registry / @empiricalrun/playwright-utils / 0.58.2
@empiricalrun/playwright-utils@0.58.2
Playwright utils for test code repos of our customers
AI Security Review
scanned 3mo ago · by lpm-firewall-aiInspected source shows no install hook or unconsented execution. Flagged network, environment, child-process, and deletion primitives are bounded to user-invoked Playwright reporting and webhook functionality.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Consumer imports and explicitly configures/uses reporter, webhook, or test utilities.
Impact
Configured test artifacts and test metadata may be sent to the selected Empirical/S3/R2 reporting service.
Mechanism
Configured test-report upload and webhook-provider API access.
AI rationale
Inspected source shows no install hook or unconsented execution. Flagged network, environment, child-process, and deletion primitives are bounded to user-invoked Playwright reporting and webhook functionality.
Evidence
package.jsondist/index.jsdist/webhook.jsdist/api-worker-client.jsdist/reporter/local-test.jsdist/reporter/uploader.jsdist/reporter/empirical-reporter.jsdist/reporter/attachment-cleanup.jstest-resultsblob-reportplaywright-reportpartial-playwright-reportpartial-summary.json
Network endpoints5
webhook.siteinbox.empirical.runapi.empirical.runtelemetry-worker.empirical-run.workers.devreports-r2.empirical.run
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- No preinstall/install/postinstall lifecycle hook is declared.
- Webhook requests use caller-provided API keys for the named webhook provider.
- Reporter uploads only after explicit reporter use and required run/storage environment configuration.
Evidence against
- No import-time network call, shell execution, or file harvesting found in inspected entrypoint paths.
- No credential material is sent to a fixed unrelated endpoint; API keys are used as authorization headers.
- The npx invocation is an explicit Playwright report-merge operation, not runtime package installation.
- Attachment deletion is limited to registered files after successful upload and only above a configured size limit.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
7 flaggeddist/reporter/local-test.jsView file
6exports.mergeForLocalTest = mergeForLocalTest;
L7: const child_process_1 = require("child_process");
L8: const path_1 = __importDefault(require("path"));
High
Child Process
Package source references child process execution.
dist/reporter/local-test.jsView on unpkg · L613try {
L14: (0, child_process_1.execFileSync)("npx", ["playwright", "merge-reports", outputDir, "--reporter", "html,json"], {
L15: cwd: currentWorkingDir,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/reporter/local-test.jsView on unpkg · L13dist/webhook.jsView file
6// ── webhook.site provider ──
L7: const WEBHOOK_SITE_BASE_URL = "https://webhook.site";
L8: const DEFAULT_TOKEN_EXPIRY = 604800;
...
L20: const expiry = options.expiry === undefined ? DEFAULT_TOKEN_EXPIRY : options.expiry;
L21: if (process.env.EMPIRICALRUN_API_KEY) {
L22: const apiClient = new api_worker_client_1.ApiWorkerClient();
...
L25: path: "/token",
L26: body: { expiry },
L27: });
...
L43: if (!response.ok) {
L44: const body = await response.text().catch(() => "");
L45: throw new Error(`webhook.site error [${response.status} ${response.statusText}]: ${body}`);
Findings
3 Critical4 High3 Medium5 Low
CriticalCredential Exfiltrationdist/webhook.js
CriticalTrigger Reachable Dangerous Capabilitydist/webhook.js
CriticalPrevious Version Dangerous Deltadist/reporter/harness.js
HighChild Processdist/reporter/local-test.js
HighTrigger Reachable Credential Exfiltrationdist/webhook.js
HighTrigger Reachable External Post Callbackdist/webhook.js
HighRuntime Package Installdist/reporter/local-test.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @empiricalrun/playwright-utils@0.58.2.
See all versions of @empiricalrun/playwright-utils for other recorded verdicts.
- Review the evidence and your use of @empiricalrun/playwright-utils@0.58.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.