registry  /  @reportforge/playwright-pdf  /  0.20.2

@reportforge/playwright-pdf@0.20.2

⚠ Under review

Playwright Test reporter that generates designed PDF reports: minimal, detailed, and executive templates with CI/CD integrations

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsTelemetryUrlStrings
ManifestNo manifest risk signals triggered.
scanned 3 file(s), 2.85 MB of source, external domains: adaptivecards.io, bitbucket.org, github.com, playwright.dev, qpdf.readthedocs.io, reportforge.org, www.chartjs.org

Source & flagged code

5 flagged · loading source
dist/index.jsView file
6078init_cjs_shims(); L6079: var { execSync: execSync3 } = require("child_process"); L6080: var path16 = require("path");
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6078
657loggedProperties[propertyName] = true; L658: _logger2["default"].log("error", 'Handlebars: Access has been denied to resolve the property "' + propertyName + '" because it is not an "own property" of its parent.\nYou can add ... L659: } ... L949: }, L950: data: function data(value, depth) { L951: while (value && depth--) { ... L2937: L2938: // node_modules/source-map/lib/base64.js L2939: var require_base64 = __commonJS({ ... L5734: (function() { L5735: var reservedWords = "break else new var case finally return void catch for switch while continue function this with default if throw delete in try do instanceof typeof abstract enu... L5736: var compilerWords = JavaScriptCompiler.RESERVED_WORDS = {};
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L657
657Cross-file remote execution chain: dist/index.js spawns dist/cli/index.js; helper contains network access plus dynamic code execution. L657: loggedProperties[propertyName] = true; L658: _logger2["default"].log("error", 'Handlebars: Access has been denied to resolve the property "' + propertyName + '" because it is not an "own property" of its parent.\nYou can add ... L659: } ... L949: }, L950: data: function data(value, depth) { L951: while (value && depth--) { ... L2937: L2938: // node_modules/source-map/lib/base64.js L2939: var require_base64 = __commonJS({ ... L5734: (function() { L5735: var reservedWords = "break else new var case finally return void catch for switch while continue function this with default if throw delete in try do instanceof typeof abstract enu... L5736: var compilerWords = JavaScriptCompiler.RESERVED_WORDS = {};
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L657
10}; L11: var __commonJS = (cb, mod) => function __require() { L12: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L10
dist/cli/index.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = @reportforge/playwright-pdf@0.13.1 matchedIdentity = npm:[redacted]:0.13.1 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.jsView on unpkg

Findings

1 Critical4 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/cli/index.js
HighChild Processdist/index.js
HighShell
HighSandbox Evasion Gated Capabilitydist/index.js
HighCross File Remote Execution Contextdist/index.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings