registry / @testrelic/playwright-analytics / 2.16.0

@testrelic/playwright-analytics@2.16.0

Playwright test analytics reporter with E2E navigation tracking, API call capture, network stats, failure diagnostics, and interactive HTML reports

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The flagged network and command primitives implement the advertised reporter and optional cloud analytics flow. The automatic config scaffold is limited to the package's own project-local configuration and does not establish malicious persistence or remote execution.

Static reason

One or more suspicious static signals were detected.

Trigger

Installation creates the local config; running the Playwright reporter with a TestRelic API key enables cloud reporting.

Impact

Test, Git, and configured reporter data may be sent to TestRelic when cloud reporting is enabled.

Mechanism

Local reporter output and configured cloud analytics upload.

AI rationale

Evidence

.testrelic/testrelic-config.json

Network endpoints1

platform.testrelic.ai/api/v1

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

A postinstall hook automatically creates a project-local TestRelic configuration file.
The reporter can read a TestRelic API key, collect test and Git metadata, and send it to the configured TestRelic cloud service.
The bundled entry point runs fixed Git metadata commands; this is a data-collection capability, not arbitrary command execution.

Evidence against

The install hook is bounded to a new .testrelic/testrelic-config.json file, skips CI and nested installs, and does not run network code.
Cloud mode is enabled only when a TestRelic API key is present; the default endpoint is package-aligned.
No eval, VM execution, remote code loading, self-dependency, credential harvesting, or destructive install behavior was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/reporter-entry.jsView file

High

Child Process

Package source references child process execution.

dist/reporter-entry.jsView on unpkg · L1

1import {randomUUID,createHash}from'crypto';import {writeFileSync,renameSync,mkdirSync,unlinkSync,existsSync,readFileSync,appendFileSync,readdirSync,statSync,openSync,readSync,close... L2: `),false}}moveFile(t,r){try{renameSync(t,r);}catch{try{let{copyFileSync:a}=nn("fs");a(t,r);try{unlinkSync(t);}catch{}}catch(a){process.stderr.write(`[testrelic] Failed to move file... L3: `);}}}writeIndex(t){let r=join(this.reportDir,"index.json"),a=r+".tmp",n=JSON.stringify(t);writeFileSync(a,n,"utf-8"),renameSync(a,r),this.totalBytesWritten+=Buffer.byteLength(n,"u... L4: `),n}catch{}let s=dirname(t);if(s===t)break;t=s;}return null}function dr(e){try{let t=readFileSync(e,"utf-8"),r=JSON.parse(t);return typeof r!="object"||r===null||Array.isArray(r)|... L5: `);let c=e.queue;if(c&&typeof c=="object"){i

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/reporter-entry.jsView on unpkg · L1

dist/index.cjsView file

1Cross-file remote execution chain: dist/index.cjs spawns dist/index.js; helper contains network access plus dynamic code execution. L1: 'use strict';Object.defineProperty(exports,'__esModule',{value:true});var crypto=require('crypto'),fs$1=require('fs'),path=require('path'),os$1=require('os'),core=require('@testrel... L2: `),false}}moveFile(e,r){try{fs$1.renameSync(e,r);}catch{try{let{copyFileSync:n}=oa("fs");n(e,r);try{fs$1.unlinkSync(e);}catch{}}catch(n){process.stderr.write(`[testrelic] Failed to... L3: `);}}}writeIndex(e){let r=path.join(this.reportDir,"index.json"),n=r+".tmp",s=JSON.stringify(e);fs$1.writeFileSync(n,s,"utf-8"),fs$1.renameSync(n,r),this.totalBytesWritten+=Buffer.... L4: `),s}catch{}let a=path.dirname(e);if(a===e)break;e=a;}return null}function Dr(t){try{let e=fs$1.read

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.cjsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.cjs L1: 'use strict';Object.defineProperty(exports,'__esModule',{value:true});var crypto=require('crypto'),fs$1=require('fs'),path=require('path'),os$1=require('os'),core=require('@testrel... L2: `),false}}moveFile(e,r){try{fs$1.renameSync(e,r);}catch{try{let{copyFileSync:n}=oa("fs");n(e,r);try{fs$1.unlinkSync(e);}catch{}}catch(n){process.stderr.write(`[testrelic] Failed to...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.cjsView on unpkg · L1

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/reporter-entry.jsView file

Findings

7 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/reporter-entry.js

HighSame File Env Network Executiondist/reporter-entry.js

HighCommand Output Exfiltrationdist/reporter-entry.js

HighCross File Remote Execution Contextdist/index.cjs

HighTrigger Reachable Command Output Exfiltrationdist/index.cjs

HighSemantic Analysis Limitedpackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Low

Affected versions and remediation

This report applies to @testrelic/playwright-analytics@2.16.0.

See all versions of @testrelic/playwright-analytics for other recorded verdicts.

Review the evidence and your use of @testrelic/playwright-analytics@2.16.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 17:56:01.510Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @testrelic

Behavioral surface

Related packages

More from @testrelic

Source & flagged code