Exfiltrationbin/smartOrchestration.js
HighTrigger Reachable Command Output Exfiltrationindex.cjs.js
MediumDynamic Requireindex.cjs.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @bigbinary/neeto-playwright-reporter@3.3.3.
See all versions of @bigbinary/neeto-playwright-reporter for other recorded verdicts.
- Review the evidence and your use of @bigbinary/neeto-playwright-reporter@3.3.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.