@taole/dd-playwright@0.1.9
Standalone stdio MCP & CLI: Playwright browser automation + isolated whistle proxy + diandian account storageState injection
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe flagged npm install is reachable through the explicit update or upgrade command, while the manifest has no install lifecycle hook. The inspected source supports the package's browser, proxy, and local service functionality; the static similarity and runtime-install hints do not establish malicious behavior.
Decision evidence
public snapshot- The manifest declares CLI entrypoints and dependencies but no install lifecycle hook.
- The updater is reached through the explicit update or upgrade CLI command; its package installation runs within that command.
- The daemon starts the package's CLI as a detached local web service and probes its loopback endpoint.
- The inspected dependency excerpts show MCP transport, browser automation, and proxy utility behavior; they do not establish package attack behavior.
- The updater runs a global npm install, but the CLI exposes it as an explicit user command rather than an automatic install or import action.
Source & flagged code
4 flaggedThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
src/updater.mjsView on unpkgPackage source invokes a package manager install command at runtime.
src/updater.mjsView on unpkg · L115Findings
Affected versions and remediation
This report applies to @taole/dd-playwright@0.1.9.
See all versions of @taole/dd-playwright for other recorded verdicts.
- Review the evidence and your use of @taole/dd-playwright@0.1.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.