registry / @reportforge/playwright-pdf / 0.27.0

@reportforge/playwright-pdf@0.27.0

Playwright Test reporter that generates designed PDF reports: minimal, detailed, and executive templates with CI/CD integrations

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 2.91 MB of source, external domains: adaptivecards.io, bitbucket.org, github.com, playwright.dev, reportforge.org, www.chartjs.org

Source & flagged code

5 flagged

dist/index.jsView file

6078init_cjs_shims(); L6079: var { execSync: execSync3 } = require("child_process"); L6080: var path15 = require("path");

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6078

657loggedProperties[propertyName] = true; L658: _logger2["default"].log("error", 'Handlebars: Access has been denied to resolve the property "' + propertyName + '" because it is not an "own property" of its parent.\nYou can add ... L659: } ... L949: }, L950: data: function data(value, depth) { L951: while (value && depth--) { ... L2937: L2938: // node_modules/source-map/lib/base64.js L2939: var require_base64 = __commonJS({ ... L5734: (function() { L5735: var reservedWords = "break else new var case finally return void catch for switch while continue function this with default if throw delete in try do instanceof typeof abstract enu... L5736: var compilerWords = JavaScriptCompiler.RESERVED_WORDS = {};

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L657

657Cross-file remote execution chain: dist/index.js spawns dist/cli/index.js; helper contains network access plus dynamic code execution. L657: loggedProperties[propertyName] = true; L658: _logger2["default"].log("error", 'Handlebars: Access has been denied to resolve the property "' + propertyName + '" because it is not an "own property" of its parent.\nYou can add ... L659: } ... L949: }, L950: data: function data(value, depth) { L951: while (value && depth--) { ... L2937: L2938: // node_modules/source-map/lib/base64.js L2939: var require_base64 = __commonJS({ ... L5734: (function() { L5735: var reservedWords = "break else new var case finally return void catch for switch while continue function this with default if throw delete in try do instanceof typeof abstract enu... L5736: var compil

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L657

10}; L11: var __commonJS = (cb, mod) => function __require() { L12: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L10

README.mdView file

Lines 358-398markdown

358 pdfPassword: process.env.RF_PDF_PASSWORD,

359 redact: {

360 enabled: true,

361 patterns: ['MYCO_[A-Z0-9]+'], // custom regexes, fully masked

362 },

363 }],

364],

365```

366

367**`pdfPassword`** encrypts the PDF with AES-256, applied in-process with no external tools required. When a failure-overflow sidecar is written (`maxInlineFailures` exceeded), it's encrypted too, as `{basename}-failures.json.enc`:

368

Source & flagged code

5 flagged · loading source

dist/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code