registry / @qubiqlabs/webpilot / 1.1.9

@qubiqlabs/webpilot@1.1.9

AI-native web automation on top of Playwright: natural language execution, codegen, healing, and reports

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 142 file(s), 969 KB of source, external domains: api.anthropic.com, api.openai.com, automationexercise.com, demo.applitools.com, dotnet.microsoft.com, fonts.googleapis.com, generativelanguage.googleapis.com, maven.apache.org, nodejs.org, petstore.swagger.io, playwright.dev, www.booking.com, www.python.org, www.w3.org

Source & flagged code

6 flagged

dist/src/core/CodegenPlaywrightValidator.jsView file

Lines 16-56javascript

16 o["default"] = v;

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.CodegenPlaywrightValidator = void 0;

37const child_process_1 = require("child_process");

38const fs = __importStar(require("fs"));

High

Child Process

Package source references child process execution.

dist/src/core/CodegenPlaywrightValidator.jsView on unpkg · L36

39const path = __importStar(require("path"));

40const CodegenContext_1 = require("./CodegenContext");

41const CodegenNormalizer_1 = require("./CodegenNormalizer");

42const PromptLoader_1 = require("./PromptLoader");

43const CodegenValidationBundle_1 = require("./CodegenValidationBundle");

44const MAX_PLAYWRIGHT_FIX_ROUNDS = 2;

45function isMissingPlaywrightBrowserError(output) {

46 return /Executable doesn't exist|Please run the following command to download new browsers|npx playwright install/i.test(output);

47}

48/** Playwright CLI args are regex patterns — use project-relative forward-slash paths on Windows. */

49function toPlaywrightSpecArg(relativePath) {

50 return relativePath.replace(/\\/g, '/');

51}

52/**

53 * Runs generated Playwright specs and optionally auto-fixes via LLM from failure output.

54 */

55class CodegenPlaywrightValidator {

56 static runSpecs(relativeSpecPaths) {

dist/src/cli/index.jsView file

Lines 547-587javascript

547 else

548 fail('tsconfig.json missing', 'Init/codegen should scaffold Cypress TypeScript config.');

549 if (exists('cypress/support/pages/BasePage.ts'))

550 pass('cypress/support/pages/BasePage.ts found');

551 else

552 fail('BasePage.ts missing'

dist/src/integrations/browser_use/PythonRuntime.jsView file

Lines 22-62javascript

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

scripts/setup-python.shView file

•path = scripts/setup-python.sh kind = build_helper sizeBytes = 1433 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/setup-python.shView on unpkg

docs/FRAMEWORK_GUIDE.mdView file

Lines 682-722markdown

682

683WebPilot codegen follows rules in `resources/prompts/shared/`:

684

685- **Strict semantic locators** — scope regions, use `.filter()` when multiple matches

686- **BasePage reuse** — generated POMs call shared helpers, not raw Playwright everywhere

687- **Multi-page POM** — one class per route, not one file per site

688- **Symbol graph merge** — new methods extend existing page classes via AST

Source & flagged code

6 flagged · loading source

dist/src/core/CodegenPlaywrightValidator.jsView file

36exports.CodegenPlaywrightValidator = void 0; L37: const child_process_1 = require("child_process"); L38: const fs = __importStar(require("fs"));

High

Child Process

Package source references child process execution.

dist/src/core/CodegenPlaywrightValidator.jsView on unpkg · L36

dist/src/cli/index.jsView file

740try { L741: const candidateVersion = execSync(`${compatiblePython} -c "import sys; print(f'{sys.version_info.major}.{sys.version_info.minor}.{sys.version_info.micro}')"`, { encoding: 'utf8', s... L742: warn(`Current Python ${version} is too old, but ${compatiblePython} (${candidateVersion}) is available`, 'Run: webpilot setup');

High

Shell

Package source references shell execution.

dist/src/cli/index.jsView on unpkg · L740

567try { L568: execSync('npx tsc --noEmit', { L569: encoding: 'utf8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/index.jsView on unpkg · L567

dist/src/integrations/browser_use/PythonRuntime.jsView file

42const path = __importStar(require("path")); L43: const child_process_1 = require("child_process"); L44: const ProjectContext_1 = require("../../cli/ProjectContext"); ... L53: 'python', L54: ...(process.platform === 'win32' L55: ? ['py -3.13', 'py -3.12', 'py -3.11', 'py'] ... L81: return ('browser-use requires Python 3.11+.\n' + L82: ' Install from https://www.python.org/downloads/ (or: winget install Python.Python.3.13)\n' + L83: ' Or set WEBPILOT_PYTHON to your python.exe path\n' + ... L91: function projectRoot() { L92: return path.resolve(process.env.WEBPILOT_PROJECT_ROOT || (0, ProjectContext_1.findProjectRoot)()); L93: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/integrations/browser_use/PythonRuntime.jsView on unpkg · L42

scripts/setup-python.shView file

•path = scripts/setup-python.sh kind = build_helper sizeBytes = 1433 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/setup-python.shView on unpkg

docs/FRAMEWORK_GUIDE.mdView file

702patternName = generic_password severity = medium line = 702 matchedText = await ap... });

