registry / @empiricalrun/playwright-utils / 0.57.0
@empiricalrun/playwright-utils@0.57.0
Playwright utils for test code repos of our customers
AI Security Review
scanned 3mo ago · by lpm-firewall-aiScanner claims of credential exfiltration conflate deliberate, user-invoked authenticated webhook and reporting API requests with theft. Source inspection found no lifecycle execution, hidden payload, dynamic execution, or unconsented data transfer.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Explicit use of webhook, reporter, visual-test, or report-upload utilities
Impact
No unconsented installation-time execution, credential harvesting, or persistence found.
Mechanism
configured test-service API calls and Playwright report generation
AI rationale
Scanner claims of credential exfiltration conflate deliberate, user-invoked authenticated webhook and reporting API requests with theft. Source inspection found no lifecycle execution, hidden payload, dynamic execution, or unconsented data transfer.
Evidence
package.jsondist/index.jsdist/webhook.jsdist/api-worker-client.jsdist/reporter/local-test.jsdist/reporter/uploader.js
Network endpoints4
webhook.siteinbox.empirical.runapi.empirical.runtelemetry-worker.empirical-run.workers.dev
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no preinstall/install/postinstall hooks.
- dist/webhook.js only contacts webhook providers when exported functions are called.
- API keys are used as Authorization/API-Key headers to configured provider endpoints, not harvested or forwarded.
- dist/reporter/local-test.js runs a fixed Playwright report command only when explicitly invoked.
- Root dist/index.js only exports utilities; it performs no network or child-process action on import.
- Report uploads require explicit test-run/storage environment configuration.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsObfuscatedUrlStrings
NoLicense
Source & flagged code
6 flaggeddist/reporter/local-test.jsView file
6exports.mergeForLocalTest = mergeForLocalTest;
L7: const child_process_1 = require("child_process");
L8: const path_1 = __importDefault(require("path"));
High
Child Process
Package source references child process execution.
dist/reporter/local-test.jsView on unpkg · L613try {
L14: (0, child_process_1.execFileSync)("npx", ["playwright", "merge-reports", outputDir, "--reporter", "html,json"], {
L15: cwd: currentWorkingDir,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/reporter/local-test.jsView on unpkg · L13dist/webhook.jsView file
6// ── webhook.site provider ──
L7: const WEBHOOK_SITE_BASE_URL = "https://webhook.site";
L8: const DEFAULT_TOKEN_EXPIRY = 604800;
...
L20: const expiry = options.expiry === undefined ? DEFAULT_TOKEN_EXPIRY : options.expiry;
L21: if (process.env.EMPIRICALRUN_API_KEY) {
L22: const apiClient = new api_worker_client_1.ApiWorkerClient();
...
L25: path: "/token",
L26: body: { expiry },
L27: });
...
L43: if (!response.ok) {
L44: const body = await response.text().catch(() => "");
L45: throw new Error(`webhook.site error [${response.status} ${response.statusText}]: ${body}`);
Findings
2 Critical4 High3 Medium6 Low
CriticalCredential Exfiltrationdist/webhook.js
CriticalTrigger Reachable Dangerous Capabilitydist/webhook.js
HighChild Processdist/reporter/local-test.js
HighTrigger Reachable Credential Exfiltrationdist/webhook.js
HighTrigger Reachable External Post Callbackdist/webhook.js
HighRuntime Package Installdist/reporter/local-test.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @empiricalrun/playwright-utils@0.57.0.
See all versions of @empiricalrun/playwright-utils for other recorded verdicts.
- Review the evidence and your use of @empiricalrun/playwright-utils@0.57.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.