registry / @testmuai/kane-cli / 0.4.10

@testmuai/kane-cli@0.4.10

KaneAI Terminal UI — browser automation testing agent

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 102 file(s), 1.56 MB of source, external domains: 127.0.0.1, accounts.lambdatest.com, api-hyperexecute.lambdatest.com, api-stage-hyperexecute.lambdatestinternal.com, api.github.com, api.lambdatest.com, auteur-stage-automind.lambdatestinternal.com, auth.lambdatest.com, dd-proxy.lambdatest.com, dl.google.com, example.com, feross.org, github.com, kaneai-api.lambdatest.com, kaneai-playground.lambdatest.io, reactjs.org, registry.npmjs.org, sheetjs.com, stage-accounts.lambdatestinternal.com, stage-api.lambdatestinternal.com, stage-auth.lambdatestinternal.com, stage-test-manager-api.lambdatestinternal.com, stage-test-manager.lambdatestinternal.com, test-manager-api.lambdatest.com, test-manager.lambdatest.com, www.google.com, www.testmuai.com

Source & flagged code

3 flagged

dist/chunk-AT45XB6X.jsView file

Lines 1-31javascript

1import { createRequire } from 'module'; const require = createRequire(import.meta.url);

2import{a as Se,b as nr}from"./chunk-C5UNZ6ZY.js";import{a as ar}from"./chunk-BH6EP2LD.js";import{c as or}from"./chunk-S3DAAAE5.js";import{b as sr,c as ut,d as dt,e as ve,f as mt,g as ir}from"./chunk-PUU7A26K.js";import{a as Ue,b as se,c as tr,e as le,f as lt,i as rr,j as ct}from"./chunk-AH4AXJML.js";import{b as ue}from"./chunk-NAAPNSZD.js";import{a as Xt}from"./chunk-WAOCHXJ5.js";import{a as er,b as at}from"./chunk-BQACGLXW.js";import{a as Wt,b as ot,c as it,d as je,e as Jt,f as Qt}from"./chunk-LOIRZFV3.js";import{f as Yt,g as Zt}from"./chunk-XCYCX4TU.js";import{a as zt}from"./chunk-LPUQ4HWQ.j ...

3`):process.stderr.write(`[replay-trace] ${o}${a}: AUTHOR (${n.reason})

4`)}}function de(e){process.env.KANE_REPLAY_TRACE==="1"&&process.stderr.write(e)}function fr(e,t){let r=e===0?"(none)":`0..${e-1}`,s=e>=t?"(none)":`${e}..${t-1}`;de(`[replay-trace] phase: replay ${r}, author ${s}

5`)}function pr(e,t){de(`[replay-trace] step ${e}: REPLAY ${t==="ok"?"OK":"FAILED"}

6`)}function hr(e,t,r){de(`[replay-trace] shrink ${e}/${t} \u2192 new boundary ${r}

7`)}function gr(e,t){de(`[replay-trace] complete-reauthor (${e} shrinks exhausted of ${t})

8`)}function pt(){de(`[replay-trace] force-author (--author) \u2014 walker bypassed

9`)}function br(e){de(`[replay-trace] cancelled at step ${e}

10`)}import{join as As}from"path";function ht(e){let t={objective:e.step.objective,model:"v16-alpha",width:e.windowSize.width,height:e.windowSize.height,session_id:e.sessionId,run_index:e.runIndex,stream:!0,mode:"replay",replay:{recording_path:dr(e.decision),step_label:e.step.objective},screenshot_dir:As(e.sessionDir,"runs",String(e.runIndex)),run_id:"run",test_id:"test"};return e.forceNavigateUrl&&(t.url=e.forceNavigateUrl),e.chrome.wsEndpoint?t.ws_endpoint=e.chrome.wsEndpoint:e.chrome.cdpEndpoint&&(t.cdp_endpoint=e.chrome.cdpEndpoint),e.auth.basicAuth?(t.username=e.auth.basicAuth.username,t.ac ...

12`),f=h[h.length-1];if(!f){n("warn","SCREENSHOT_SKIP","NDJSON empty",{step_index:r,reason:"ndjson_empty"});return}let g=JSON.parse(f).action_id;if(!g){n("warn","SCREENSHOT_SKIP","No action_id in NDJSON",{step_index:r,reason:"no_action_id"});return}let I=Er(i);s.enqueue(g,I),n("info","SCREENSHOT_ENQUEUED","Screenshot enqueued",{step_index:r,child_id:o,action_id:g,size:I.length})}catch(a){n("error","SCREENSHOT_DISPATCH_ERROR","Screenshot dispatch error",{step_index:r,error:a instanceof Error?a.message:String(a)})}}import{dirname as Ls,join as Ds}from"path";function Pr(e,t,r){let s=e.total_runs??1 ...

