registry / @wdio/browserstack-service / 9.40.0
@wdio/browserstack-service@9.40.0
WebdriverIO service for better Browserstack integration
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook. Inspected shell execution checks the BrowserStack CLI version, and the reviewed network destinations are BrowserStack service endpoints; no concrete attack behavior was found.
Static reason
One or more suspicious static signals were detected.
Trigger
The service checks or updates its CLI during runtime, or a caller imports the separate cleanup entry with relevant command-line flags.
Impact
No unauthorized command execution, consumer-project mutation, or unrelated credential transfer was established.
Mechanism
The service runs the installed CLI to read its version and sends service requests and crash reports to BrowserStack endpoints; cleanup operations are gated by command-line arguments.
AI rationale
The manifest has no install lifecycle hook. Inspected shell execution checks the BrowserStack CLI version, and the reviewed network destinations are BrowserStack service endpoints; no concrete attack behavior was found.
Network endpoints2
api.browserstack.comcollector-observability.browserstack.com
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exports the service and a separate cleanup entry, and lists no install lifecycle hook.
- build/index.js uses shell execution to check the installed BrowserStack CLI version.
- The service API and crash-report destinations are BrowserStack endpoints.
- The cleanup entry only performs its cleanup and reporting actions when the corresponding command-line flags and data are present.
Evidence against
- The package scripts shown are build, test, and prepack tasks; none is an install hook.
- The inspected shell call runs the existing CLI with a version argument, and the inspected network calls target BrowserStack services.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedbuild/cleanup.jsView file
491import util, { promisify } from "node:util";
L492: import { exec } from "node:child_process";
L493: import { Readable } from "node:stream";
High
build/index.jsView file
19L20: // package.json
L21: var package_default;
...
L28: author: "BrowserStack <support@browserstack.com>",
L29: homepage: "https://github.com/browserstack/wdio-browserstack-service",
L30: license: "MIT",
...
L331: BStackLogger = class {
L332: static logFilePath = path.join(process.cwd(), LOGS_FILE);
L333: static logFolderPath = path.join(process.cwd(), "logs");
...
L341: if (this.logFileStream && this.logFileStream.writable) {
L342: this.logFileStream.write(this.formatLog(logMessage, logLevel));
L343: }
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
build/index.jsView on unpkg · L19Findings
4 High3 Medium5 Low
HighChild Processbuild/cleanup.js
HighShell
HighCommand Output Exfiltrationbuild/index.js
HighCross File Remote Execution Contextbuild/index.js
MediumDynamic Requirebuild/index.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @wdio/browserstack-service@9.40.0.
See all versions of @wdio/browserstack-service for other recorded verdicts.
- Review the evidence and your use of @wdio/browserstack-service@9.40.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.