registry / @wdio/browserstack-service / 9.39.4
@wdio/browserstack-service@9.39.4
WebdriverIO service for better Browserstack integration
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe scanner signals correspond to package-aligned CLI management, optional dependency loading, and authenticated test reporting. Static inspection found no concrete malicious chain or unresolved credential forwarding to an unrelated destination.
Static reason
One or more suspicious static signals were detected.
Trigger
Service initialization, test execution, and test-run exit activate the inspected behavior.
Impact
Testing diagnostics and redacted configuration may be uploaded; no malicious credential export, agent-control mutation, or install-time attack was identified.
Mechanism
The service manages SDK CLI processes and sends authenticated testing telemetry and diagnostics to BrowserStack endpoints.
AI rationale
The scanner signals correspond to package-aligned CLI management, optional dependency loading, and authenticated test reporting. Static inspection found no concrete malicious chain or unresolved credential forwarding to an unrelated destination.
Evidence
log/sdk-cli-debug.log
Network endpoints3
api.browserstack.comapi.browserstack.com/sdk/v1/eventupload-observability.browserstack.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has build and prepack scripts, no registry-install lifecycle hooks, and no runtime self-dependency.
- The cleanup helper uploads test logs to the BrowserStack upload service.
- The entrypoint launches the local cleanup helper on exit only when cleanup arguments exist.
- CLI update authentication uses configured BrowserStack credentials with the BrowserStack API destination.
- Dynamic loading selects named Percy integration dependencies; shell execution checks the SDK CLI version.
- Diagnostic uploads redact sensitive content from captured package configuration.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedbuild/cleanup.jsView file
491import util, { promisify } from "node:util";
L492: import { exec } from "node:child_process";
L493: import { Readable } from "node:stream";
High
build/index.jsView file
19L20: // package.json
L21: var package_default;
...
L28: author: "BrowserStack <support@browserstack.com>",
L29: homepage: "https://github.com/browserstack/wdio-browserstack-service",
L30: license: "MIT",
...
L331: BStackLogger = class {
L332: static logFilePath = path.join(process.cwd(), LOGS_FILE);
L333: static logFolderPath = path.join(process.cwd(), "logs");
...
L341: if (this.logFileStream && this.logFileStream.writable) {
L342: this.logFileStream.write(this.formatLog(logMessage, logLevel));
L343: }
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
build/index.jsView on unpkg · L19Findings
4 High3 Medium5 Low
HighChild Processbuild/cleanup.js
HighShell
HighCommand Output Exfiltrationbuild/index.js
HighCross File Remote Execution Contextbuild/index.js
MediumDynamic Requirebuild/index.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @wdio/browserstack-service@9.39.4.
See all versions of @wdio/browserstack-service for other recorded verdicts.
- Review the evidence and your use of @wdio/browserstack-service@9.39.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.