registry / botium-core / 1.15.15
botium-core@1.15.15
The Selenium for Chatbots
AI Security Review
scanned 27d ago · by lpm-firewall-aiInspected source shows opt-out installation analytics and a private-key field in a sample configuration. The key's validity is unresolved, so warn without blocking publication.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation triggers the postinstall report; the sample key is present in the published package files.
Impact
The telemetry exposes limited installation metadata. The included sample credential may be exposed to package consumers; source inspection did not establish whether it is live or usable.
Mechanism
The report posts platform, architecture, package name, and version to its configured analytics host. The sample file includes a Dialogflow private key field.
AI rationale
Inspected source shows opt-out installation analytics and a private-key field in a sample configuration. The key's validity is unresolved, so warn without blocking publication.
Evidence
package.jsonreport.jssamples/scripting/utterances/botium.json
Network endpoints1
v1.license.botium.cyaraportal.us
Decision evidence
public snapshotAI called this Suspicious at 79.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The package runs report.js automatically after installation.
- The report sends platform, architecture, package name, and version to a host configurable through an environment variable; reporting can be disabled with BOTIUM_ANALYTICS=false.
- A sample configuration contains a Dialogflow private key, creating a risk that a credential was included in the published package.
Evidence against
- The install report's listed payload is limited to platform, architecture, package name, and version.
- The report has an explicit environment-variable opt-out.
- The package entrypoint exports Botium library components; inspected source did not show an attack chain.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
11 flaggedpackage.jsonView file
•scripts.postinstall = node ./report.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•Remote tarball dependency specs: xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz
Medium
Remote Tarball Dependency
Package manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkgsamples/scripting/utterances/botium.jsonView file
8patternName = private_key_rsa
severity = critical
line = 8
Critical
Critical Secret
Package contains a critical-looking secret pattern.
samples/scripting/utterances/botium.jsonView on unpkg · L8Findings
2 Critical4 High6 Medium6 Low
CriticalCritical Secretsamples/scripting/utterances/botium.json
CriticalSecret Patternsamples/scripting/utterances/botium.json
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy Blobtest/convo/convos/tree/excel/testbotium.xlsx
HighPayload In Excluded Dirtest/convo/convos/tree/excel/testbotium.xlsx
HighSemantic Analysis Limiteddist/botium-cjs.js
MediumDynamic Requiredist/botium-cjs.js
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobtest/convo/convos/tree/excel/testbotium.xlsx
MediumStructural Risk Force Deep Review
MediumRemote Tarball Dependency
Affected versions and remediation
This report applies to botium-core@1.15.15.
See all versions of botium-core for other recorded verdicts.
- Review the evidence and your use of botium-core@1.15.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.