Medium

Secret Pattern

Hardcoded password in docs/FRAMEWORK_GUIDE.md

docs/FRAMEWORK_GUIDE.mdView on unpkg · L702

Findings

4 High5 Medium4 Low

HighChild Processdist/src/core/CodegenPlaywrightValidator.js

HighShelldist/src/cli/index.js

HighSandbox Evasion Gated Capabilitydist/src/integrations/browser_use/PythonRuntime.js

HighRuntime Package Installdist/src/cli/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/setup-python.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndocs/FRAMEWORK_GUIDE.md

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/src/core/CodegenPlaywrightValidator.jsView file

Lines 16-56javascript

16 o["default"] = v;

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.CodegenPlaywrightValidator = void 0;

37const child_process_1 = require("child_process");

38const fs = __importStar(require("fs"));

High

Child Process

Package source references child process execution.

dist/src/core/CodegenPlaywrightValidator.jsView on unpkg · L36

39const path = __importStar(require("path"));

40const CodegenContext_1 = require("./CodegenContext");

41const CodegenNormalizer_1 = require("./CodegenNormalizer");

42const PromptLoader_1 = require("./PromptLoader");

43const CodegenValidationBundle_1 = require("./CodegenValidationBundle");

44const MAX_PLAYWRIGHT_FIX_ROUNDS = 2;

45function isMissingPlaywrightBrowserError(output) {

46 return /Executable doesn't exist|Please run the following command to download new browsers|npx playwright install/i.test(output);

47}

48/** Playwright CLI args are regex patterns — use project-relative forward-slash paths on Windows. */

49function toPlaywrightSpecArg(relativePath) {

50 return relativePath.replace(/\\/g, '/');

51}

52/**

53 * Runs generated Playwright specs and optionally auto-fixes via LLM from failure output.

54 */

55class CodegenPlaywrightValidator {

56 static runSpecs(relativeSpecPaths) {

dist/src/cli/index.jsView file

Lines 547-587javascript

547 else

548 fail('tsconfig.json missing', 'Init/codegen should scaffold Cypress TypeScript config.');

549 if (exists('cypress/support/pages/BasePage.ts'))

550 pass('cypress/support/pages/BasePage.ts found');

551 else

552 fail('BasePage.ts missing'

dist/src/integrations/browser_use/PythonRuntime.jsView file

Lines 22-62javascript

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

scripts/setup-python.shView file

•path = scripts/setup-python.sh kind = build_helper sizeBytes = 1433 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/setup-python.shView on unpkg

docs/FRAMEWORK_GUIDE.mdView file

Lines 682-722markdown

682

683WebPilot codegen follows rules in `resources/prompts/shared/`:

684

685- **Strict semantic locators** — scope regions, use `.filter()` when multiple matches

686- **BasePage reuse** — generated POMs call shared helpers, not raw Playwright everywhere

687- **Multi-page POM** — one class per route, not one file per site

688- **Symbol graph merge** — new methods extend existing page classes via AST

Lines 720-760javascript

720 if (fs.existsSync(chromiumPath))

721 pass('Playwright Chromium browser installed');

722 else

723 warn('Playwright Chromium browser not installed', 'Run: npx playwright install chromium');

724 }

725 catch {

726 fail('Playwright is not ready', 'Run: npm install && npx playwright install chromium');

727 }

728 }

729 console.log(`\n${chalk_1.default.blue('Python and WebPilot engine')}`);

730 try {

731 const { resolvePythonPath, hasBrowserUse, findCompatibleSystemPython } = require('../integrations/browser_use/PythonRuntime');

732 const py = resolvePythonPath();

733 const version = execSync(`"${py}" -c "import sys; print(f'{sys.version_info.major}.{sys.version_info.minor}.{sys.version_info.micro}')"`, { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();

734 const [major, minor] = version.split('.').map(Number);

735 if (major > 3 || (major === 3 && minor >= 11))

736 pass(`Python ${version} (${py})`);

737 else {

738 const compatiblePython = findCompatibleSystemPython();

739 if (compatiblePython) {

740 try {

741 const candidateVersion = execSync(`${compatiblePython} -c "import sys; print(f'{sys.version_info.major}.{sys.version_info.minor}.{sys.version_info.micro}')"`, { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], shell: true }).trim();

742 warn(`Current Python ${version} is too old, but ${compatiblePython} (${candidateVersion}) is available`, 'Run: webpilot setup');

High

Shell

Package source references shell execution.

dist/src/cli/index.jsView on unpkg · L740

743 }

744 catch {

745 warn(`Current Python ${version} is too old, but ${compatiblePython} is available`, 'Run: webpilot setup');

746 }

747 }

748 else {

749 fail(`Python ${version} is too old`, 'Install Python 3.11+ and run: webpilot setup');

750 }

751 }

752 if (!hasBrowserUse(py)) {

753 warn(`browser_use not installed for ${py}`, 'Run: webpilot setup');

754 }

755 else {

756 const installRoot = (0, ProjectContext_1.findCliInstallRoot)();

757 const source = execSync(`"${py}" -c "import browser_use; print(browser_use.__file__)"`, {

758 cwd: process.cwd(),

759 encoding: 'utf8',

760 env: {