registry / @roopesh.yadava/qa-pack / 1.9.1
@roopesh.yadava/qa-pack@1.9.1
AI-powered QA agent skills for Claude Code — manual testing, BDD automation, accessibility, UI/Figma diff, bug reporting
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe postinstall hook expands Claude’s browser-tool permissions without an affirmative consent check, creating a concrete agent capability risk. The permission is scoped to the package’s Playwright QA integration, so the evidence supports a warning rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Installing or updating the package through npm.
Impact
Playwright MCP actions can proceed without per-call approval, allowing agent browser activity to run under the user’s existing browser session.
Mechanism
The hook adds a blanket permission for the Playwright MCP namespace to the consumer’s local Claude settings, including when that settings file already exists.
AI rationale
The postinstall hook expands Claude’s browser-tool permissions without an affirmative consent check, creating a concrete agent capability risk. The permission is scoped to the package’s Playwright QA integration, so the evidence supports a warning rather than a publish block.
Evidence
package.jsonbin/postinstall.jsclaude/settings.jsontemplates/settings.local.json.example.claude/settings.local.json
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest runs bin/postinstall.js during npm postinstall.
- The hook targets the consumer project’s local Claude settings and says it forces the rule on every install or update, including for hand-edited settings.
- The hook adds the Playwright MCP permission and writes the settings file without an affirmative consent check.
- The permission covers the Playwright MCP namespace; the package also supplies a Playwright MCP server for Chromium.
Evidence against
- The Playwright permission is tied to a browser tool supplied by the package for QA work; inspected source did not establish credential export or remote payload execution.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
14 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node bin/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgclaude/skills/shared/scaffold.shView file
•matchType = normalized_sha256
matchedPackage = @roopesh.yadava/qa-pack@1.9.0
matchedPath = claude/skills/shared/scaffold.sh
matchedIdentity = npm:QHJvb3Blc2gueWFkYXZhL3FhLXBhY2s:1.9.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
Findings
3 Critical6 High7 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationclaude/skills/web-qa-agent/toolkit/qa-toolkit.cjs
CriticalCredential Exfiltrationclaude/skills/web-qa-agent/toolkit/qa-toolkit.cjs
CriticalAi Agent Control Hijackbin/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/postinstall.js
HighSemantic Analysis Limitedclaude/skills/shared/measure-reuse.cjs#virtual:normalized:round1
HighKnown Malware Source Similaritybin/postinstall.js
HighKnown Malware Source Similarityclaude/skills/web-qa-agent/toolkit/qa-toolkit.cjs
HighKnown Malware Source Similarityclaude/skills/shared/scaffold.sh
Medium
Affected versions and remediation
This report applies to @roopesh.yadava/qa-pack@1.9.1.
See all versions of @roopesh.yadava/qa-pack for other recorded verdicts.
- Review the evidence and your use of @roopesh.yadava/qa-pack@1.9.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.