@bigbinary/neeto-playwright-reporter@4.0.6
The custom playwright reporter for neeto-playwright-dashboard.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe reporter automatically sends its NeetoPlaydash API key in Honeybadger error context to api.honeybadger.io. This is credential exfiltration to a separate service, triggered by runtime errors.
Static reason
One or more suspicious static signals were detected.
Trigger
The Playwright reporter is instantiated and an error or unhandled rejection occurs.
Impact
The user's NeetoPlaydash credential can be disclosed to a separate error-reporting service.
Mechanism
Reporter options containing the API key are set as Honeybadger context; automatic error notifications send that context to api.honeybadger.io.
Attack narrative
When Playwright creates the reporter, it reads the NeetoPlaydash API key from reporter options or NEETO_API_KEY and adds the complete options object to Honeybadger's global error context. On reporter errors or unhandled rejections, the package automatically submits Honeybadger notifications to api.honeybadger.io, exposing that service credential to a different host.
AI rationale
The reporter automatically sends its NeetoPlaydash API key in Honeybadger error context to api.honeybadger.io. This is credential exfiltration to a separate service, triggered by runtime errors.
Evidence
index.cjs.js
Network endpoints2
api.honeybadger.ioconnect.neetoplaydash.com
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- Reporter configuration reads NEETO_API_KEY or an apiKey option.
- The reporter constructor places its apiKey on the instance and configures Honeybadger with a fixed reporting key.
- The reporter adds the full options object, including apiKey, to Honeybadger's global error context.
- Reporter errors and unhandled rejections automatically call Honeybadger's notification path.
- The bundled Honeybadger client defaults to api.honeybadger.io.
Evidence against
- The package is described as a Playwright reporter that sends test-run data to NeetoPlaydash.
- The CLI wrapper runs Playwright and forwards reporter options through environment variables.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggedindex.cjs.jsView file
1"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
High
1"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
index.cjs.jsView on unpkg · L11"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("os"),t=require("domain"),n=require("fs"),i=require("path"),o=require("util"),a=require("url"),r=r...
L2: /*!
...
L7: */
L8: function(e){var t,n,o,a=qe.exports,r=i.extname,s=/^\s*([^;\s]*)(?:;|\s|$)/,c=/^text\//i;function u(e){if(!e||"string"!=typeof e)return!1;var t=s.exec(e),n=t&&a[t[1].toLowerCase()];...
L9: /*! https://mths.be/wtf8 v1.0.1 by @mathias */Wp=Jp,Vp=Jp.exports,function(e){var t=Vp,n=Wp&&Wp.exports==t&&Wp,i="object"==typeof F&&F;i.global!==i&&i.window!==i||(e=i);var o,a,r,s...
Findings
6 High3 Medium6 Low
HighChild Processindex.cjs.js
HighShell
HighSame File Env Network Executionindex.cjs.js
HighCommand Output Exfiltrationindex.cjs.js
HighCross File Remote Execution Contextbin/neetoplaydash.mjs
HighTrigger Reachable Command Output Exfiltrationindex.cjs.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @bigbinary/neeto-playwright-reporter@4.0.6.
See all versions of @bigbinary/neeto-playwright-reporter for other recorded verdicts.
- Avoid installing @bigbinary/neeto-playwright-reporter@4.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.