registry / @empiricalrun/playwright-utils / 0.61.2
@empiricalrun/playwright-utils@0.61.2
Playwright utils for test code repos of our customers
AI Security Review
scanned 20d ago · by lpm-firewall-aiSource inspection found no install hook or concrete attack behavior. The scanner's webhook finding maps to explicit test helpers, while the dynamic overlay cache and telemetry are tied to Playwright testing and the package's API service.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Consumers invoke the exported helpers or use the Playwright test fixture; overlay assistance runs when a click or hover is blocked by an intercepting element.
Impact
These operations support testing and reporting; the inspected source does not establish credential theft or another concrete attack.
Mechanism
The helpers contact the selected webhook provider, telemetry uses the Empirical API when a project key is present, and overlay code is generated for and matched to a page element.
AI rationale
Source inspection found no install hook or concrete attack behavior. The scanner's webhook finding maps to explicit test helpers, while the dynamic overlay cache and telemetry are tied to Playwright testing and the package's API service.
Evidence
package.jsondist/webhook.jsdist/api-worker-client.jsdist/telemetry.jsdist/test/scripts/pw-locator-patch/dismiss-overlays/cache.jsdist/test/scripts/pw-locator-patch/highlight/click.jsdist/reporter/local-test.jsdist/reporter/incremental-blob-reporter.jsupstream-oracle/run.mjs
Network endpoints3
api.empirical.runwebhook.siteinbox.empirical.run
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the library and test helpers, and lists no install lifecycle hook; upstream-oracle/run.mjs is a separate test harness.
- The webhook helpers create and query webhook.site or Empirical inbox tokens through exported calls, using API keys for those services.
- ApiWorkerClient sends its Empirical project key to the Empirical API by default; DASHBOARD_DOMAIN can select another API host.
- Overlay code is generated by the overlay agent, cached against an element description, and run only for a matching overlay during a Playwright interaction.
- The local report helper runs only Playwright's merge-reports command, and its caller gates it on local testing.
- Telemetry requires EMPIRICALRUN_API_KEY and sends test-run event properties to the API worker.
Evidence against
- The overlay cache compiles a matching stored code string with AsyncFunction and executes it with the Playwright page.
- Overlay telemetry includes page text and test identifiers, sent to the package's API worker when the project key is present.
Behavioral surface
Source & flagged code
9 flaggeddist/reporter/local-test.jsView file
6exports.mergeForLocalTest = mergeForLocalTest;
L7: const child_process_1 = require("child_process");
L8: const path_1 = __importDefault(require("path"));
High
Child Process
Package source references child process execution.
dist/reporter/local-test.jsView on unpkg · L613try {
L14: (0, child_process_1.execFileSync)("npx", ["playwright", "merge-reports", outputDir, "--reporter", "html,json"], {
L15: cwd: currentWorkingDir,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/reporter/local-test.jsView on unpkg · L13dist/kv.jsView file
3exports.KVClient = void 0;
L4: const api_worker_client_1 = require("./api-worker-client");
L5: class KVClient {
Medium
Findings
3 Critical6 High4 Medium5 Low
CriticalCredential Exfiltrationdist/webhook.js
CriticalTrigger Reachable Dangerous Capabilitydist/webhook.js
CriticalPrevious Version Dangerous Deltadist/test/scripts/pw-locator-patch/dismiss-overlays/cache.js
HighChild Processdist/reporter/local-test.js
HighShell
HighTrigger Reachable Credential Exfiltrationdist/webhook.js
HighTrigger Reachable External Post Callbackdist/webhook.js
HighRuntime Package Installdist/reporter/local-test.js
HighSemantic Analysis Limitedupstream-oracle/run.mjs#virtual:normalized:round1
MediumDynamic Requiredist/kv.js
MediumNetwork
Medium
Affected versions and remediation
This report applies to @empiricalrun/playwright-utils@0.61.2.
See all versions of @empiricalrun/playwright-utils for other recorded verdicts.
- Review the evidence and your use of @empiricalrun/playwright-utils@0.61.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.