registry / @bigbinary/neeto-playwright-reporter / 4.0.5
@bigbinary/neeto-playwright-reporter@4.0.5
The custom playwright reporter for neeto-playwright-dashboard.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe execution signal comes from fixed Git metadata queries in the reporter, while its network requests send report data to the configured NeetoPlaydash API. The prepare hook only installs Husky, and the inspected sources show no secret harvesting or unrelated recipient.
Static reason
One or more suspicious static signals were detected.
Trigger
Playwright invokes the reporter during a test run, or a user invokes the CLI with the Playwright command.
Impact
No malicious or unrelated effect was established.
Mechanism
The reporter gathers fixed Git metadata and sends run and test report data to the configured NeetoPlaydash API; the CLI launches Playwright with the supplied arguments.
AI rationale
The execution signal comes from fixed Git metadata queries in the reporter, while its network requests send report data to the configured NeetoPlaydash API. The prepare hook only installs Husky, and the inspected sources show no secret harvesting or unrelated recipient.
Evidence
package.jsonindex.cjs.jsindex.jsbin/neetoplaydash.mjs
Network endpoints1
connect.neetoplaydash.com
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The manifest points to the reporter and CLI entrypoints; its prepare hook runs Husky installation.
- The reporter uses fixed Git commands to collect commit, author, and branch metadata for a run.
- The reporter uses the NeetoPlaydash API, with its default host and API credentials taken from reporter configuration or environment settings.
- The CLI passes Playwright arguments to the Playwright process and inherits its environment and standard streams.
- The required dependency excerpts show standard Axios cancellation handling, utility-library imports, and a Honeybadger client whose default API key is unset.
- The dependency root exports the Axios client together with its cancellation and configuration helpers.
Evidence against
- Static signals flag shell execution and networking, but the inspected shell commands are fixed Git metadata queries and the network calls serve the reporter’s dashboard workflow.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEval
Source & flagged code
5 flaggedindex.cjs.jsView file
1"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
High
1"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
index.cjs.jsView on unpkg · L11"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
...
L7: */
L8: function(e){var t,n,o,a=qe.exports,r=i.extname,s=/^\s*([^;\s]*)(?:;|\s|$)/,c=/^text\//i;function u(e){if(!e||"string"!=typeof e)return!1;var t=s.exec(e),n=t&&a[t[1].toLowerCase()];...
L9: /*! https://mths.be/wtf8 v1.0.1 by @mathias */Wp=Jp,Vp=Jp.exports,function(e){var t=Vp,n=Wp&&Wp.exports==t&&Wp,i="object"==typeof F&&F;i.global!==i&&i.window!==i||(e=i);var o,a,r,s...
Findings
6 High3 Medium6 Low
HighChild Processindex.cjs.js
HighShell
HighSame File Env Network Executionindex.cjs.js
HighCommand Output Exfiltrationindex.cjs.js
HighCross File Remote Execution Contextbin/neetoplaydash.mjs
HighTrigger Reachable Command Output Exfiltrationindex.cjs.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @bigbinary/neeto-playwright-reporter@4.0.5.
See all versions of @bigbinary/neeto-playwright-reporter for other recorded verdicts.
- Review the evidence and your use of @bigbinary/neeto-playwright-reporter@4.0.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.