registry / @wdio/browserstack-service / 9.35.2
@wdio/browserstack-service@9.35.2
WebdriverIO service for better Browserstack integration
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Oversized source lightweight scan
build/index.js2.83 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsCryptoShellUrlStringsapi-cloud.browserstack.comapi.browserstack.comapp-accessibility.browserstack.comcollector-observability.browserstack.comeds.browserstack.comgithub.com
Source & flagged code
3 flaggedbuild/cleanup.jsView file
379import util, { promisify } from "node:util";
L380: import { exec } from "node:child_process";
L381: import { Readable } from "node:stream";
High
build/index.jsView file
19L20: // package.json
L21: var package_default;
...
L28: author: "BrowserStack <support@browserstack.com>",
L29: homepage: "https://github.com/browserstack/wdio-browserstack-service",
L30: license: "MIT",
...
L353: if (!res.ok) {
L354: throw new ResponseError(`Error response from server ${res.status}: ${await res.text()}`, res);
L355: }
...
L358: function _fetch(input, init) {
L359: const proxyUrl = process.env.HTTP_PROXY || process.env.HTTPS_PROXY;
L360: if (proxyUrl) {
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
build/index.jsView on unpkg · L19Findings
4 High3 Medium4 Low
HighChild Processbuild/cleanup.js
HighShell
HighCommand Output Exfiltrationbuild/index.js
HighCross File Remote Execution Contextbuild/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @wdio/browserstack-service@9.35.2.
See all versions of @wdio/browserstack-service for other recorded verdicts.
- Review the evidence and your use of @wdio/browserstack-service@9.35.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.