registry / @caslanqa/create-playwright-ai / 4.0.0

@caslanqa/create-playwright-ai@4.0.0

Scaffold a ready-to-run Playwright + TypeScript test framework: AI Judge for LLM evaluation, layered API testing, lazy session auth, and full tooling (ESLint, Prettier, husky, commitlint)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 76 file(s), 308 KB of source, external domains: example.com, get.maestro.mobile.dev, maestro.mobile.dev, ollama.com, playwright.dev, www.saucedemo.com

Source & flagged code

3 flagged

mobile/core/appInstaller.tsView file

Lines 1-21typescript

1import { execFile } from 'child_process';

2import { createHash } from 'crypto';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

mobile/core/appInstaller.tsView on unpkg · L1

3import fs from 'fs';

4import os from 'os';

5import path from 'path';

6import { promisify } from 'util';

8import { adbPath, androidEnv } from './android';

9import type { DiscoveredDevice } from './types';

11const execFileAsync = promisify(execFile);

13// Apps installed during THIS run, keyed by device+source. Mobile runs serial in one worker process,

14// so a module-level set installs the app once per run (not before every test) and resets each run.

15const installed = new Set<string>();

17/** Cache location for a downloaded artifact, keyed by URL hash (stable across a run). */

18function cachePath(url: string): string {

19 const ext = path.extname(new URL(url).pathname) || '.bin';

20 const hash = createHash('sha1').update(url).digest('hex').slice(0, 12);

21 return path.join(os.tmpdir(), `pw-ai-app-${hash}${ext}`);

bin/create-project.cjsView file

Lines 18-58javascript

18 *

19 * Modules (mobile, desktop) are opt-in plug-ins. Opting out installs NONE of a

20 * module's files/scripts/config; a module can also be added to an EXISTING

21 *

Source & flagged code

3 flagged · loading source

mobile/core/appInstaller.tsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code