registry / @taole/dd-playwright / 0.1.14
@taole/dd-playwright@0.1.14
Standalone stdio MCP & CLI: Playwright browser automation + isolated whistle proxy + diandian account storageState injection
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package has a real credential exposure risk: its account-management server binds to all interfaces and returns stored session cookies without authentication. This is a serious vulnerability in an otherwise purpose-aligned tool, so it warrants a warning rather than a malicious-package block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user starts the Web console with startweb or serve; it listens on all interfaces by default.
Impact
A reachable network client may read account cookies and use them to access the associated Diandian account; exposed endpoints also permit account-management actions.
Mechanism
The server binds to 0.0.0.0, returns account data including cookieHeader from GET /api/accounts, and sets permissive cross-origin response headers.
AI rationale
The package has a real credential exposure risk: its account-management server binds to all interfaces and returns stored session cookies without authentication. This is a serious vulnerability in an otherwise purpose-aligned tool, so it warrants a warning rather than a malicious-package block.
Evidence
src/server/web-server.mjssrc/account-store.mjs
Network endpoints2
0.0.0.0:<port> (default port 12309)GET /api/accounts
Decision evidence
public snapshotAI called this Suspicious at 95.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The Web console listens on 0.0.0.0, exposing it on all network interfaces.
- GET /api/accounts returns both the account list and active account without an authentication check in the route.
- The account list includes each account’s cookieHeader.
- JSON responses allow requests from any origin with Access-Control-Allow-Origin: *.
- The login flow sends captured cookies to the package’s stated Diandian user-info endpoint.
- The manifest declares only a test script and no install lifecycle script.
Evidence against
- The package describes itself as a Playwright browser tool with Diandian account storage, matching its account and login flows.
- The updater runs npm install only through the explicit CLI update command.
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedsrc/updater.mjsView file
2import { fileURLToPath } from "node:url";
L3: import { execSync } from "node:child_process";
L4: import { resolveConfig } from "./config.mjs";
High
115try {
L116: execSync(`npm install -g ${PACKAGE_NAME}@latest`, {
L117: stdio: "inherit",
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
src/updater.mjsView on unpkg · L115src/server/daemon.mjsView file
•matchType = normalized_sha256
matchedPackage = @taole/dd-playwright@0.1.6
matchedPath = src/server/daemon.mjs
matchedIdentity = npm:QHRhb2xlL2RkLXBsYXl3cmlnaHQ:0.1.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Findings
1 Critical4 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltasrc/browser-manager.mjs
HighChild Processsrc/updater.mjs
HighShell
HighRuntime Package Installsrc/updater.mjs
HighKnown Malware Source Similaritysrc/server/daemon.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @taole/dd-playwright@0.1.14.
See all versions of @taole/dd-playwright for other recorded verdicts.
- Review the evidence and your use of @taole/dd-playwright@0.1.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.