registry / @bigbinary/neeto-playwright-reporter / 4.0.4
@bigbinary/neeto-playwright-reporter@4.0.4
The custom playwright reporter for neeto-playwright-dashboard.
AI Security Review
scanned 22d ago · by lpm-firewall-aiSource inspection shows the scanner’s shell and network signals arise from normal reporter behavior: fixed Git metadata queries and dashboard reporting. The prepare hook is Husky setup, and no concrete attack surface was established.
Static reason
One or more suspicious static signals were detected.
Trigger
Running Playwright with this reporter, or invoking the explicit Playwright subcommand in the CLI.
Impact
No unconsented credential disclosure, destructive action, or unrelated system mutation was established.
Mechanism
The reporter reads run metadata and submits it to the dashboard API; the CLI passes the requested arguments to the local Playwright CLI.
AI rationale
Source inspection shows the scanner’s shell and network signals arise from normal reporter behavior: fixed Git metadata queries and dashboard reporting. The prepare hook is Husky setup, and no concrete attack surface was established.
Network endpoints1
connect.neetoplaydash.com
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest’s prepare hook runs Husky setup; it declares no preinstall, install, or postinstall hook.
- Both bundles’ shell helper is called with fixed Git queries for commit, author, and branch metadata, which are included in the reporter’s run payload.
- The bundled client defaults to the Neeto Playdash service; its project and API keys come from reporter options or corresponding environment variables.
- The command-line entrypoint requires the Playwright subcommand and forwards the requested arguments to the local Playwright CLI.
- The reporter’s setup runs from Playwright’s reporter lifecycle, and the ESM bundle sends the collected run data through its reporter API.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggedindex.cjs.jsView file
1"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
High
1"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
index.cjs.jsView on unpkg · L11"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
...
L7: */
L8: function(e){var t,n,o,a=qe.exports,r=i.extname,s=/^\s*([^;\s]*)(?:;|\s|$)/,c=/^text\//i;function u(e){if(!e||"string"!=typeof e)return!1;var t=s.exec(e),n=t&&a[t[1].toLowerCase()];...
L9: /*! https://mths.be/wtf8 v1.0.1 by @mathias */Kp=Vp,Wp=Vp.exports,function(e){var t=Wp,n=Kp&&Kp.exports==t&&Kp,i="object"==typeof F&&F;i.global!==i&&i.window!==i||(e=i);var o,a,r,s...
Findings
6 High3 Medium6 Low
HighChild Processindex.cjs.js
HighShell
HighSame File Env Network Executionindex.cjs.js
HighCommand Output Exfiltrationindex.cjs.js
HighCross File Remote Execution Contextbin/neetoplaydash.mjs
HighTrigger Reachable Command Output Exfiltrationindex.cjs.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @bigbinary/neeto-playwright-reporter@4.0.4.
See all versions of @bigbinary/neeto-playwright-reporter for other recorded verdicts.
- Review the evidence and your use of @bigbinary/neeto-playwright-reporter@4.0.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.