@bigbinary/neeto-playwright-reporter@3.4.0
The custom playwright reporter for neeto-playwright-dashboard.
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe source supports a warning because an unrestricted configured API destination can receive the supplied API key. The default is the package-aligned service, and the other flagged command execution is used for Playwright invocation or Git metadata.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user runs the reporter or CLI with an API key and a configured base URL.
Impact
A configured endpoint outside the intended service could receive the API key. The source does not establish that such a destination is selected by default.
Mechanism
The code uses the configured URL for API requests and places the API key in the X-Api-Key header; the default URL is connect.neetoplaydash.com.
AI rationale
The source supports a warning because an unrestricted configured API destination can receive the supplied API key. The default is the package-aligned service, and the other flagged command execution is used for Playwright invocation or Git metadata.
Evidence
bin/neetoplaydash.mjsbin/smartOrchestration.jsindex.cjs.js
Network endpoints1
connect.neetoplaydash.com
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The launcher accepts an API key from command options, reporter configuration, or the NEETO_API_KEY environment variable, and passes it to the orchestration client.
- The launcher copies a configured reporter base URL into the environment; the orchestration request sends the API key to that URL, with connect.neetoplaydash.com as the default.
- The bundled reporter also selects a configurable base URL and sends the API key in its X-Api-Key header, without restricting the destination to the Neeto service.
- The bundled synchronous commands read Git commit, branch, and author metadata.
- The only prepare hook runs Husky setup.
Evidence against
- The default API destination is the package’s Neeto Playdash service, and the API key is supplied through caller configuration or environment variables.
- The shell execution found in the launcher starts Playwright when the user invokes its CLI; the bundled synchronous commands are Git metadata queries.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
8 flaggedindex.cjs.jsView file
1"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
High
1"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
index.cjs.jsView on unpkg · L11"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
...
L7: */
L8: function(e){var t,n,o,a=Le.exports,r=i.extname,s=/^\s*([^;\s]*)(?:;|\s|$)/,c=/^text\//i;function u(e){if(!e||"string"!=typeof e)return!1;var t=s.exec(e),n=t&&a[t[1].toLowerCase()];...
L9: /*! https://mths.be/wtf8 v1.0.1 by @mathias */qp=Hp,Mp=Hp.exports,function(e){var t=Mp,n=qp&&qp.exports==t&&qp,i="object"==typeof E&&E;i.global!==i&&i.window!==i||(e=i);var o,a,r,s...
Findings
2 Critical6 High4 Medium5 Low
CriticalCredential Exfiltrationbin/smartOrchestration.js
CriticalTrigger Reachable Dangerous Capabilitybin/smartOrchestration.js
HighChild Processindex.cjs.js
HighShell
HighSame File Env Network Executionindex.cjs.js
HighCommand Output Exfiltrationindex.cjs.js
HighTrigger Reachable Credential Exfiltrationbin/smartOrchestration.js
HighTrigger Reachable Command Output Exfiltrationindex.cjs.js
MediumDynamic Requireindex.cjs.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @bigbinary/neeto-playwright-reporter@3.4.0.
See all versions of @bigbinary/neeto-playwright-reporter for other recorded verdicts.
- Review the evidence and your use of @bigbinary/neeto-playwright-reporter@3.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.