registry / @wdio/browserstack-service / 9.34.0
@wdio/browserstack-service@9.34.0
WebdriverIO service for better Browserstack integration
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Oversized source lightweight scan
build/index.js2.80 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsCryptoShellUrlStringsapi-cloud.browserstack.comapi.browserstack.comapp-accessibility.browserstack.comcollector-observability.browserstack.comeds.browserstack.comgithub.com
Source & flagged code
4 flaggedbuild/cleanup.jsView file
379import util, { promisify } from "node:util";
L380: import { exec } from "node:child_process";
L381: import { Readable } from "node:stream";
High
•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
build/cleanup.js:
homepage: "https://github.com/browserstack/wdio-browserstack-service",
url: "git+https://github.com/browserstack/wdio-browserstack-service.git",
url: "https://github.com/browserstack/wdio-browserstack-service/issues"
static FUNNEL_INSTRUMENTATION_URL = "https://api.browserstack.com/sdk/v1/event";
static BROWSERSTACK_AUTOMATE_API_URL = "https://api.browserstack.com";
static BROWSERSTACK_AA_API_URL = "https://api.browserstack.com";
static BROWSERSTACK_PERCY_API_URL = "https://api.browserstack.com";
static BROWSERSTACK_AUTOMATE_API_CLOUD_URL = "https://api-cloud.browserstack.com";
High
Entrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
build/cleanup.jsView on unpkgbuild/index.jsView file
Findings
5 High3 Medium4 Low
HighChild Processbuild/cleanup.js
HighShell
HighEntrypoint Foreign Package Code Overwritebuild/cleanup.js
HighCommand Output Exfiltrationbuild/index.js
HighCross File Remote Execution Contextbuild/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @wdio/browserstack-service@9.34.0.
See all versions of @wdio/browserstack-service for other recorded verdicts.
- Review the evidence and your use of @wdio/browserstack-service@9.34.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.