registry / @wdio/browserstack-service / 9.29.1
@wdio/browserstack-service@9.29.1
WebdriverIO service for better Browserstack integration
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
2 flaggedbuild/cleanup.jsView file
273import util, { promisify } from "node:util";
L274: import { exec } from "node:child_process";
L275: import { Readable } from "node:stream";
High
build/index.jsView file
24Cross-file remote execution chain: build/index.js spawns build/cleanup.js; helper contains network access plus dynamic code execution.
L24:
L25: // package.json
L26: var package_default;
...
L33: author: "Adam Bjerstedt <abjerstedt@gmail.com>",
L34: homepage: "https://github.[redacted]-browserstack-service",
L35: license: "MIT",
...
L293: function derToPem(der) {
L294: const b64 = der.toString("base64").replace(/(.{64})/g, "$1\n");
L295: return `-----BEGIN CERTIFICATE-----
...
L305: function resolveCaCertPath(options) {
L306: let p = process.env.BROWSERSTACK_EXTRA_CA_CERTS;
L307: if ((!p || !p.trim()) && options?.proxyCaCertificate) {
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
build/index.jsView on unpkg · L24Findings
3 High2 Medium3 Low
HighChild Processbuild/cleanup.js
HighShell
HighCross File Remote Execution Contextbuild/index.js
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @wdio/browserstack-service@9.29.1.
See all versions of @wdio/browserstack-service for other recorded verdicts.
- Review the evidence and your use of @wdio/browserstack-service@9.29.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.