Loading npm security reports…

@playdrop/playdrop-cli@0.12.37: Suspicious npm security report | LPM Firewall

registry / @playdrop/playdrop-cli / 0.12.37

@playdrop/playdrop-cli@0.12.37

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 87 file(s), 1.43 MB of source, external domains: 127.0.0.1, ai.blue.playdrop.ai, ai.green.playdrop.ai, ai.localhost, ai.playdrop.ai, ai.preview.playdrop.ai, api.blue.playdrop.ai, api.green.playdrop.ai, api.openai.com, api.playdrop.ai, api.preview.playdrop.ai, assets-local.playdrop.ai, assets.playdrop.ai, blue.playdrop.ai, github.com, green.playdrop.ai, playdrop.ai, preview.playdrop.ai, raw.githubusercontent.com, slack.com, www.localhost, www.playdrop.ai, www.w3.org

Source & flagged code

5 flagged

dist/playwright.jsView file

Lines 47-87javascript

47 '--no-sandbox',

48 '--disable-web-security',

49];

50// Force software WebGL for headless capture so local preview output stays stable.

51exports.HEADLESS_CHROMIUM_ARGS = [

52 ...COMMON_CHROMIUM_ARGS,

53 '--use-gl=angle',

54 '--use-angle=swiftshader',

55 '--enable-unsafe-swiftshader',

56 '--ignore-gpu-blocklist',

57];

58// Visible dev-browser sessions should use the normal GPU path instead of SwiftShader.

59exports.INTERACTIVE_CHROMIUM_ARGS = [

60 ...COMMON_CHROMIUM_ARGS,

61 '--ignore-gpu-blocklist',

62];

63// Deterministic project checks must exercise the installed Chrome GPU path.

64exports.INSTALLED_CHROME_ARGS = exports.INTERACTIVE_CHROMIUM_ARGS;

65// Backward-compatible alias for older imports.

66exports.CHROMIUM_ARGS = exports.HEADLESS_CHROMIUM_ARGS;

67let customLoader = null;

68const nativeImport = new Function('specifier', 'return import(specifier);');

69function setPlaywrightLoader(loader) {

High

Eval

Package source references dynamic code evaluation.

dist/playwright.jsView on unpkg · L67

70 customLoader = loader;

71}

72async function loadPlaywright() {

73 if (customLoader) {

74 return customLoader();

75 }

76 const loaderPath = process.env.PLAYDROP_PLAYWRIGHT_LOADER_PATH?.trim();

77 if (loaderPath) {

78 const loaderModule = await nativeImport((0, node_url_1.pathToFileURL)(loaderPath).href);

79 const candidate = loaderModule.loadPlaywright

80 ?? loaderModule.createPlaywrightModule

81 ?? loaderModule.default

82 ?? loaderModule;

83 if (typeof candidate === 'function') {

84 return await candidate();

85 }

86 if (candidate && typeof candidate === 'object' && typeof candidate.chromium?.launch === 'function') {

87 return candidate;

dist/apiClient.jsView file

Lines 1-25javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.createCliClientHeaders = createCliClientHeaders;

4exports.createCliApiClient = createCliApiClient;

5exports.createCliAiClient =

dist/commands/worker.jsView file

Lines 1-25javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod :

dist/commands/clients.jsView file

Lines 1-34javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod :

dist/commands/captureListing.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @playdrop/playdrop-cli@0.12.34 matchedIdentity = npm:QHBsYXlkcm9wL3BsYXlkcm9wLWNsaQ:0.12.34 similarity = 0.977 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/captureListing.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/playwright.jsView file

67let customLoader = null; L68: const nativeImport = new Function('specifier', 'return import(specifier);'); L69: function setPlaywrightLoader(loader) {

High

Eval

Package source references dynamic code evaluation.

