registry / @checksum-ai/runtime / 4.7.0

@checksum-ai/runtime@4.7.0

Checksum.ai test runtime

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis flagged 19 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 1.46 MB of source, external domains: 127.0.0.1, api.checksum.ai, app.checksum.ai, feross.org, github.com, jimmy.warting.se, lodash.com, npms.io, openjsf.org, socket.io, underscorejs.org, www.apache.org

Oversized source lightweight scan

cli.js6.03 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoObfuscatedHighEntropyStringsMinifiedUrlStringsapi.checksum.aiapp.checksum.aigithub.comjimmy.warting.selodash.comnpms.ioopenjsf.orgunderscorejs.orgwww.apache.org

index.js5.90 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsEvalCryptoHighEntropyStringsMinifiedUrlStringsapi.checksum.aifeross.orggithub.comjimmy.warting.selodash.comnpms.ioopenjsf.orgsocket.iounderscorejs.orgwww.apache.org

test-run-monitor.js4.21 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoObfuscatedHighEntropyStringsMinifiedUrlStringsapi.checksum.aiwww.apache.org

Source & flagged code

11 flagged

.envView file

1patternName = blocked_file severity = critical matchedText = .env redactedSecretContext = secretLikeLines = 1 L1: CHECKSUM_RUNTIME_BUILD_TIME=<redacted:24 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L1

postinstall.jsView file

Lines 1-50javascript

1const fs = require("fs");

2const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

postinstall.jsView on unpkg · L1

3const { exec } = require("child_process");

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L2

5try {

6 console.log("Adding checksum scripts to package.json");

7 const packageJsonPath = path.resolve(__dirname, "../../../package.json");

8 if (!fs.existsSync(packageJsonPath)) {

9 console.log("No package.json found, will not add checksum script");

10 process.exit(1);

11 }

12 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath));

14 // verify that the package.json has a scripts section

15 if (!packageJson.scripts) {

16 packageJson.scripts = {};

17 }

19 packageJson.scripts["checksum"] =

20 "node ./node_modules/@checksum-ai/runtime/cli.js";

22 fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, 2));

23} catch (e) {

24 console.log("Failed adding checksum scripts to package.json, ", e);

25}

27async function installPlaywright() {

28 try {

29 function run() {

30 return new Promise((resolve, reject) => {

31 exec("npx playwright install", (error, stdout, stderr) => {

32 if (error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

postinstall.jsView on unpkg · L30

33 reject(`Error: ${error.message}`);

34 return;

35 }

36 if (stderr) {

37 reject(`Stderr: ${stderr}`);

38 return;

39 }

40 resolve(stdout);

41 });

42 });

43 }

45 console.log("Installing playwright");

46 await run();

47 console.log("Playwright installed successfully");

48 } catch (e) {

49 console.error("Playwright installation failed", e);

50 }

checksumlib.jsView file

74now you can use replayer.getMirror() to access the mirror instance of a replayer,\r L75: or you can use record.mirror to access the mirror instance during recording.`,jb={map:{},getId(){return console.error(pi),-1},getNode(){return console.error(pi),null},removeNodeFro... L76: ${t.locator}`);r!==null&&this.sessionRecorder.addCustomEvent("assertion",{matcher:`toHaveText("${r}")`,locator:t.locator})},"toHaveTextHandler");this.toBeVisibleHandler=a(()=>e=>{l...

Low

Eval

Package source references a known benign dynamic code generation pattern.

checksumlib.jsView on unpkg · L74

scripts/playwright_patches/1.52.0.jsView file

Lines 274-314javascript

274 "node_modules/playwright-core/lib/client/channelOwner.js"

275 );

276 if (!doesFileExist(file)) {

277 return;

278 }

279 let originalContent, newContent;

280 let entryPointText, appendText;

281

282 entryPointText =

index.jsView file

•path = index.js kind = oversized_source_file sizeBytes = 6190458 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

index.jsView on unpkg

cli.jsView file

•path = cli.js kind = oversized_cli_entrypoint sizeBytes = 6318494 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

cli.jsView on unpkg

checksum-root/checksum.config.tsView file

Lines 24-64typescript

24 * You can find it in https://app.checksum.ai/#/settings/

25 */

26 apiKey: process.env.CHECKSUM_API_KEY,

28 /**

29 * Define your test run environments and test users within each environment.

30 * The environments must be aligned with those set here:

31 * https://app.checksum.ai/#/settings/

README.mdView file

Lines 90-130markdown

90 */

91 runMode: RunMode.Normal,

93 /**

94 * Define CHECKSUM_API_KEY in checksum/.env or your shell.

95 * You can find it in https://app.checksum.ai/#/settings/

96 */

97 apiKey: process.env.CHECKSUM_API_KEY,

99 /**

100 * Define your test run environments and test users within each environment.

