registry / @wdio/browserstack-service / 9.32.1
@wdio/browserstack-service@9.32.1
WebdriverIO service for better Browserstack integration
AI Security Review
scanned 3mo ago · by lpm-firewall-aiStatic hints overstate package-aligned runtime features as malware. Source inspection found no install-time execution, stealth exfiltration, arbitrary remote execution chain, persistence, or destructive behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User configures/runs WebdriverIO with this service and applicable BrowserStack features.
Impact
May transmit configured test, host, and smart-selection metadata to BrowserStack during opted-in test execution.
Mechanism
BrowserStack test integration, observability, and optional local CLI/Percy support.
AI rationale
Static hints overstate package-aligned runtime features as malware. Source inspection found no install-time execution, stealth exfiltration, arbitrary remote execution chain, persistence, or destructive behavior.
Evidence
package.jsonbuild/index.jsREADME.md
Network endpoints3
api.browserstack.comcollector-observability.browserstack.com127.0.0.1:5338
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no install lifecycle hooks or bin entrypoint.
- build/index.js exports a WebdriverIO service; import code does not perform network I/O.
- CLI download/exec is invoked from service setup and is BrowserStack-specific.
- Host/Git metadata is only assembled for enabled smart test selection and sent to BrowserStack APIs.
- Loopback URL is the documented Percy local server default.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Oversized source lightweight scan
Source & flagged code
5 flaggedbuild/cleanup.jsView file
305import util, { promisify } from "node:util";
L306: import { exec } from "node:child_process";
L307: import { Readable } from "node:stream";
High
build/index.jsView file
19L20: // package.json
L21: var package_default;
...
L28: author: "BrowserStack <support@browserstack.com>",
L29: homepage: "https://github.com/browserstack/wdio-browserstack-service",
L30: license: "MIT",
...
L306: if (!res.ok) {
L307: throw new ResponseError(`Error response from server ${res.status}: ${await res.text()}`, res);
L308: }
...
L311: function _fetch(input, init) {
L312: const proxyUrl = process.env.HTTP_PROXY || process.env.HTTPS_PROXY;
L313: if (proxyUrl) {
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
build/index.jsView on unpkg · L1919
Findings
2 Critical4 High3 Medium4 Low
CriticalCommand Output Exfiltrationbuild/index.js
CriticalTrigger Reachable Dangerous Capabilitybuild/index.js
HighChild Processbuild/cleanup.js
HighShell
HighLoopback Host Fingerprint Telemetrybuild/index.js
HighCross File Remote Execution Contextbuild/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @wdio/browserstack-service@9.32.1.
See all versions of @wdio/browserstack-service for other recorded verdicts.
- Review the evidence and your use of @wdio/browserstack-service@9.32.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.