registry / @testrelic/appium-analytics / 1.2.1

@testrelic/appium-analytics@1.2.1

Appium test analytics reporter with device log capture, command tracking, network interception, and interactive HTML reports for Android and iOS

AI Security Review

scanned 15d ago · by lpm-firewall-ai

Inspected source shows a guarded, package-specific setup hook and ordinary TestRelic cloud authentication; it does not establish the flagged unrelated credential redirect or command-output exfiltration. The demo downloader uses fixed upstream GitHub release URLs.

Static reason

One or more suspicious static signals were detected.

Trigger

Package installation triggers the postinstall hook; cloud authentication occurs when the Appium analytics reporter is used with a configured API key.

Impact

The hook may add package-specific configuration to the consumer project, and reporter use sends analytics data to the configured service.

Mechanism

The hook writes `.testrelic/testrelic-config.json` subject to project-root, CI, nested-install, and existing-file guards. Cloud authentication sends the configured key to the TestRelic API.

AI rationale

Evidence

scripts/postinstall.cjsscripts/download-apps.mjsdist/index.cjsdist/cli.cjs

Network endpoints2

github.com/appium/android-apidemos/releases/download/v6.0.7/ApiDemos-debug.apkgithub.com/saucelabs/my-demo-app-android/releases/download/2.2.0/mda-2.2.0-25.apk

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The postinstall hook is present and creates a package-specific configuration file in the invoking project, with CI, missing-root, nested-install, and existing-file guards.
The CLI processes commands supplied by the user through its arguments.
Cloud API-key authentication sends the key to the TestRelic service endpoint; report payloads contain Appium test-run data.
The download script uses fixed GitHub release URLs for demo APKs.

Evidence against

No reviewed source established credential redirection to an unrelated gateway or command-output exfiltration.
The install hook writes only `.testrelic/testrelic-config.json` with a TestRelic endpoint and API-key environment-variable placeholder.
The CLI exposes explicit merge and local report-serving commands.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinified

Source & flagged code

14 flagged

package.jsonView file

Lines 81-111json

81 "@wdio/spec-reporter": "^9.27.0",

82 "@wdio/types": "^9.27.0",

83 "mockttp": "^4.3.0",

84 "ts-node": "^10.9.2",

85 "tsup": "^8.0.0",

86 "typescript": "^5.5.0",

87 "vitest": "^2.0.0",

88 "webdriverio": "^9.27.0"

89 },

90 "engines": {

91 "node": ">=18"

92 },

93 "license": "MIT",

94 "homepage": "https://testrelic.ai",

95 "publishConfig": {

96 "registry": "https://registry.npmjs.org",

97 "access": "public"

98 },

99 "scripts": {

100 "build": "tsup",

101 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L101

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L101

102 "test": "vitest run",

103 "test:watch": "vitest",

104 "typecheck": "tsc --noEmit",

105 "test:smoke": "node_modules\\.bin\\wdio run wdio.smoke.conf.ts",

106 "test:smoke:mydemoapp": "node_modules\\.bin\\wdio run wdio.mydemoapp.conf.ts",

107 "test:e2e:android": "npx wdio run wdio.android.conf.ts",

108 "test:e2e:ios": "npx wdio run wdio.ios.conf.ts",

109 "download-apps": "node scripts/download-apps.mjs"

110 }

111}

•scripts changed=test:smoke,test:smoke:mydemoapp

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

dist/cli.cjsView file

188} L189: (0, import_node_child_process.execFile)(file, args, (err) => { L190: if (err) {

High

Child Process

Package source references child process execution.

dist/cli.cjsView on unpkg · L188

dist/index.cjsView file

1'use strict';var fs$1=require('fs'),path=require('path'),core=require('@testrelic/core'),rHA=require('net'),nHA=require('os'),buffer=require('buffer'),zlib=require('zlib'),child_pr... L2: `),E}catch{}let u=path.dirname(n);if(u===n)break;n=u;}return null}function Z9(s){try{let n=fs$1.readFileSync(s,"utf-8"),a=JSON.parse(n);return typeof a!="object"||a===null||Array.i... L3: `);let S=s.queue;if(S&&typeof S=="object"){if(typeof S.maxAge=="string"){let G=O9(S.maxAge);G!==null&&(a.queueMaxAge=G);}typeof S.directory=="string"&&(a.queueDirectory=S.directory...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.cjsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.cjs: 'use strict';var fs$1=require('fs'),path=require('path'),core=require('@testrelic/core'),rHA=require('net'),nHA=require('os'),buffer=require('buffer'),zlib=require('zlib'),child_pr... `)):typeof readline=="function"&&(V=readline(),V!==null&&(V+=` `));if(!V)return null;K.input=vr(V);}return K.input.shift()},put_char:function(K,V){V===null||V===10?(RA(Wi(K.output,0)),K.output=[]):V!=0&&K.output.push(V);},flush:function(K){K.o... `)):typeof readline=="function"&&(N=readline(),N!==null&&(N+=` `));if(!N)return null;k.input=vl(N);}return k.input.shift()},put_char:function(k,N){N===null||N===10?(RA(_i(k.output,0)),k.output=[])

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.cjsView on unpkg

scripts/download-apps.mjsView file

Lines 1-35javascript

1#!/usr/bin/env node

3/**

4 * Downloads demo APKs/apps for E2E testing.

5 *

6 * - Android: ApiDemos-debug.apk from appium/android-apidemos

7 * - iOS: UIKitCatalog (built from Xcode sample project, or downloaded as .app.zip)

8 */

10import { createWriteStream, existsSync, mkdirSync } from 'node:fs';

dist/service.jsView file

•path = dist/service.js kind = oversized_source_file sizeBytes = 4977655 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/service.jsView on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts changed=test:smoke,test:smoke:mydemoapp

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.cjsView file

Findings

1 Critical11 High5 Medium4 Low

CriticalManifest Confusionpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli.cjs

HighSame File Env Network Executiondist/index.cjs

HighRemote System File Writescripts/download-apps.mjs

HighCredential Redirect Persistencedist/index.cjs

HighCommand Output Exfiltrationdist/index.cjs

HighSandbox Evasion Gated Capabilitydist/index.cjs

HighCross File Remote Execution Contextdist/index.cjs

HighSpawned Bundled Service Listenerdist/index.cjs

HighTrigger Reachable Command Output Exfiltrationdist/index.cjs

High

Affected versions and remediation

This report applies to @testrelic/appium-analytics@1.2.1.

See all versions of @testrelic/appium-analytics for other recorded verdicts.

Review the evidence and your use of @testrelic/appium-analytics@1.2.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-07 21:34:50.190Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @testrelic

Behavioral surface

Related packages

More from @testrelic

Source & flagged code