13`)}catch{}}e?.chromePid&&e.chromePid>0&&o({type:"chrome_pid",pid:e.chromePid});let a=null;e?.cdpEndpoint&&Dr(e.cdpEndpoint,i=>o({type:"bounds",...i})).then(i=>{a=i.stop}).catch(()=>{});let u=!1;return{setRunActive(i

14`):e==="linux"?["Google Chrome is required but was not found at /usr/bin/google-chrome.","(amd64 / x86_64 only \u2014 Google does not ship Chrome for Linux ARM.)","","Debian / Ubuntu (any version):"," wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb"," sudo apt install -y ./google-chrome-stable_current_amd64.deb","","Fedora / RHEL / AlmaLinux / Rocky:"," sudo dnf install -y https://dl.google.com/linux/direct/google-chrome-stable_current_x86_64.rpm","","Then re-run your command. Set KANE_CLI_CHROME_PATH=/path/to/chrome","to point at a non-standard install."].joi ...

15`):e==="win32"?["Google Chrome is required but was not found in Program Files or AppData.","","Install via winget (Windows 10 1809+):"," winget install --id Google.Chrome -e --silent","","Or download:"," https://www.google.com/chrome/","","Then re-run your command. Set KANE_CLI_CHROME_PATH=C:\\path\\to\\chrome.exe","to point at a non-standard install."].join(`

16`):["Google Chrome is required.","Install from https://www.google.com/chrome/","(Note: no official Chrome builds for BSD or Alpine/musl Linux.)"].join(`

17`)}function Hs(e){let t=Ie(),r=[`--remote-debugging-port=${e.port}`,`--user-data-dir=${e.userDataDir}`,`--window-size=${e.width},${e.height}`,"--no-first-run","--no-default-browser-check","--disable-blink-features=AutomationControlled","--disable-features=DownloadBubble,DownloadBubbleV2","--safebrowsing-disable-download-protection","--disable-popup-blocking","--disable-notifications","--disable-infobars","--disable-translate","--disable-prompt-on-repost","--disable-background-networking","--disable-client-side-phishing-detection","--disable-default-apps","--disable-hang-monitor","--disable-syn ...

18`)}return r}function zr(e){if(!Gr(e))throw new Error(`Variables file not found: ${e}`);let t=qr(e,"utf-8"),r=JSON.parse(t),s={};if(r&&typeof r=="object"){for(let[n,o]of Object.entries

19 \u26A0 Failed to create output directory.

20 ${s.message}

21 Path: ${Xr(t)}

23`),t}let r={commit_id:e.commitId};e.testId!==void 0&&(r.test_id=e.testId),e.testcaseId!==void 0&&(r.testcase_id=e.testcaseId),e.projectId!==void 0&&(r.project_id=e.projectId),e.folderId!==void 0&&(r.folder_id=e.folderId),e.orgId!==void 0&&(r.org_id=e.orgId),e.sessionName!==void 0&&(r.session_name=e.sessionName),e.plan!==void 0&&(r.plan=e.plan);try{nn(t,JSON.stringify(r,null,2)+`

24`,"utf8")}catch(s){process.stderr.write(`

25 \u26A0 Failed to write meta.json.

26 ${s.message}

27 Path: ${t}

29`)}return t}var an=()=>{};async function es(e,t,r){let s=t.log??an,n=e.session.testId??null,o=null,a=null,u=null;if(!r.localMode&&t.performUpload)try{o=await t.performUpload(),o?.success&&(o.testId&&(n=o.testId),o.testcaseId&&e.session.setTestcaseId(o.testcaseId))}catch(i){s("error","FINALIZE_UPLOAD_ERROR","Upload pipeline threw",{error:String(i)})}if(t.renderFeedbackPrompt)try{a=await t.renderFeedbackPrompt(),a&&n&&t.submitFeedback&&t.submitFeedback(n,a).catch(i=>{s("error","FINALIZE_FEEDBACK_SUBMIT_ERROR","Feedback submit failed",{error:String(i)})})}catch(i){s("error","FINALIZE_FEEDBACK_REN ...

30`)}try{t.runCleanup?.()}catch(i){s("error","FINALIZE_CLEANUP_ERROR","Cleanup hook threw",{error:String(i)})}try{await e.session.finish("complete")}catch(i){s("error","FINALIZE_SESSION_FINISH_ERROR","session.finish threw",{error:String(i)})}return{uploadResult:o,feedbackChoice:a,resultMdPath:u}}import{readFileSync as rs,writeFileSync as ss,existsSync as ns}

31`,"utf8")}catch(o){process.stderr.write(`warn: failed to update meta.json commit_id: ${o.message}

Long lines were clipped for display.

dist/chunk-PUU7A26K.jsView file

Lines 1-12javascript

1import { createRequire } from 'module'; const require = createRequire(import.meta.url);

