registry / @wdio/browserstack-service / 9.42.0
@wdio/browserstack-service@9.42.0
WebdriverIO service for better Browserstack integration
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe source shows no install hook or unrelated collector. Runtime capture of project configuration and logs is disclosed, includes credential-key redaction, and has a documented opt-out as part of the BrowserStack service workflow.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
During a WebdriverIO service run and cleanup; log capture can be disabled with disableAutoCaptureLogs.
Impact
Expected BrowserStack reporting and support data is transmitted to BrowserStack; no unrelated collector or malicious action was found.
Mechanism
The service collects configured project files and debug logs, redacts values under known credential keys, and sends data to BrowserStack endpoints when the relevant credentials and run context are available.
AI rationale
The source shows no install hook or unrelated collector. Runtime capture of project configuration and logs is disclosed, includes credential-key redaction, and has a documented opt-out as part of the BrowserStack service workflow.
Network endpoints2
api.browserstack.comupload-observability.browserstack.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no preinstall, install, or postinstall hook.
- During service setup, the package tells users that WebdriverIO config files, imported local configs, package.json, and debug logs are captured; it describes credential redaction and the disableAutoCaptureLogs opt-out.
- The cleanup path sends funnel data only when BrowserStack username and access key are configured.
- Log upload packages config files and package.json and uses BrowserStack’s upload service; the captured-file behavior is disclosed and can be disabled.
Evidence against
- The service automatically uploads local project configuration and debug logs, which may contain project information, although the package discloses this behavior and provides an opt-out.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
5 flaggedbuild/cleanup.jsView file
491import util, { promisify } from "node:util";
L492: import { exec } from "node:child_process";
L493: import { Readable } from "node:stream";
High
build/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @wdio/browserstack-service@9.41.0
matchedIdentity = npm:[redacted]:9.41.0
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
build/index.jsView on unpkg19L20: // package.json
L21: var package_default;
...
L28: author: "BrowserStack <support@browserstack.com>",
L29: homepage: "https://github.com/browserstack/wdio-browserstack-service",
L30: license: "MIT",
...
L333: BStackLogger = class {
L334: static logFilePath = path.join(process.cwd(), LOGS_FILE);
L335: static logFolderPath = path.join(process.cwd(), "logs");
...
L343: if (this.logFileStream && this.logFileStream.writable) {
L344: this.logFileStream.write(this.formatLog(logMessage, logLevel));
L345: }
Findings
1 Critical4 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltabuild/index.js
HighChild Processbuild/cleanup.js
HighShell
HighCommand Output Exfiltrationbuild/index.js
HighCross File Remote Execution Contextbuild/index.js
MediumDynamic Requirebuild/index.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @wdio/browserstack-service@9.42.0.
See all versions of @wdio/browserstack-service for other recorded verdicts.
- Review the evidence and your use of @wdio/browserstack-service@9.42.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.