dist/playwright.jsView on unpkg · L67

dist/apiClient.jsView file

5exports.createCliAiClient = createCliAiClient; L6: const api_client_1 = require("@playdrop/api-client"); L7: const ai_client_1 = require("@playdrop/ai-client");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/apiClient.jsView on unpkg · L5

dist/commands/worker.jsView file

5Object.defineProperty(exports, "__esModule", { value: true }); L6: exports.WORKER_TASK_WORKSPACE_RETENTION = exports.WORKER_CONTEXT_COMMAND_NOT_ALLOWED_MESSAGE = exports.WORKER_SESSION_EXPIRED_MESSAGE = exports.runLoggedProcess = exports.readEnvBo... L7: exports.allocateWorkerDevPort = allocateWorkerDevPort; ... L134: const WORKER_TRANSCRIPT_CHUNK_BATCH_SIZE = 100; L135: const SLACK_API_BASE_URL = 'https://slack.com/api'; L136: const WORKER_WRAPPER_CONTRACT_VERSION = 2; ... L306: const relativePath = [redacted](input.path); L307: const contentBase64 = typeof input.contentBase64 === 'string' ? input.contentBase64.trim() : ''; L308: const sha256 = typeof input.sha256 === 'string' ? input.sha256.trim() : ''; ... L436: attempt, L437: metadata: assignment.task.metadata, L438: },

Findings

3 High5 Medium6 Low

HighEvaldist/playwright.js

HighSandbox Evasion Gated Capabilitydist/commands/clients.js

HighPrevious Version Dangerous Deltadist/commands/captureListing.js

MediumDynamic Requiredist/apiClient.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/commands/worker.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/playwright.jsView file

Lines 47-87javascript

47 '--no-sandbox',

48 '--disable-web-security',

49];

50// Force software WebGL for headless capture so local preview output stays stable.

51exports.HEADLESS_CHROMIUM_ARGS = [

52 ...COMMON_CHROMIUM_ARGS,

53 '--use-gl=angle',

54 '--use-angle=swiftshader',

55 '--enable-unsafe-swiftshader',

56 '--ignore-gpu-blocklist',

57];

58// Visible dev-browser sessions should use the normal GPU path instead of SwiftShader.

59exports.INTERACTIVE_CHROMIUM_ARGS = [

60 ...COMMON_CHROMIUM_ARGS,

61 '--ignore-gpu-blocklist',

62];

63// Deterministic project checks must exercise the installed Chrome GPU path.

64exports.INSTALLED_CHROME_ARGS = exports.INTERACTIVE_CHROMIUM_ARGS;

65// Backward-compatible alias for older imports.

66exports.CHROMIUM_ARGS = exports.HEADLESS_CHROMIUM_ARGS;

67let customLoader = null;

68const nativeImport = new Function('specifier', 'return import(specifier);');

69function setPlaywrightLoader(loader) {

High

Eval

Package source references dynamic code evaluation.

dist/playwright.jsView on unpkg · L67

70 customLoader = loader;

71}

72async function loadPlaywright() {

73 if (customLoader) {

74 return customLoader();

75 }

76 const loaderPath = process.env.PLAYDROP_PLAYWRIGHT_LOADER_PATH?.trim();

77 if (loaderPath) {

78 const loaderModule = await nativeImport((0, node_url_1.pathToFileURL)(loaderPath).href);

79 const candidate = loaderModule.loadPlaywright

80 ?? loaderModule.createPlaywrightModule

81 ?? loaderModule.default

82 ?? loaderModule;

83 if (typeof candidate === 'function') {

84 return await candidate();

85 }

86 if (candidate && typeof candidate === 'object' && typeof candidate.chromium?.launch === 'function') {

87 return candidate;

dist/apiClient.jsView file

Lines 1-25javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.createCliClientHeaders = createCliClientHeaders;

4exports.createCliApiClient = createCliApiClient;

5exports.createCliAiClient =

dist/commands/worker.jsView file

Lines 1-25javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod :

dist/commands/clients.jsView file

Lines 1-34javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod :

dist/commands/captureListing.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/captureListing.jsView on unpkg