registry  /  @hasna/testers  /  0.0.89

@hasna/testers@0.0.89

AI-powered QA testing CLI — spawns cheap AI agents to test web apps with headless browsers

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 20 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings
Manifest
WildcardDependency
scanned 5 file(s), 4.74 MB of source, external domains: ai-gateway.vercel.sh, ai-sdk.dev, api.anthropic.com, api.cerebras.ai, api.github.com, api.openai.com, api.vercel.com, api.z.ai, app.example.com, bun.sh, cdn.jsdelivr.net, cdnjs.cloudflare.com, example.com, generativelanguage.googleapis.com, github.com, json-schema.org, react.dev, registry.npmjs.org, staging.example.com, truststore.pki.rds.amazonaws.com, vercel.com, www.npmjs.com, www.postgresql.org, www.w3.org
Oversized source lightweight scan
dist/cli/index.js2.61 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsShellDynamicRequireHighEntropyStrings

Source & flagged code

6 flagged · loading source
package.jsonView file
•scripts.postinstall = mkdir -p $HOME/.hasna/testers/screenshots $HOME/.hasna/testers/browser/profiles 2>/dev/null || true
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = mkdir -p $HOME/.hasna/testers/screenshots $HOME/.hasna/testers/browser/profiles 2>/dev/null || true
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/index.jsView file
4736import { chromium } from "playwright"; L4737: import { spawn } from "child_process"; L4738: function isLightpandaAvailable() {
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L4736
4872try { L4873: execSync("bun install @lightpanda/browser", { L4874: stdio: "inherit",
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L4872
dist/cli/index.jsView file
•path = dist/cli/index.js kind = oversized_source_file sizeBytes = 2734891 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli/index.jsView on unpkg
•path = dist/cli/index.js kind = oversized_cli_entrypoint sizeBytes = 2734891 magicHex = [redacted]
Medium
Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli/index.jsView on unpkg

Findings

6 High7 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighShell
HighEval
HighRuntime Package Installdist/index.js
HighOversized Source Filedist/cli/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
MediumOversized Cli Entrypointdist/cli/index.js
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings