registry / @caslanqa/create-playwright-ai / 4.0.1

@caslanqa/create-playwright-ai@4.0.1

Scaffold a ready-to-run Playwright + TypeScript test framework: AI Judge for LLM evaluation, layered API testing, lazy session auth, and full tooling (ESLint, Prettier, husky, commitlint)

Static Scan Results

scanned 46m ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 76 file(s), 310 KB of source, external domains: example.com, get.maestro.mobile.dev, maestro.mobile.dev, ollama.com, playwright.dev, www.saucedemo.com

Source & flagged code

2 flagged

mobile/core/appInstaller.tsView file

Lines 1-21typescript

1import { execFile } from 'child_process';

2import { createHash } from 'crypto';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

mobile/core/appInstaller.tsView on unpkg · L1

3import fs from 'fs';

4import os from 'os';

5import path from 'path';

6import { promisify } from 'util';

8import { adbPath, androidEnv } from './android';

9import type { DiscoveredDevice } from './types';

11const execFileAsync = promisify(execFile);

13// Apps installed during THIS run, keyed by device+source. Mobile runs serial in one worker process,

14// so a module-level set installs the app once per run (not before every test) and resets each run.

15const installed = new Set<string>();

17/** Cache location for a downloaded artifact, keyed by URL hash (stable across a run). */

18function cachePath(url: string): string {

19 const ext = path.extname(new URL(url).pathname) || '.bin';

20 const hash = createHash('sha1').update(url).digest('hex').slice(0, 12);

21 return path.join(os.tmpdir(), `pw-ai-app-${hash}${ext}`);

bin/create-project.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @caslanqa/create-playwright-ai@4.0.0 matchedIdentity = npm:[redacted]:4.0.0 similarity = 0.987 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/create-project.cjsView on unpkg

Source & flagged code

2 flagged · loading source

mobile/core/appInstaller.tsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code