@testrelic/playwright-analytics@2.13.0: Malicious npm security | LPM Firewall

Loading npm security reports…

@testrelic/playwright-analytics@2.13.0: Malicious npm security | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/reporter-entry.jsView file

1import {randomUUID,createHash}from'crypto';import {writeFileSync,renameSync,mkdirSync,unlinkSync,existsSync,readFileSync,appendFileSync,readdirSync,statSync,rmSync,createReadStream... L2: `),false}}moveFile(e,r){try{renameSync(e,r);}catch{try{let{copyFileSync:s}=rs("fs");s(e,r);try{unlinkSync(e);}catch{}}catch(s){process.stderr.write(`[testrelic] Failed to move file...

High

Child Process

Package source references child process execution.

dist/reporter-entry.jsView on unpkg · L1

1import {randomUUID,createHash}from'crypto';import {writeFileSync,renameSync,mkdirSync,unlinkSync,existsSync,readFileSync,appendFileSync,readdirSync,statSync,rmSync,createReadStream... L2: `),false}}moveFile(e,r){try{renameSync(e,r);}catch{try{let{copyFileSync:s}=rs("fs");s(e,r);try{unlinkSync(e);}catch{}}catch(s){process.stderr.write(`[testrelic] Failed to move file... L3: `);}}}writeIndex(e){let r=join(this.reportDir,"index.json"),s=r+".tmp",n=JSON.stringify(e);writeFileSync(s,n,"utf-8"),renameSync(s,r),this.totalBytesWritten+=Buffer.byteLength(n,"u... L4: `),n}catch{}let a=dirname(e);if(a===e)break;e=a;}return null}function Et(t){try{let e=readFileSync(t,"utf-8"),r=JSON.parse(e);return typeof r!="object"||r===null||Array.isArray(r)|... L5: `);let p=t.queue;if(p&&typeof p=="object"){i

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/reporter-entry.jsView on unpkg · L1

1import {randomUUID,createHash}from'crypto';import {writeFileSync,renameSync,mkdirSync,unlinkSync,existsSync,readFileSync,appendFileSync,readdirSync,statSync,rmSync,createReadStream... L2: `),false}}moveFile(e,r){try{renameSync(e,r);}catch{try{let{copyFileSync:s}=rs("fs");s(e,r);try{unlinkSync(e);}catch{}}catch(s){process.stderr.write(`[testrelic] Failed to move file... L3: `);}}}writeIndex(e){let r=join(this.reportDir,"index.json"),s=r+".tmp",n=JSON.stringify(e);writeFileSync(s,n,"utf-8"),renameSync(s,r),this.totalBytesWritten+=Buffer.byteLength(n,"u... L4: `),n}catch{}let a=dirname(e);if(a===e)break;e=a;}return null}function Et(t){try{let e=readFileSync(t,"utf-8"),r=JSON.parse(e);return typeof r!="object"||r===null||Array.isArray(r)|...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/reporter-entry.jsView on unpkg · L1

scripts/postinstall.cjsView file

53process.stderr.write('[testrelic] Could not create .testrelic/testrelic-config.json: ' + err.message + '\n'); L54: }; ...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

scripts/postinstall.cjsView on unpkg · L53

dist/index.cjsView file

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.cjs L1: 'use strict';Object.defineProperty(exports,'__esModule',{value:true});var crypto=require('crypto'),fs=require('fs'),path=require('path'),os$1=require('os'),core=require('@testrelic... L2: `),false}}moveFile(e,r){try{fs.renameSync(e,r);}catch{try{let{copyFileSync:n}=Dn("fs");n(e,r);try{fs.unlinkSync(e);}catch{}}catch(n){process.stderr.write(`[testrelic] Failed to mov...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.cjsView on unpkg · L1

dist/reporter-entry.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @testrelic/playwright-analytics@2.11.1 matchedIdentity = npm:[redacted]:2.11.1 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/reporter-entry.cjsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 103-131json

103 "@testrelic/core": "2.6.0"

104 },

105 "devDependencies": {

106 "@playwright/test": "^1.35.0",

107 "@types/node": "^18.0.0",

108 "typescript": "^5.5.0",

109 "tsup": "^8.0.0",

110 "vitest": "^2.0.0"

111 },

112 "engines": {

113 "node": ">=18"

114 },

115 "license": "MIT",

116 "homepage": "https://testrelic.ai",

117 "publishConfig": {

118 "registry": "https://registry.npmjs.org",

119 "access": "public"

120 },

121 "scripts": {

122 "build": "tsup",

123 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L123

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L123

124 "test": "vitest run",

125 "test:watch": "vitest",

126 "test:integration": "vitest run --config vitest.integration.config.ts",

127 "typecheck": "tsc --noEmit",

128 "test:e2e": "pnpm run build && npx playwright test --config __tests__/e2e/playwright.config.ts",

129 "test:e2e:validate": "npx tsx __tests__/e2e/validate-report.ts"

130 }

131}

dist/reporter-entry.jsView file

Lines 1-21javascript

1import {randomUUID,createHash}from'crypto';import {writeFileSync,renameSync,mkdirSync,unlinkSync,existsSync,readFileSync,appendFileSync,readdirSync,statSync,rmSync,createReadStream}from'fs';import {join,dirname,relative,extname,resolve,basename}from'path';import {tmpdir,platform}from'os';import {isValidConfig,createError,ErrorCode,ATTACHMENT_NAME,isTestRelicFilePayload,isTestRelicDataPayload,isValidEndpointUrl,isValidCloudConfig,isValidQueueEntry}from'@testrelic/core'

scripts/postinstall.cjsView file

Lines 33-55javascript

33

34const template = {

35 cloud: {

36 apiKey: '$TESTRELIC_API_KEY',

37 endpoint: 'https://platform.testrelic.ai/api/v1',

38 upload: 'both',

39 },

40

dist/index.cjsView file

Lines 1-21javascript

1'use strict';Object.defineProperty(exports,'__esModule',{value:true});var crypto=require('crypto'),fs=require('fs'),path=require('path'),os$1=require

dist/reporter-entry.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @testrelic/playwright-analytics@2.11.1 matchedIdentity = npm:[redacted]:2.11.1 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/reporter-entry.cjsView on unpkg