registry  /  @qubiqlabs/webpilot  /  1.0.4

@qubiqlabs/webpilot@1.0.4

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 126 file(s), 797 KB of source, external domains: api.anthropic.com, api.openai.com, automationexercise.com, demo.applitools.com, fonts.googleapis.com, generativelanguage.googleapis.com, maven.apache.org, nodejs.org, petstore.swagger.io, www.booking.com, www.w3.org

Source & flagged code

4 flagged · loading source
dist/src/core/CodegenPlaywrightValidator.jsView file
36exports.CodegenPlaywrightValidator = void 0; L37: const child_process_1 = require("child_process"); L38: const fs = __importStar(require("fs"));
High
Child Process

Package source references child process execution.

dist/src/core/CodegenPlaywrightValidator.jsView on unpkg · L36
55try { L56: (0, child_process_1.execSync)(`npx playwright test ${args} -c packages/test-framework/playwright.config.ts --retries=0`, { L57: cwd: process.cwd(),
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/core/CodegenPlaywrightValidator.jsView on unpkg · L55
scripts/setup-python.shView file
•path = scripts/setup-python.sh kind = build_helper sizeBytes = 1224 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/setup-python.shView on unpkg
docs/FRAMEWORK_GUIDE.mdView file
702patternName = generic_password severity = medium line = 702 matchedText = await ap... });
Medium
Secret Pattern

Hardcoded password in docs/FRAMEWORK_GUIDE.md

docs/FRAMEWORK_GUIDE.mdView on unpkg · L702

Findings

3 High5 Medium4 Low
HighChild Processdist/src/core/CodegenPlaywrightValidator.js
HighShell
HighRuntime Package Installdist/src/core/CodegenPlaywrightValidator.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/setup-python.sh
MediumStructural Risk Force Deep Review
MediumSecret Patterndocs/FRAMEWORK_GUIDE.md
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings