registry / @empiricalrun/playwright-utils / 0.56.0
@empiricalrun/playwright-utils@0.56.0
⚠ Under reviewPlaywright utils for test code repos of our customers
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 13 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsObfuscatedUrlStrings
NoLicense
Source & flagged code
4 flaggeddist/reporter/local-test.jsView file
6exports.mergeForLocalTest = mergeForLocalTest;
L7: const child_process_1 = require("child_process");
L8: const path_1 = __importDefault(require("path"));
High
Child Process
Package source references child process execution.
dist/reporter/local-test.jsView on unpkg · L613try {
L14: (0, child_process_1.execFileSync)("npx", ["playwright", "merge-reports", outputDir, "--reporter", "html,json"], {
L15: cwd: currentWorkingDir,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/reporter/local-test.jsView on unpkg · L13dist/webhook.jsView file
6// ── webhook.site provider ──
L7: const WEBHOOK_SITE_BASE_URL = "https://webhook.site";
L8: const DEFAULT_TOKEN_EXPIRY = 604800;
...
L20: const expiry = options.expiry === undefined ? DEFAULT_TOKEN_EXPIRY : options.expiry;
L21: if (process.env.EMPIRICALRUN_API_KEY) {
L22: const apiClient = new api_worker_client_1.ApiWorkerClient();
...
L25: path: "/token",
L26: body: { expiry },
L27: });
...
L43: if (!response.ok) {
L44: const body = await response.text().catch(() => "");
L45: throw new Error(`webhook.site error [${response.status} ${response.statusText}]: ${body}`);
Findings
2 Critical2 High3 Medium6 Low
CriticalCredential Exfiltrationdist/webhook.js
CriticalTrigger Reachable Dangerous Capabilitydist/webhook.js
HighChild Processdist/reporter/local-test.js
HighRuntime Package Installdist/reporter/local-test.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @empiricalrun/playwright-utils@0.56.0.
See all versions of @empiricalrun/playwright-utils for other recorded verdicts.
- Review the evidence and your use of @empiricalrun/playwright-utils@0.56.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.