Source & flagged code

11 flagged · loading source

.envView file

1patternName = blocked_file severity = critical matchedText = .env redactedSecretContext = secretLikeLines = 1 L1: CHECKSUM_RUNTIME_BUILD_TIME=<redacted:24 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L1

postinstall.jsView file

2const path = require("path"); L3: const { exec } = require("child_process"); L4:

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L2

30return new Promise((resolve, reject) => { L31: exec("npx playwright install", (error, stdout, stderr) => { L32: if (error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

postinstall.jsView on unpkg · L30

1const fs = require("fs"); L2: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

postinstall.jsView on unpkg · L1

checksumlib.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

checksumlib.jsView on unpkg · L74

scripts/playwright_patches/1.52.0.jsView file

294// reported: false, L295: // userData: undefined, L296: // stepId: undefined ... L370: L371: const isRuntime = true || process.env.RUNTIME === "true"; L372:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/playwright_patches/1.52.0.jsView on unpkg · L294

index.jsView file

•path = index.js kind = oversized_source_file sizeBytes = 6190458 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

index.jsView on unpkg

cli.jsView file

•path = cli.js kind = oversized_cli_entrypoint sizeBytes = 6318494 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

cli.jsView on unpkg

checksum-root/checksum.config.tsView file

44patternName = generic_password severity = medium line = 44 matchedText = password...d>",

Medium

Secret Pattern

Hardcoded password in checksum-root/checksum.config.ts

checksum-root/checksum.config.tsView on unpkg · L44

README.mdView file

110patternName = generic_password severity = medium line = 110 matchedText = password...d>",

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L110

115patternName = generic_password severity = medium line = 115 matchedText = password...d>",

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L115

Findings

1 Critical5 High8 Medium5 Low

CriticalCritical Secret.env

HighChild Processpostinstall.js

HighShell

HighRuntime Package Installpostinstall.js

HighObfuscated

HighOversized Source Fileindex.js

MediumDynamic Requirepostinstall.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Cli Entrypointcli.js

MediumStructural Risk Force Deep Review

MediumSecret Patternchecksum-root/checksum.config.ts

MediumSecret PatternREADME.md

LowEvalchecksumlib.js

LowWeak Cryptoscripts/playwright_patches/1.52.0.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

11 flagged

.envView file

1patternName = blocked_file severity = critical matchedText = .env redactedSecretContext = secretLikeLines = 1 L1: CHECKSUM_RUNTIME_BUILD_TIME=<redacted:24 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L1

postinstall.jsView file

Lines 1-50javascript

1const fs = require("fs");

2const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

postinstall.jsView on unpkg · L1

3const { exec } = require("child_process");

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L2

5try {

6 console.log("Adding checksum scripts to package.json");

7 const packageJsonPath = path.resolve(__dirname, "../../../package.json");

8 if (!fs.existsSync(packageJsonPath)) {

9 console.log("No package.json found, will not add checksum script");

10 process.exit(1);

11 }

12 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath));

14 // verify that the package.json has a scripts section

15 if (!packageJson.scripts) {

16 packageJson.scripts = {};

17 }

19 packageJson.scripts["checksum"] =

20 "node ./node_modules/@checksum-ai/runtime/cli.js";

22 fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, 2));

23} catch (e) {

24 console.log("Failed adding checksum scripts to package.json, ", e);

25}

27async function installPlaywright() {

28 try {

29 function run() {

30 return new Promise((resolve, reject) => {

31 exec("npx playwright install", (error, stdout, stderr) => {

32 if (error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

postinstall.jsView on unpkg · L30

33 reject(`Error: ${error.message}`);

34 return;

35 }

36 if (stderr) {

37 reject(`Stderr: ${stderr}`);

38 return;

39 }

40 resolve(stdout);

41 });

42 });

43 }

45 console.log("Installing playwright");

46 await run();

47 console.log("Playwright installed successfully");

48 } catch (e) {

49 console.error("Playwright installation failed", e);

50 }

checksumlib.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

checksumlib.jsView on unpkg · L74

scripts/playwright_patches/1.52.0.jsView file

Lines 274-314javascript

274 "node_modules/playwright-core/lib/client/channelOwner.js"

275 );

276 if (!doesFileExist(file)) {

277 return;

278 }

279 let originalContent, newContent;

280 let entryPointText, appendText;

281

282 entryPointText =

index.jsView file

•path = index.js kind = oversized_source_file sizeBytes = 6190458 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

index.jsView on unpkg

cli.jsView file

•path = cli.js kind = oversized_cli_entrypoint sizeBytes = 6318494 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

cli.jsView on unpkg

checksum-root/checksum.config.tsView file

Lines 24-64typescript

24 * You can find it in https://app.checksum.ai/#/settings/

25 */

26 apiKey: process.env.CHECKSUM_API_KEY,

28 /**

29 * Define your test run environments and test users within each environment.

30 * The environments must be aligned with those set here:

31 * https://app.checksum.ai/#/settings/

README.mdView file

Lines 90-130markdown

90 */

91 runMode: RunMode.Normal,

93 /**

94 * Define CHECKSUM_API_KEY in checksum/.env or your shell.

95 * You can find it in https://app.checksum.ai/#/settings/

96 */

97 apiKey: process.env.CHECKSUM_API_KEY,

99 /**

100 * Define your test run environments and test users within each environment.