registry / Install hook abuse / @testrelic/playwright-analytics
@testrelic/playwright-analytics
Playwright test analytics reporter with E2E navigation tracking, API call capture, network stats, failure diagnostics, and interactive HTML reports
This report shows the evidence for @testrelic/playwright-analytics@2.13.0. 2 of 11 known versions are blocked or flagged. The newest version, 2.16.4, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an automatic install-time hidden-code execution chain, not normal reporter functionality. Block publication to prevent arbitrary concealed code from running during installation.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm installation of the package as a dependency outside CI.
Impact
Arbitrary hidden code can run with the installing user's permissions.
Mechanism
Obfuscated install-hook payload reconstruction and execution.
Attack narrative
The package declares a postinstall hook. Its script first appears to create a TestRelic configuration file, then appends dense obfuscated code that reconstructs data into callable code and invokes it. This runs during dependency installation, before the user explicitly runs the package. Because the executed payload is deliberately concealed, its file, process, and network actions are not reviewable or consented to.
AI rationale
This is an automatic install-time hidden-code execution chain, not normal reporter functionality. Block publication to prevent arbitrary concealed code from running during installation.
Evidence
package.jsonscripts/postinstall.cjs.testrelic/testrelic-config.json
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package runs scripts/postinstall.cjs automatically after installation.
- The postinstall script has a large, concealed decoder appended after its visible configuration code.
- The concealed code reconstructs callable code and immediately invokes the resulting payload.
Evidence against
- The readable portion of the postinstall script creates a same-vendor configuration file and skips CI.
- The reporter's cloud upload features match the stated analytics purpose, but do not explain the hidden install-time payload.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/reporter-entry.jsView file
1import {randomUUID,createHash}from'crypto';import {writeFileSync,renameSync,mkdirSync,unlinkSync,existsSync,readFileSync,appendFileSync,readdirSync,statSync,rmSync,createReadStream...
L2: `),false}}moveFile(e,r){try{renameSync(e,r);}catch{try{let{copyFileSync:s}=rs("fs");s(e,r);try{unlinkSync(e);}catch{}}catch(s){process.stderr.write(`[testrelic] Failed to move file...
High
Child Process
Findings
1 Critical6 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/reporter-entry.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/reporter-entry.js
HighSame File Env Network Executiondist/reporter-entry.js
HighCommand Output Exfiltrationdist/reporter-entry.js
HighObfuscated Payload Loaderscripts/postinstall.cjs
HighTrigger Reachable Command Output Exfiltrationdist/index.cjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @testrelic/playwright-analytics@2.13.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @testrelic/playwright-analytics@2.13.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.