@taole/dd-playwright@0.1.8
Standalone stdio MCP & CLI: Playwright browser automation + isolated whistle proxy + diandian account storageState injection
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the flagged install command is gated by an explicit update or upgrade invocation. The inspected daemon and dependency runtime locations do not establish malicious behavior.
Decision evidence
public snapshot- The manifest declares CLI entry points and dependencies, with no install lifecycle hook.
- The updater runs only through the explicit update or upgrade command and installs this package globally after checking for a newer release.
- The daemon starts the package CLI in its server mode and checks a loopback address.
- Inspected dependency entry points and runtime helpers show browser automation, stdio transport, proxy utilities, and certificate handling; no attack behavior was identified in the reviewed locations.
Source & flagged code
4 flaggedThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
src/updater.mjsView on unpkgPackage source invokes a package manager install command at runtime.
src/updater.mjsView on unpkg · L97Findings
Affected versions and remediation
This report applies to @taole/dd-playwright@0.1.8.
See all versions of @taole/dd-playwright for other recorded verdicts.
- Review the evidence and your use of @taole/dd-playwright@0.1.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.