registry / @bigbinary/neeto-playwright-reporter / 3.4.1
@bigbinary/neeto-playwright-reporter@3.4.1
The custom playwright reporter for neeto-playwright-dashboard.
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe flagged credential and network behavior is part of the reporter’s configured API workflow: the CLI supplies the API key and project key to the NeetoPlaydash sharding endpoint, while the reporter posts run records to its API. The prepare hook runs Husky setup, and the inspected process execution is tied to the invoked Playwright workflow.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The CLI runs when a consumer invokes neetoplaydash with Playwright arguments.
Impact
The inspected behavior supports test reporting and distribution; no unrelated credential collection or harmful side effect was identified.
Mechanism
It sends caller-provided credentials with test and shard data to the configured NeetoPlaydash service, then uses the returned test list to run the shard.
AI rationale
The flagged credential and network behavior is part of the reporter’s configured API workflow: the CLI supplies the API key and project key to the NeetoPlaydash sharding endpoint, while the reporter posts run records to its API. The prepare hook runs Husky setup, and the inspected process execution is tied to the invoked Playwright workflow.
Evidence
package.jsonbin/neetoplaydash.mjsbin/smartOrchestration.jsindex.jsindex.cjs.js
Network endpoints1
connect.neetoplaydash.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to the reporter bundles and CLI; its prepare hook runs husky install.
- The CLI reads the project key and API key from command-line options, reporter configuration, or named environment variables.
- The sharding flow sends shard and test data with the supplied API and project keys to the configured service, defaulting to connect.neetoplaydash.com.
- Both reporter bundles configure the NeetoPlaydash service endpoint and post run records to its reporter API.
- The CLI launches Playwright with its reporter and writes the service-returned test list to a temporary file for the run.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
8 flaggedindex.cjs.jsView file
1"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
High
1"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
index.cjs.jsView on unpkg · L11"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
...
L7: */
L8: function(e){var t,n,o,a=Le.exports,r=i.extname,s=/^\s*([^;\s]*)(?:;|\s|$)/,c=/^text\//i;function u(e){if(!e||"string"!=typeof e)return!1;var t=s.exec(e),n=t&&a[t[1].toLowerCase()];...
L9: /*! https://mths.be/wtf8 v1.0.1 by @mathias */qp=Hp,Mp=Hp.exports,function(e){var t=Mp,n=qp&&qp.exports==t&&qp,i="object"==typeof E&&E;i.global!==i&&i.window!==i||(e=i);var o,a,r,s...
Findings
2 Critical6 High4 Medium5 Low
CriticalCredential Exfiltrationbin/smartOrchestration.js
CriticalTrigger Reachable Dangerous Capabilitybin/smartOrchestration.js
HighChild Processindex.cjs.js
HighShell
HighSame File Env Network Executionindex.cjs.js
HighCommand Output Exfiltrationindex.cjs.js
HighTrigger Reachable Credential Exfiltrationbin/smartOrchestration.js
HighTrigger Reachable Command Output Exfiltrationindex.cjs.js
MediumDynamic Requireindex.cjs.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @bigbinary/neeto-playwright-reporter@3.4.1.
See all versions of @bigbinary/neeto-playwright-reporter for other recorded verdicts.
- Review the evidence and your use of @bigbinary/neeto-playwright-reporter@3.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.