@checksum-ai/runtime@4.12.0: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@checksum-ai/runtime@4.12.0: Suspicious npm security report | LPM Firewall

Source & flagged code

11 flagged · loading source

1patternName = blocked_file severity = critical matchedText = .env redactedSecretContext = secretLikeLines = 1 L1: CHECKSUM_RUNTIME_BUILD_TIME=<redacted:24 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L1

postinstall.jsView file

2const path = require("path"); L3: const { exec } = require("child_process"); L4:

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L2

30return new Promise((resolve, reject) => { L31: exec("npx playwright install", (error, stdout, stderr) => { L32: if (error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

postinstall.jsView on unpkg · L30

1const fs = require("fs"); L2: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

postinstall.jsView on unpkg · L1

checksumlib.jsView file

74now you can use replayer.getMirror() to access the mirror instance of a replayer,\r L75: or you can use record.mirror to access the mirror instance during recording.`,jb={map:{},getId(){return console.error(pi),-1},getNode(){return console.error(pi),null},removeNodeFro... L76: ${t.locator}`);r!==null&&this.sessionRecorder.addCustomEvent("assertion",{matcher:`toHaveText("${r}")`,locator:t.locator})},"toHaveTextHandler");this.toBeVisibleHandler=a(()=>e=>{l...

Low

Eval

Package source references a known benign dynamic code generation pattern.

checksumlib.jsView on unpkg · L74

scripts/playwright_patches/1.52.0.jsView file

294// reported: false, L295: // userData: undefined, L296: // stepId: undefined ... L370: L371: const isRuntime = true || process.env.RUNTIME === "true"; L372:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/playwright_patches/1.52.0.jsView on unpkg · L294

index.jsView file

•path = index.js kind = oversized_source_file sizeBytes = 6191606 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

index.jsView on unpkg

cli.jsView file

•path = cli.js kind = oversized_cli_entrypoint sizeBytes = 6322799 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

cli.jsView on unpkg

checksum-root/checksum.config.tsView file

44patternName = generic_password severity = medium line = 44 matchedText = password...d>",

Medium

Secret Pattern

Hardcoded password in checksum-root/checksum.config.ts

checksum-root/checksum.config.tsView on unpkg · L44

README.mdView file

110patternName = generic_password severity = medium line = 110 matchedText = password...d>",

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L110

115patternName = generic_password severity = medium line = 115 matchedText = password...d>",

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L115

Source & flagged code

11 flagged

Lines 1-1text

1CHECKSUM_RUNTIME_BUILD_TIME=2026-07-22T13:36:55.162Z

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L1

postinstall.jsView file

Lines 1-50javascript

1const fs = require("fs");

2const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

postinstall.jsView on unpkg · L1

3const { exec } = require("child_process");

4

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L2

5try {

6 console.log("Adding checksum scripts to package.json");

7 const packageJsonPath = path.resolve(__dirname, "../../../package.json");

8 if (!fs.existsSync(packageJsonPath)) {

9 console.log("No package.json found, will not add checksum script");

10 process.exit(1);

11 }

12 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath));

13

14 // verify that the package.json has a scripts section

15 if (!packageJson.scripts) {

16 packageJson.scripts = {};

17 }

18

19 packageJson.scripts["checksum"] =

20 "node ./node_modules/@checksum-ai/runtime/cli.js";

21

22 fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, 2));

23} catch (e) {

24 console.log("Failed adding checksum scripts to package.json, ", e);

25}

26

27async function installPlaywright() {

28 try {

29 function run() {

30 return new Promise((resolve, reject) => {

31 exec("npx playwright install", (error, stdout, stderr) => {

32 if (error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

postinstall.jsView on unpkg · L30

33 reject(`Error: ${error.message}`);

34 return;

35 }

36 if (stderr) {

37 reject(`Stderr: ${stderr}`);

38 return;

39 }

40 resolve(stdout);

41 });

42 });

43 }

44

45 console.log("Installing playwright");

46 await run();

47 console.log("Playwright installed successfully");

48 } catch (e) {

49 console.error("Playwright installation failed", e);

50 }

checksumlib.jsView file

74now you can use replayer.getMirror() to access the mirror instance of a replayer,\r L75: or you can use record.mirror to access the mirror instance during recording.`,jb={map:{},getId(){return console.error(pi),-1},getNode(){return console.error(pi),null},removeNodeFro... L76: ${t.locator}`);r!==null&&this.sessionRecorder.addCustomEvent("assertion",{matcher:`toHaveText("${r}")`,locator:t.locator})},"toHaveTextHandler");this.toBeVisibleHandler=a(()=>e=>{l...

Low

Eval

Package source references a known benign dynamic code generation pattern.

checksumlib.jsView on unpkg · L74

scripts/playwright_patches/1.52.0.jsView file

Lines 274-314javascript

274 "node_modules/playwright-core/lib/client/channelOwner.js"

275 );

276 if (!doesFileExist(file)) {

277 return;

278 }

279 let originalContent, newContent;

280 let

index.jsView file

•path = index.js kind = oversized_source_file sizeBytes = 6191606 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

index.jsView on unpkg

cli.jsView file

•path = cli.js kind = oversized_cli_entrypoint sizeBytes = 6322799 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

cli.jsView on unpkg

checksum-root/checksum.config.tsView file

Lines 24-64typescript

24 * You can find it in https://app.checksum.ai/#/settings/

25 */

26 apiKey: process.env.CHECKSUM_API_KEY,

27

28 /**

29 * Define your test run environments and test users within each environment.

30

README.mdView file

Lines 90-130markdown

90 */

91 runMode: RunMode.Normal,

92

93 /**

94 * Define CHECKSUM_API_KEY in checksum/.env or your shell.

95 * You can find it in https://app.checksum.ai/#/settings/

96 */

97 apiKey: process.env.CHECKSUM_API_KEY,

98

99 /**

100