registry / @empiricalrun/playwright-utils / 0.58.6
@empiricalrun/playwright-utils@0.58.6
Playwright utils for test code repos of our customers
AI Security Review
scanned 3mo ago · by lpm-firewall-aiStatic inspection found package-aligned, caller-invoked Playwright utilities with configuration-gated network and reporting behavior, not an unconsented execution or exfiltration chain. The scanner's credential-exfiltration label conflates use of supplied service keys with authenticated API calls.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Consumer invokes webhook, reporter, telemetry, or report-merge utilities.
Impact
Expected test artifacts and telemetry may be sent only when the corresponding utility and configuration are used.
Mechanism
Configured testing, reporting, and service API calls.
AI rationale
Static inspection found package-aligned, caller-invoked Playwright utilities with configuration-gated network and reporting behavior, not an unconsented execution or exfiltration chain. The scanner's credential-exfiltration label conflates use of supplied service keys with authenticated API calls.
Evidence
package.jsondist/index.jsdist/webhook.jsdist/api-worker-client.jsdist/telemetry.jsdist/reporter/uploader.jsdist/reporter/local-test.js
Network endpoints5
api.empirical.runwebhook.siteinbox.empirical.runtelemetry-worker.empirical-run.workers.devreports-r2.empirical.run
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- No npm lifecycle hook is declared; scripts are development/test commands.
- Main entrypoint only re-exports utilities.
- Webhook requests require caller invocation and configured API credentials.
- Reporter uploads are enabled only with explicit project, run, backend, and storage configuration.
- Telemetry is opt-in via a dedicated telemetry key.
- Playwright process execution is confined to an explicit report-merge helper.
Evidence against
- No install-time, import-time, hidden payload, eval/vm, or remote code-loading behavior found.
- Network calls target declared Empirical, webhook.site, and configured storage services for package-aligned testing/reporting features.
- Credentials are used as authentication headers for the configured service, not collected and forwarded to an unrelated endpoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
7 flaggeddist/reporter/local-test.jsView file
6exports.mergeForLocalTest = mergeForLocalTest;
L7: const child_process_1 = require("child_process");
L8: const path_1 = __importDefault(require("path"));
High
Child Process
Package source references child process execution.
dist/reporter/local-test.jsView on unpkg · L613try {
L14: (0, child_process_1.execFileSync)("npx", ["playwright", "merge-reports", outputDir, "--reporter", "html,json"], {
L15: cwd: currentWorkingDir,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/reporter/local-test.jsView on unpkg · L13dist/kv.jsView file
3exports.KVClient = void 0;
L4: const api_worker_client_1 = require("./api-worker-client");
L5: class KVClient {
Medium
Findings
2 Critical5 High4 Medium5 Low
CriticalCredential Exfiltrationdist/webhook.js
CriticalTrigger Reachable Dangerous Capabilitydist/webhook.js
HighChild Processdist/reporter/local-test.js
HighShell
HighTrigger Reachable Credential Exfiltrationdist/webhook.js
HighTrigger Reachable External Post Callbackdist/webhook.js
HighRuntime Package Installdist/reporter/local-test.js
MediumDynamic Requiredist/kv.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @empiricalrun/playwright-utils@0.58.6.
See all versions of @empiricalrun/playwright-utils for other recorded verdicts.
- Review the evidence and your use of @empiricalrun/playwright-utils@0.58.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.