registry / @wdio/browserstack-service / 9.39.6
@wdio/browserstack-service@9.39.6
WebdriverIO service for better Browserstack integration
AI Security Review
scanned 23d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the flagged execution paths inspected are tied to BrowserStack CLI version checks and service cleanup. The observed API destination is BrowserStack’s own API host, with no concrete attack behavior identified.
Static reason
One or more suspicious static signals were detected.
Trigger
Using the service can trigger a CLI version check; the process exit handler can start cleanup when cleanup arguments are available.
Impact
No unrelated credential recipient, unrequested account action, or install-time mutation was established.
Mechanism
The version check runs the existing CLI with a version argument. The update request targets the BrowserStack API using configured BrowserStack credentials, and cleanup reads funnel data only when its command-line flag is present.
AI rationale
The manifest has no install lifecycle hook, and the flagged execution paths inspected are tied to BrowserStack CLI version checks and service cleanup. The observed API destination is BrowserStack’s own API host, with no concrete attack behavior identified.
Evidence
package.jsonbuild/index.jsbuild/cleanup.js
Network endpoints1
api.browserstack.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json lists build and test scripts, with no install lifecycle hook.
- The service runs an existing CLI with a version argument and captures its output for the update check.
- The update request uses configured BrowserStack credentials and targets the BrowserStack API host.
- The exit handler starts the package cleanup helper with computed cleanup arguments.
- The cleanup helper reads funnel data only when its corresponding command-line flag is present.
Evidence against
- The bundle contains shell execution and an exit-triggered cleanup subprocess; inspected callers tie them to CLI version checks and service cleanup.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedbuild/cleanup.jsView file
491import util, { promisify } from "node:util";
L492: import { exec } from "node:child_process";
L493: import { Readable } from "node:stream";
High
build/index.jsView file
19L20: // package.json
L21: var package_default;
...
L28: author: "BrowserStack <support@browserstack.com>",
L29: homepage: "https://github.com/browserstack/wdio-browserstack-service",
L30: license: "MIT",
...
L331: BStackLogger = class {
L332: static logFilePath = path.join(process.cwd(), LOGS_FILE);
L333: static logFolderPath = path.join(process.cwd(), "logs");
...
L341: if (this.logFileStream && this.logFileStream.writable) {
L342: this.logFileStream.write(this.formatLog(logMessage, logLevel));
L343: }
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
build/index.jsView on unpkg · L19Findings
4 High3 Medium5 Low
HighChild Processbuild/cleanup.js
HighShell
HighCommand Output Exfiltrationbuild/index.js
HighCross File Remote Execution Contextbuild/index.js
MediumDynamic Requirebuild/index.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @wdio/browserstack-service@9.39.6.
See all versions of @wdio/browserstack-service for other recorded verdicts.
- Review the evidence and your use of @wdio/browserstack-service@9.39.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.