@wdio/browserstack-service@8.49.2
WebdriverIO service for better Browserstack integration
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNo source evidence shows malicious install-time mutation, stealth persistence, or credential theft. However, unverified server-directed binary download and execution is a meaningful unresolved RCE risk.
Static reason
No blocking static signals were detected.
Trigger
A configured WebdriverIO BrowserStack session using the supported CLI path.
Impact
A compromised update response or download host could execute arbitrary code as the test runner.
Mechanism
Server-directed binary download, extraction, chmod, and child-process spawn.
AI rationale
No source evidence shows malicious install-time mutation, stealth persistence, or credential theft. However, unverified server-directed binary download and execution is a meaningful unresolved RCE risk.
Evidence
package.jsonbuild/cli/cliUtils.jsbuild/cli/index.jsbuild/Percy/PercyBinary.jsbuild/ai-handler.js
Network endpoints2
api.browserstack.comgithub.com/percy/cli/releases/latest/download
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- build/cli/cliUtils.js downloads a CLI archive from a server-provided URL with redirects enabled.
- The archive is extracted, chmodded executable, then spawned by build/cli/index.js.
- No checksum, signature, or archive-path validation is present in that download flow.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- CLI download/execution occurs during configured WebdriverIO test runtime, not installation or import.
- Observed endpoints are BrowserStack/Percy service endpoints aligned with the package purpose.
- AI code conditionally changes browser-test capabilities and installs a Firefox test-browser addon; it does not alter local AI-agent controls.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsObfuscatedUrlStrings
Source & flagged code
1 flaggedbuild/constants.jsView file
1import { createRequire } from 'node:module';
L2: const require = createRequire(import.meta.url);
L3: const { version: bstackServiceVersion } = require('../package.json');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
build/constants.jsView on unpkg · L1Findings
4 Medium5 Low
MediumDynamic Requirebuild/constants.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @wdio/browserstack-service@8.49.2.
See all versions of @wdio/browserstack-service for other recorded verdicts.
- Review the evidence and your use of @wdio/browserstack-service@8.49.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.