@wdio/browserstack-service@9.42.2
WebdriverIO service for better Browserstack integration
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package automatically uploads exception data, stack traces, and function arguments to its own service when wrapped functions fail. This is not a clear attack, but the automatic runtime reporting can expose local or runtime details without an evident opt-out, so it warrants a warning.
Static reason
One or more suspicious static signals were detected.
Trigger
An error in a wrapped TestHub or Observability function.
Impact
Diagnostic data, potentially including local paths in stack traces or runtime argument details, leaves the environment. No credential theft or unrelated collector was identified.
Mechanism
The handler serializes function arguments and sends the exception, stack trace, hashed build ID, and filtered config in an authenticated POST.
AI rationale
The package automatically uploads exception data, stack traces, and function arguments to its own service when wrapped functions fail. This is not a clear attack, but the automatic runtime reporting can expose local or runtime details without an evident opt-out, so it warrants a warning.
Evidence
build/index.js
Network endpoints1
collector-observability.browserstack.com/api/v1/analytics
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- On wrapped function errors, the code serializes the function arguments and calls the crash reporter.
- The crash report includes an exception and stack trace, then POSTs report data to BrowserStack’s analytics endpoint using Basic authentication.
- The reported config is PII-filtered, and the package metadata shows no install lifecycle hook.
Evidence against
- The endpoint belongs to BrowserStack, the service this package integrates with.
- The report uses BrowserStack Observability credentials rather than discovered credentials from another service.
- The package’s shell execution checks the BrowserStack CLI binary version.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedbuild/cleanup.jsView file
490import util, { promisify } from "node:util";
L491: import { exec } from "node:child_process";
L492: import { Readable } from "node:stream";
High
build/index.jsView file
19L20: // package.json
L21: var package_default;
...
L28: author: "BrowserStack <support@browserstack.com>",
L29: homepage: "https://github.com/browserstack/wdio-browserstack-service",
L30: license: "MIT",
...
L325: BStackLogger = class {
L326: static logFilePath = path.join(process.cwd(), LOGS_FILE);
L327: static logFolderPath = path.join(process.cwd(), "logs");
...
L335: if (this.logFileStream && this.logFileStream.writable) {
L336: this.logFileStream.write(this.formatLog(logMessage, logLevel));
L337: }
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
build/index.jsView on unpkg · L19Findings
4 High4 Medium4 Low
HighChild Processbuild/cleanup.js
HighShell
HighCommand Output Exfiltrationbuild/index.js
HighCross File Remote Execution Contextbuild/index.js
MediumDynamic Requirebuild/index.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencebuild/index.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @wdio/browserstack-service@9.42.2.
See all versions of @wdio/browserstack-service for other recorded verdicts.
- Review the evidence and your use of @wdio/browserstack-service@9.42.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.