registry / @govtechsg/oobee / 0.10.98

@govtechsg/oobee@0.10.98

Oobee is a customisable, automated accessibility testing tool that allows software development teams to assess whether their products are user-friendly to persons with disabilities (PWDs).

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

GitDependency

scanned 120 file(s), 2.95 MB of source, external domains: a11y.tech.gov.sg, blogs.law.harvard.edu, browser.sentry-cdn.com, dequeuniversity.com, diveintomark.org, docs.google.com, example.org, github.com, govtechsg.github.io, playwright.dev, reactjs.org, store.esellerate.net, www.blog-connection.com, www.bytescout.com, www.deque.com, www.example.com, www.feedforall.com, www.google.com, www.isomer.gov.sg, www.rss-specifications.com, www.sitemaps.org, www.surfpack.com, www.w3.org, www.wcag.com

Source & flagged code

3 flagged

dist/crawlers/commonCrawlerFunc.jsView file

Lines 734-774javascript

734 catch (e) {

735 // do nothing, just continue

736 }

737 // Omit logging of browser console errors to reduce unnecessary verbosity

738 /*

739 page.on('console', msg => {

740 const type = msg.type();

741 if (type === 'error') {

742 consoleLogger.error(msg.text());

743 } else {

744 consoleLogger.info(msg.text());

745 }

746 });

747 */

748 const disableOobee = ruleset.includes(RuleFlags.DISABLE_OOBEE);

749 const enableWcagAaa = ruleset.includes(RuleFlags.ENABLE_WCAG_AAA);

750 const gradingReadabilityFlag = await extractAndGradeText(page); // Ensure flag is obtained before proceeding

751 await playwrightUtils.injectFile(page, axeScript);

752 const results = await page.evaluate(async ({ selectors, saflyIconSelector, disableOobee, enableWcagAaa, gradingReadabilityFlag, evaluateAltTextFunctionString, escapeCssSelectorFunctionString, framesCheckFunctionString, findElementByCssSelectorFunctionString, getAxeConfigurationFunctionString, flagUnlabelledClickableElementsFunctionString, xPathToCssFunctionString, }) => {

753 try {

754 // Load functions into the browser context

755 eval(evaluateAltTextFunctionString);

756 eval(escapeCssSelectorFunctionString);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/crawlers/commonCrawlerFunc.jsView on unpkg · L754

757 eval(framesCheckFunctionString);

758 eval(findElementByCssSelectorFunctionString);

759 eval(flagUnlabelledClickableElementsFunctionString);

760 eval(xPathToCssFunctionString);

761 eval(getAxeConfigurationFunctionString);

762 // remove so that axe does not scan

763 document.querySelector(saflyIconSelector)?.remove();

764 const oobeeAccessibleLabelFlaggedXpaths = disableOobee

765 ? []

766 : (await flagUnlabelledClickableElements()).map(item => item.xpath);

767 const oobeeAccessibleLabelFlaggedCssSelectors = oobeeAccessibleLabelFlaggedXpaths

768 .map(xpath => {

769 try {

770 const cssSelector = xPathToCss(xpath);

771 return cssSelector;

772 }

773 catch (e) {

774 console.error('Error converting XPath to CSS: ', xpath, e);

scripts/install_oobee_dependencies.cmdView file

•path = scripts/install_oobee_dependencies.cmd kind = build_helper sizeBytes = 480 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install_oobee_dependencies.cmdView on unpkg

package.jsonView file

Lines 83-123json

83 "eslint-config-airbnb-base": {

84 "eslint": "^9.26.0"

85 },

86 "fast-xml-parser": ">=5.3.8",

87 "js-yaml": "^4.1.1",

88 "minimatch": "^10.2.4",

89 "brace-expansion": "^5.0.6",

Source & flagged code

3 flagged · loading source

dist/crawlers/commonCrawlerFunc.jsView file

754// Load functions into the browser context L755: eval(evaluateAltTextFunctionString); L756: eval(escapeCssSelectorFunctionString);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/crawlers/commonCrawlerFunc.jsView on unpkg · L754

scripts/install_oobee_dependencies.cmdView file

•path = scripts/install_oobee_dependencies.cmd kind = build_helper sizeBytes = 480 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install_oobee_dependencies.cmdView on unpkg

package.jsonView file

•Runtime dependency names matching Node built-ins: https

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

Findings

1 High5 Medium5 Low

HighNode Builtin Dependency Squatpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/install_oobee_dependencies.cmd

MediumStructural Risk Force Deep Review

MediumGit Dependency

LowScripts Present

LowEvaldist/crawlers/commonCrawlerFunc.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/crawlers/commonCrawlerFunc.jsView file

Lines 734-774javascript

734 catch (e) {

735 // do nothing, just continue

736 }

737 // Omit logging of browser console errors to reduce unnecessary verbosity

738 /*

739 page.on('console', msg => {

740 const type = msg.type();

741 if (type === 'error') {

742 consoleLogger.error(msg.text());

743 } else {

744 consoleLogger.info(msg.text());

745 }

746 });

747 */

748 const disableOobee = ruleset.includes(RuleFlags.DISABLE_OOBEE);

749 const enableWcagAaa = ruleset.includes(RuleFlags.ENABLE_WCAG_AAA);

750 const gradingReadabilityFlag = await extractAndGradeText(page); // Ensure flag is obtained before proceeding

751 await playwrightUtils.injectFile(page, axeScript);

753 try {

754 // Load functions into the browser context

755 eval(evaluateAltTextFunctionString);

756 eval(escapeCssSelectorFunctionString);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/crawlers/commonCrawlerFunc.jsView on unpkg · L754

757 eval(framesCheckFunctionString);

758 eval(findElementByCssSelectorFunctionString);

759 eval(flagUnlabelledClickableElementsFunctionString);

760 eval(xPathToCssFunctionString);

761 eval(getAxeConfigurationFunctionString);

762 // remove so that axe does not scan

763 document.querySelector(saflyIconSelector)?.remove();

764 const oobeeAccessibleLabelFlaggedXpaths = disableOobee

765 ? []

766 : (await flagUnlabelledClickableElements()).map(item => item.xpath);

767 const oobeeAccessibleLabelFlaggedCssSelectors = oobeeAccessibleLabelFlaggedXpaths

768 .map(xpath => {

769 try {

770 const cssSelector = xPathToCss(xpath);

771 return cssSelector;

772 }

773 catch (e) {

774 console.error('Error converting XPath to CSS: ', xpath, e);

scripts/install_oobee_dependencies.cmdView file

•path = scripts/install_oobee_dependencies.cmd kind = build_helper sizeBytes = 480 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install_oobee_dependencies.cmdView on unpkg

package.jsonView file

Lines 83-123json

83 "eslint-config-airbnb-base": {

84 "eslint": "^9.26.0"

85 },

86 "fast-xml-parser": ">=5.3.8",

87 "js-yaml": "^4.1.1",

88 "minimatch": "^10.2.4",

89 "brace-expansion": "^5.0.6",