registry / @moxxy/plugin-browser / 0.28.0

@moxxy/plugin-browser@0.28.0

Browser capabilities for moxxy: web_fetch (zero-deps light tier) + browser_session (Playwright sidecar for JS-heavy / interactive pages).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 27 file(s), 250 KB of source, external domains: 10.0.0.1, 10.0.0.5, 127.0.0.1, 169.254.169.254, 172.16.0.1, 192.168.1.1, 93.184.216.34, a.example.com, b.example.com, evil.example.com, example.com, intranet.example.com, nope.invalid, single.example, unquoted.example

Source & flagged code

3 flagged

dist/browser-session.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { randomUUID } from 'node:crypto';

High

Child Process

Package source references child process execution.

dist/browser-session.jsView on unpkg · L1

3import * as path from 'node:path';

4import { fileURLToPath } from 'node:url';

5import { MoxxyError, defineTool, z } from '@moxxy/sdk';

6import { assertPublicUrl, SsrfBlockedError } from './ssrf-guard.js';

7const actionSchema = z.union([

8 z.object({

9 kind: z.literal('goto'),

10 // `z.string().url()` accepts file:// and javascript: URLs, which would be

11 // forwarded verbatim to Playwright `page.goto`. This refine is only a fast

12 // schema-level scheme check; the full SSRF guard (loopback/private/

13 // link-local/metadata IPs, DNS resolution — same `assertPublicUrl` as

14 // web_fetch) runs in the handler before the RPC AND again inside the

15 // sidecar's goto dispatch.

16 url: z.string().url().refine((u) => /^https?:\/\//i.test(u), 'only http(s) URLs allowed'),

17 waitUntil: z.enum(['load', 'domcontentloaded', 'networkidle']).optional(),

18 timeoutMs: z.number().int().positive().max(120_000).optional(),

19 }),

20 z.object({

21 kind: z.literal('click'),

dist/sidecar/install.jsView file

Lines 1-22javascript

1/**

2 * Playwright lifecycle: import, launch, and one-shot auto-install of the

3 * per-browser binary. Keeps the dispatch layer free of node:child_process

4 * + Playwright-import noise.

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/sidecar/install.jsView on unpkg · L2

5 */

6import { spawn } from 'node:child_process';

7import { assertPublicUrl } from '../ssrf-guard.js'

Source & flagged code

3 flagged · loading source

dist/browser-session.jsView file

1import { spawn } from 'node:child_process'; L2: import { randomUUID } from 'node:crypto';

High

Child Process

Package source references child process execution.

dist/browser-session.jsView on unpkg · L1

dist/sidecar/install.jsView file

2* Playwright lifecycle: import, launch, and one-shot auto-install of the L3: * per-browser binary. Keeps the dispatch layer free of node:child_process L4: * + Playwright-import noise. ... L61: const onChunk = (chunk) => { L62: const text = chunk.toString('utf8'); L63: for (const line of text.split(/\r?\n/)) ... L67: }; L68: child.stdout.on('data', onChunk); L69: child.stderr.on('data', onChunk); ... L101: throw err; L102: process.stderr.write(`moxxy-browser: ${which} binary missing, running \`npx playwright install ${which}\` ` + L103: `(one-time, ~150MB). This may take a minute…\n`);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/sidecar/install.jsView on unpkg · L2

221return new Promise((resolve, reject) => { L222: const child = spawn('npx', ['playwright', 'install', which], { L223: stdio: ['ignore', 'pipe', 'pipe'],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/sidecar/install.jsView on unpkg · L221

Findings

4 High3 Medium3 Low

HighChild Processdist/browser-session.js

HighShell

HighCloud Metadata Accessdist/sidecar/install.js

HighRuntime Package Installdist/sidecar/install.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/browser-session.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { randomUUID } from 'node:crypto';

High

Child Process

Package source references child process execution.

dist/browser-session.jsView on unpkg · L1

3import * as path from 'node:path';

4import { fileURLToPath } from 'node:url';

5import { MoxxyError, defineTool, z } from '@moxxy/sdk';

6import { assertPublicUrl, SsrfBlockedError } from './ssrf-guard.js';

7const actionSchema = z.union([

8 z.object({

9 kind: z.literal('goto'),

10 // `z.string().url()` accepts file:// and javascript: URLs, which would be

11 // forwarded verbatim to Playwright `page.goto`. This refine is only a fast

12 // schema-level scheme check; the full SSRF guard (loopback/private/

13 // link-local/metadata IPs, DNS resolution — same `assertPublicUrl` as

14 // web_fetch) runs in the handler before the RPC AND again inside the

15 // sidecar's goto dispatch.

16 url: z.string().url().refine((u) => /^https?:\/\//i.test(u), 'only http(s) URLs allowed'),

17 waitUntil: z.enum(['load', 'domcontentloaded', 'networkidle']).optional(),

18 timeoutMs: z.number().int().positive().max(120_000).optional(),

19 }),

20 z.object({

21 kind: z.literal('click'),

dist/sidecar/install.jsView file

Lines 1-22javascript

1/**

2 * Playwright lifecycle: import, launch, and one-shot auto-install of the

3 * per-browser binary. Keeps the dispatch layer free of node:child_process

4 * + Playwright-import noise.

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/sidecar/install.jsView on unpkg · L2

5 */

6import { spawn } from 'node:child_process';

7import { assertPublicUrl } from '../ssrf-guard.js'

Lines 201-241javascript

201 remember(host, true);

202 return route.abort('blockedbyclient');

203 }

204 return route.continue();

205 });

206}

207function isMissingBrowserError(err) {

208 if (!(err instanceof Error))

209 return false;

210 // Playwright's "Executable doesn't exist at …" launch error fires

211 // when the npm package is installed but the per-browser binary

212 // hasn't been downloaded. The message stays stable across versions.

213 return /Executable doesn'?t exist at/i.test(err.message);

214}

215/**

216 * Run `npx playwright install <which>` and stream its output to the

217 * sidecar's stderr so the operator can watch progress. Resolves on

218 * exit-0; rejects with the tail of stderr otherwise.

219 */

220function runPlaywrightInstall(which) {

221 return new Promise((resolve, reject) => {

222 const child = spawn('npx', ['playwright', 'install', which], {

223 stdio: ['ignore', 'pipe', 'pipe'],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/sidecar/install.jsView on unpkg · L221

224 });

225 let stderrTail = '';

226 child.stdout.on('data', (chunk) => process.stderr.write(chunk));

227 child.stderr.on('data', (chunk) => {

228 process.stderr.write(chunk);

229 stderrTail += chunk.toString('utf8');

230 if (stderrTail.length > 4000)

231 stderrTail = stderrTail.slice(-4000);

232 });

233 child.once('error', (err) => reject(err));

234 child.once('close', (code) => {

235 if (code === 0)

236 resolve();

237 else

238 reject(new Error(`exit ${code}: ${stderrTail.trim() || '(no stderr)'}`));

239 });

240 });

241}