registry / @wdio/browserstack-service / 9.39.5
@wdio/browserstack-service@9.39.5
WebdriverIO service for better Browserstack integration
AI Security Review
scanned 24d ago · by lpm-firewall-aiSource inspection found no install lifecycle hook or concrete attack chain. The flagged subprocess and network behavior is consistent with the BrowserStack service’s CLI, Git orchestration, and flag-triggered reporting functions.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer uses the service or invokes its cleanup entrypoint with upload-related command-line flags.
Impact
The inspected behavior supports service operation and requested reporting; no concrete attack impact was established.
Mechanism
The service starts its SDK CLI during setup and uses Git subprocesses to gather orchestration information. Cleanup sends supplied funnel data to the package’s instrumentation endpoint or uploads logs when requested by flags.
AI rationale
Source inspection found no install lifecycle hook or concrete attack chain. The flagged subprocess and network behavior is consistent with the BrowserStack service’s CLI, Git orchestration, and flag-triggered reporting functions.
Evidence
package.jsonbuild/index.jsbuild/cleanup.js
Network endpoints1
APIUtils.FUNNEL_INSTRUMENTATION_URL
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the BrowserStack service and a separate cleanup entrypoint; its listed scripts contain no install lifecycle hook.
- Cleanup sends funnel data only when the corresponding command-line flag and data are present; its request goes to the package’s instrumentation endpoint.
- The spawned SDK CLI is obtained through the service’s setup path, and the other flagged process calls run fixed Git commands for test orchestration.
- No concrete malicious behavior was identified in the inspected runtime paths.
Evidence against
- Importing the cleanup entrypoint starts cleanup handling, which can send supplied funnel data or upload logs when command-line flags request those actions.
- The service spawns a CLI process with the current environment, and test orchestration runs Git commands and reads their output.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
5 flaggedbuild/cleanup.jsView file
491import util, { promisify } from "node:util";
L492: import { exec } from "node:child_process";
L493: import { Readable } from "node:stream";
High
build/index.jsView file
19L20: // package.json
L21: var package_default;
...
L28: author: "BrowserStack <support@browserstack.com>",
L29: homepage: "https://github.com/browserstack/wdio-browserstack-service",
L30: license: "MIT",
...
L331: BStackLogger = class {
L332: static logFilePath = path.join(process.cwd(), LOGS_FILE);
L333: static logFolderPath = path.join(process.cwd(), "logs");
...
L341: if (this.logFileStream && this.logFileStream.writable) {
L342: this.logFileStream.write(this.formatLog(logMessage, logLevel));
L343: }
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
build/index.jsView on unpkg · L19Findings
4 High3 Medium5 Low
HighChild Processbuild/cleanup.js
HighShell
HighCommand Output Exfiltrationbuild/index.js
HighCross File Remote Execution Contextbuild/index.js
MediumDynamic Requirebuild/index.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @wdio/browserstack-service@9.39.5.
See all versions of @wdio/browserstack-service for other recorded verdicts.
- Review the evidence and your use of @wdio/browserstack-service@9.39.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.