registry / @wdio/browserstack-service / 9.41.0
@wdio/browserstack-service@9.41.0
WebdriverIO service for better Browserstack integration
AI Security Review
scanned 14d ago · by lpm-firewall-aiInspected source supports ordinary BrowserStack service behavior, including a disclosed, configurable log and configuration upload to a BrowserStack endpoint. Scanner flags for process execution, networking, and dynamic loading did not establish a concrete attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A WebdriverIO run reaches the service log-upload path; the upload can be disabled through the service option or environment setting.
Impact
The upload shares project configuration and logs with BrowserStack for service observability; no unrelated recipient or concrete malicious behavior was identified.
Mechanism
The service archives selected configuration and log files, redacts recognized sensitive values, and sends the archive using BrowserStack credentials to a BrowserStack endpoint.
AI rationale
Inspected source supports ordinary BrowserStack service behavior, including a disclosed, configurable log and configuration upload to a BrowserStack endpoint. Scanner flags for process execution, networking, and dynamic loading did not establish a concrete attack.
Evidence
package.jsonbuild/index.jsbuild/cleanup.js
Network endpoints1
upload-observability.browserstack.com
Decision evidence
public snapshotAI called this Clean at 81.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install lifecycle hook and exports the built service entry point.
- The service collects configuration and log files for upload to BrowserStack’s observability endpoint; its source provides a disable option.
- The cleanup entry point is separately exported; inspected source shows no concrete attack behavior.
- The gRPC files register DNS resolution and validate service configuration; cleanup sends a funnel event with Basic authentication to its configured instrumentation URL; the protobuf files define generated descriptors.
- The eight protobuf modules export descriptors for their respective google/protobuf schemas.
- The eight target modules provide protobuf text encoding, size-delimited serialization, well-known-type helpers, or generated google/protobuf descriptors.
- The eight modules define generated descriptors for their respective google/protobuf schemas.
- The eight target modules define protobuf message schemas, provide text-encoding and size-delimited wire helpers, and implement gRPC name-resolution load-balancer and subchannel-pool functions.
Evidence against
Behavioral surface
Source & flagged code
5 flaggedbuild/cleanup.jsView file
491import util, { promisify } from "node:util";
L492: import { exec } from "node:child_process";
L493: import { Readable } from "node:stream";
High
build/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @wdio/browserstack-service@9.40.0
matchedIdentity = npm:[redacted]:9.40.0
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
build/index.jsView on unpkg19L20: // package.json
L21: var package_default;
...
L28: author: "BrowserStack <support@browserstack.com>",
L29: homepage: "https://github.com/browserstack/wdio-browserstack-service",
L30: license: "MIT",
...
L331: BStackLogger = class {
L332: static logFilePath = path.join(process.cwd(), LOGS_FILE);
L333: static logFolderPath = path.join(process.cwd(), "logs");
...
L341: if (this.logFileStream && this.logFileStream.writable) {
L342: this.logFileStream.write(this.formatLog(logMessage, logLevel));
L343: }
Findings
1 Critical4 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltabuild/index.js
HighChild Processbuild/cleanup.js
HighShell
HighCommand Output Exfiltrationbuild/index.js
HighCross File Remote Execution Contextbuild/index.js
MediumDynamic Requirebuild/index.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @wdio/browserstack-service@9.41.0.
See all versions of @wdio/browserstack-service for other recorded verdicts.
- Review the evidence and your use of @wdio/browserstack-service@9.41.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.