registry / @empiricalrun/playwright-utils / 0.58.0
@empiricalrun/playwright-utils@0.58.0
Playwright utils for test code repos of our customers
AI Security Review
scanned 3mo ago · by lpm-firewall-aiScanner claims conflate configured authentication headers and explicit test-reporting integrations with credential exfiltration. Source contains no install-time execution or unconsented collection, execution, persistence, or control-surface modification.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Caller invokes webhook, reporter, upload, or telemetry APIs during test workflows.
Impact
May send requested test data or telemetry to configured package-aligned services.
Mechanism
User-configured test reporting and webhook-provider integration.
AI rationale
Scanner claims conflate configured authentication headers and explicit test-reporting integrations with credential exfiltration. Source contains no install-time execution or unconsented collection, execution, persistence, or control-surface modification.
Evidence
package.jsondist/index.jsdist/webhook.jsdist/api-worker-client.jsdist/reporter/local-test.jsdist/telemetry.jsdist/reporter/uploader.js
Network endpoints5
webhook.siteapi.empirical.runinbox.empirical.runtelemetry-worker.empirical-run.workers.devreports-r2.empirical.run
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- dist/webhook.js uses configured API keys for webhook provider requests.
- dist/reporter/uploader.js can upload explicitly configured test artifacts.
- dist/telemetry.js posts telemetry only when EMPIRICAL_TELEMETRY_API_KEY is set.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- dist/index.js only defines exports; importing it does not invoke network or shell actions.
- dist/webhook.js sends keys only as authorization to its selected webhook/API service.
- dist/reporter/local-test.js runs a fixed Playwright report-merge command when called.
- No source evidence of environment harvesting, remote code loading, persistence, or agent-config mutation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsObfuscatedUrlStrings
Source & flagged code
6 flaggeddist/reporter/local-test.jsView file
6exports.mergeForLocalTest = mergeForLocalTest;
L7: const child_process_1 = require("child_process");
L8: const path_1 = __importDefault(require("path"));
High
Child Process
Package source references child process execution.
dist/reporter/local-test.jsView on unpkg · L613try {
L14: (0, child_process_1.execFileSync)("npx", ["playwright", "merge-reports", outputDir, "--reporter", "html,json"], {
L15: cwd: currentWorkingDir,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/reporter/local-test.jsView on unpkg · L13dist/webhook.jsView file
6// ── webhook.site provider ──
L7: const WEBHOOK_SITE_BASE_URL = "https://webhook.site";
L8: const DEFAULT_TOKEN_EXPIRY = 604800;
...
L20: const expiry = options.expiry === undefined ? DEFAULT_TOKEN_EXPIRY : options.expiry;
L21: if (process.env.EMPIRICALRUN_API_KEY) {
L22: const apiClient = new api_worker_client_1.ApiWorkerClient();
...
L25: path: "/token",
L26: body: { expiry },
L27: });
...
L43: if (!response.ok) {
L44: const body = await response.text().catch(() => "");
L45: throw new Error(`webhook.site error [${response.status} ${response.statusText}]: ${body}`);
Findings
2 Critical4 High3 Medium6 Low
CriticalCredential Exfiltrationdist/webhook.js
CriticalTrigger Reachable Dangerous Capabilitydist/webhook.js
HighChild Processdist/reporter/local-test.js
HighTrigger Reachable Credential Exfiltrationdist/webhook.js
HighTrigger Reachable External Post Callbackdist/webhook.js
HighRuntime Package Installdist/reporter/local-test.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @empiricalrun/playwright-utils@0.58.0.
See all versions of @empiricalrun/playwright-utils for other recorded verdicts.
- Review the evidence and your use of @empiricalrun/playwright-utils@0.58.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.