2import{c as O,h as F}from"./chunk-AH4AXJML.js";import{a as k}from"./chunk-L5LI2JF4.js";import{readFileSync as se,existsSync

dist/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { createRequire } from 'module'; const require = createRequire(import.meta.url);

3import{a as zt,b as vn,c as bn,d as yn}from"./chunk-UAYCLUUZ.js";import"./chunk-QC73LMAN.js";import{i

Source & flagged code

3 flagged · loading source

dist/chunk-AT45XB6X.jsView file

11`)}},Os),t.register(Ir,()=>kr())}function St(){me!==null&&(kr(),(yt??Cr).deregister(Ir),yt=null)}import{readFileSync as Er,readdirSync as Ar,existsSync as ce}from"fs";import{join a... L12: `),f=h[h.length-1];if(!f){n("warn","SCREENSHOT_SKIP","NDJSON empty",{step_index:r,reason:"ndjson_empty"});return}let g=JSON.parse(f).action_id;if(!g){n("warn","SCREENSHOT_SKIP","No... L13: `)}catch{}}e?.chromePid&&e.chromePid>0&&o({type:"chrome_pid",pid:e.chromePid});let a=null;e?.cdpEndpoint&&Dr(e.cdpEndpoint,i=>o({type:"bounds",...i})).then(i=>{a=i.stop}).catch(()=...

High

Child Process

Package source references child process execution.

dist/chunk-AT45XB6X.jsView on unpkg · L11

dist/chunk-PUU7A26K.jsView file

3`),{global:o,bodyStartLine:n}=X(e,s),{title:r,steps:i}=Z(e,s,n);return{path:e,title:r,global:o,steps:i}}function X(e,t){if(t[0]?.trim()!=="---")return{global:{},bodyStartLine:0};le... L4: `),n;try{n=k(o)??{}}catch(r){throw new u(`invalid YAML in frontmatter: ${r.message}`,e,1)}if(M(e,n,"frontmatter",1),n.on_lock_conflict!==void 0){let r=n.on_lock_conflict;if(r!=="re... L5: `);try{n=k(h)??{}}catch(I){throw new u(`invalid YAML in step config: ${I.message}`,e,r)}o=f+1}let i=te(s.slice(o)),a=i.filter(l=>l.trim()!=="");if(a.length>0&&/^@session\s+/.test(a... ... L9: `),o="passed";if(s[0]?.trim()==="---")for(let r=1;r<s.length&&s[r].trim()!=="---";r++){let i=/^status:\s+(passed|failed|interrupted)\s*$/.exec(s[r]);i&&(o=i[1])}let n=[];for(let r=... L10: `,"utf8"),e.codeExportDir){let n=e.codeExportLanguage??"python",r=S(t,`playwright-${n}-code`);try{W(e.codeExportDir,r)}catch(i){process.stderr.write(`warn: codegen copy failed: ${i... L11: `)}}}export{Be as a,x as b,w as c,Je as d,v as e,W as f,St as g};

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-PUU7A26K.jsView on unpkg · L3

dist/index.jsView file

2Cross-file remote execution chain: dist/index.js spawns dist/chunk-BH6EP2LD.js; helper contains network access plus dynamic code execution. L2: import { createRequire } from 'module'; const require = createRequire(import.meta.url); L3: import{a as zt,b as vn,c as bn,d as yn}from"./chunk-UAYCLUUZ.js";import"./chunk-QC73LMAN.js";import{i as En}from"./chunk-G3PWEKD7.js";import"./chunk-3MSXQU2C.js";import"./chunk-EQC... L4: `).replace(/^/gm," ".repeat(o))}let c=[`Usage: ${n.commandUsage(e)}`,""],m=n.commandDescription(e);m.length>0&&(c=c.concat([n.wrap(m,t,0),""]));let u=n.visibleArguments(e).map(d=>a... ... L11: (Did you mean one of ${i.join(", ")}?)`:i.length===1?` L12: (Did you mean ${i[0]}?)`:""}On.suggestSimilar=gi});var Dn=me(Pn=>{"use strict";var wi=be("events").EventEmitter,mt=be("child_process"),ie=be("path"),ft=be("fs"),T=be("process"),{Ar... L13: - specify the name in Command constructor or using .name()`);return n=n||{},n.isDefault&&(this._defaultCommandName=e._name),(n.noHelp||n.hidden)&&(e._hidden=!0),this._registerComma... ... L24: `)}),this}_outputHelpIfRequested(e){let n=this._getHelpOption();n&&e.find(t=>n.is(t))&&(this.outputHelp(),this._exit(0,"commander.helpDispla…

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L2

Findings

2 High3 Medium5 Low

HighChild Processdist/chunk-AT45XB6X.js

HighCross File Remote Execution Contextdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowWeak Cryptodist/chunk-PUU7A26K.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings