@tesbox/cli: Suspicious npm security report (Warn)

Loading npm security reports…

Static Scan Results

scanned 14h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 101 KB of source, external domains: api.tesbogrid.com, run.tesbogrid.com

Source & flagged code

3 flagged

src/playwrightRun.jsView file

Lines 1-34javascript

1/**

2 * `tesbox playwright <args...>` implementation.

3 *

4 * A transparent passthrough to the real Playwright CLI — `playwright test`,

5 * `playwright show-report`, `playwright codegen`, any subcommand/flags are

6 * forwarded verbatim, so an existing playwright.config.ts / npm scripts /

7 * reporters keep working unmodified. This command never touches Tesbo's

8 * scaling infrastructure — it only runs the user's own Playwright install

9 * locally and, for `playwright test`, uploads the resulting report.

10 *

11 * This is the recommended workflow for Report Only Mode projects, but works

12 * for any project (there's nothing infra-specific about it).

13 */

15import { spawn } from "node:child_process";

16import fs from "node:fs";

High

Child Process

Package source references child process execution.

src/playwrightRun.jsView on unpkg · L14

17import os from "node:os";

18import path from "node:path";

19import process from "node:process";

20import crypto from "node:crypto";

21import { uploadResults } from "./uploadResults.js";

23const DEFAULT_APP_API_URL = "https://api.tesbogrid.com";

25function log(s) {

26 process.stdout.write(`${s}\n`);

27}

28function logErr(s) {

29 process.stderr.write(`${s}\n`);

30}

32function resolvePlaywrightBinary(cwd) {

33 const binName = process.platform === "win32" ? "playwright.cmd" : "playwright";

34 const localBin = path.join(cwd, "node_modules", ".bin", binName);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/playwrightRun.jsView on unpkg · L14

src/runBuild.jsView file

Lines 1-41javascript

1/**

2 * `tesbox run-build [opts] -- <command>` implementation.

3 *

4 * Centralized CLI orchestration for a Selenium / TestNG run:

5 *

6 * 1. Generate a stable buildId (or accept --build-id from CI).

7 * 2. POST /tesbo-reports/builds/start so the row appears in the dashboard

8 * with status IN_PROGRESS *immediately* — before tests start running.

9 * 3. Run the user's test command (e.g. `mvn test` / `java Runner.Runner …`)

10 * with TESBO_BUILD_ID injected. The user's framework runs unchanged;

Source & flagged code

3 flagged · loading source

src/playwrightRun.jsView file

@tesbox/cli: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

3 flagged

src/playwrightRun.jsView file

Lines 1-34javascript

1/**

2 * `tesbox playwright <args...>` implementation.

3 *

4 * A transparent passthrough to the real Playwright CLI — `playwright test`,

5 * `playwright show-report`, `playwright codegen`, any subcommand/flags are

6 * forwarded verbatim, so an existing playwright.config.ts / npm scripts /

7 * reporters keep working unmodified. This command never touches Tesbo's

8 * scaling infrastructure — it only runs the user's own Playwright install

9 * locally and, for `playwright test`, uploads the resulting report.

10 *

11 * This is the recommended workflow for Report Only Mode projects, but works

12 * for any project (there's nothing infra-specific about it).

13 */

15import { spawn } from "node:child_process";

16import fs from "node:fs";

High

Child Process

Package source references child process execution.

src/playwrightRun.jsView on unpkg · L14

17import os from "node:os";

18import path from "node:path";

19import process from "node:process";

20import crypto from "node:crypto";

21import { uploadResults } from "./uploadResults.js";

23const DEFAULT_APP_API_URL = "https://api.tesbogrid.com";

25function log(s) {

26 process.stdout.write(`${s}\n`);

27}

28function logErr(s) {

29 process.stderr.write(`${s}\n`);

30}

32function resolvePlaywrightBinary(cwd) {

33 const binName = process.platform === "win32" ? "playwright.cmd" : "playwright";

34 const localBin = path.join(cwd, "node_modules", ".bin", binName);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/playwrightRun.jsView on unpkg · L14

src/runBuild.jsView file

Lines 1-41javascript

1/**

2 * `tesbox run-build [opts] -- <command>` implementation.

3 *

4 * Centralized CLI orchestration for a Selenium / TestNG run:

5 *

6 * 1. Generate a stable buildId (or accept --build-id from CI).

7 * 2. POST /tesbo-reports/builds/start so the row appears in the dashboard

8 * with status IN_PROGRESS *immediately* — before tests start running.

9 * 3. Run the user's test command (e.g. `mvn test` / `java Runner.Runner …`)

10 * with TESBO_BUILD_ID injected. The user's framework runs unchanged;

@tesbox/cli@3.0.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code