@iblai/iblai-js@1.25.3: Suspicious npm security report (Warn)

Loading npm security reports…

@iblai/iblai-js@1.25.3: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged

dist/playwright/index.esm.jsView file

Lines 1-23javascript

1import test$2, { test as test$1, expect, devices, defineConfig } from '@playwright/test';

2export { expect } from '@playwright/test';

3import winston from 'winston';

4import axios from 'axios';

5import AxeBuilder from '@axe-core/playwright';

7const logger = winston.createLogger({

8 level: process.env.CI ? 'silent' : 'info',

9 format: winston.format.combine(winston.format.colorize(), winston.format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss' }), winston.format.printf((info) => {

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/playwright/index.esm.jsView on unpkg · L3

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/playwright/index.esm.jsView on unpkg · L3

10 const { timestamp, level, message, ...meta } = info;

11 const formattedMeta = Object.keys(meta).length

12 ? `\n${JSON.stringify(meta, undefined, 2)}`

13 : '';

14 return `${timestamp} ${level}: ${message} ${formattedMeta}`;

15 })),

16 transports: [new winston.transports.Console()],

17});

19/**

20 * Check if the current browser is Firefox

21 */

22function isFirefox(page) {

23 var _a;

Lines 255-295javascript

255 }

256 catch (error) {

257 if (axios.isAxiosError(error)) {

258 console.error('Error deleting email:', ((_a = error.response) === null || _a === void 0

bin/ibl-mcp-server.jsView file

Lines 1-12javascript

1#!/usr/bin/env node

2import { createRequire } from 'module';

3import { resolve, dirname } from 'path';

4import { fileURLToPath } from 'url';

6// Resolve @iblai/mcp from this package's dependency tree

dist/web-containers/source/next/index.esm.jsView file

•path = dist/web-containers/source/next/index.esm.js kind = oversized_source_file sizeBytes = 12986420 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/web-containers/source/next/index.esm.jsView on unpkg

dist/playwright/index.cjsView file

Lines 256-296javascript

256 }

257 catch (error) {

258 if (axios.isAxiosError(error)) {

259 console.error('Error deleting email:', ((_a = error.response) === null || _a ===

Source & flagged code

6 flagged · loading source

dist/playwright/index.esm.jsView file

3import winston from 'winston'; L4: import axios from 'axios'; L5: import AxeBuilder from '@axe-core/playwright'; ... L7: const logger = winston.createLogger({ L8: level: process.env.CI ? 'silent' : 'info', L9: format: winston.format.combine(winston.format.colorize(), winston.format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss' }), winston.format.printf((info) => { ... L177: try { L178: JSON.parse(value); L179: return true; ... L298: // Fill in Password field L299: const passwordInputField = page.getByPlaceholder('Password', { L300: exact: true,

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/playwright/index.esm.jsView on unpkg · L3

3Trigger-reachable chain: manifest.exports -> dist/playwright/index.esm.js L3: import winston from 'winston'; L4: import axios from 'axios'; L5: import AxeBuilder from '@axe-core/playwright'; ... L7: const logger = winston.createLogger({ L8: level: process.env.CI ? 'silent' : 'info', L9: format: winston.format.combine(winston.format.colorize(), winston.format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss' }), winston.format.printf((info) => { ... L177: try { L178: JSON.parse(value); L179: return true; ... L298: // Fill in Password field L299: const passwordInputField = page.getByPlaceholder('Password', { L300: exact: true,

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/playwright/index.esm.jsView on unpkg · L3

275patternName = generic_password severity = medium line = 275 matchedText = password...rd',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/playwright/index.esm.jsView on unpkg · L275

bin/ibl-mcp-server.jsView file

6// Resolve @iblai/mcp from this package's dependency tree L7: const require = createRequire(import.meta.url); L8: const mcpEntry = require.resolve('@iblai/mcp');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/ibl-mcp-server.jsView on unpkg · L6

dist/web-containers/source/next/index.esm.jsView file

•path = dist/web-containers/source/next/index.esm.js kind = oversized_source_file sizeBytes = 12986420 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/web-containers/source/next/index.esm.jsView on unpkg

dist/playwright/index.cjsView file

276patternName = generic_password severity = medium line = 276 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in dist/playwright/index.cjs

dist/playwright/index.cjsView on unpkg · L276

Source & flagged code

6 flagged

dist/playwright/index.esm.jsView file

Lines 1-23javascript

1import test$2, { test as test$1, expect, devices, defineConfig } from '@playwright/test';

2export { expect } from '@playwright/test';

3import winston from 'winston';

4import axios from 'axios';

5import AxeBuilder from '@axe-core/playwright';

7const logger = winston.createLogger({

8 level: process.env.CI ? 'silent' : 'info',

9 format: winston.format.combine(winston.format.colorize(), winston.format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss' }), winston.format.printf((info) => {

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/playwright/index.esm.jsView on unpkg · L3

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/playwright/index.esm.jsView on unpkg · L3

10 const { timestamp, level, message, ...meta } = info;

11 const formattedMeta = Object.keys(meta).length

12 ? `\n${JSON.stringify(meta, undefined, 2)}`

13 : '';

14 return `${timestamp} ${level}: ${message} ${formattedMeta}`;

15 })),

16 transports: [new winston.transports.Console()],

17});

19/**

20 * Check if the current browser is Firefox

21 */

22function isFirefox(page) {

23 var _a;

Lines 255-295javascript

255 }

256 catch (error) {

257 if (axios.isAxiosError(error)) {

258 console.error('Error deleting email:', ((_a = error.response) === null || _a === void 0

bin/ibl-mcp-server.jsView file

Lines 1-12javascript

1#!/usr/bin/env node

2import { createRequire } from 'module';

3import { resolve, dirname } from 'path';

4import { fileURLToPath } from 'url';

6// Resolve @iblai/mcp from this package's dependency tree

dist/web-containers/source/next/index.esm.jsView file

•path = dist/web-containers/source/next/index.esm.js kind = oversized_source_file sizeBytes = 12986420 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/web-containers/source/next/index.esm.jsView on unpkg

dist/playwright/index.cjsView file

Lines 256-296javascript

256 }

257 catch (error) {

258 if (axios.isAxiosError(error)) {

259 console.error('Error deleting email:', ((_a = error.response) === null || _a ===

@iblai/iblai-js@1.25.3

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code