registry / botium-core / 1.15.17
botium-core@1.15.17
⚠ Under reviewThe Selenium for Chatbots
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe postinstall behavior is disclosed installation tracking that sends package metadata, and the inspected source does not show credential transfer. The sample configuration’s private-key field remains unresolved, so this review cannot establish a clean result or a malicious attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation runs the postinstall script; the sample credential is present in the distributed sample configuration.
Impact
The sample key could expose an account if it is valid; its validity could not be determined from source inspection.
Mechanism
The postinstall report sends limited platform and package metadata to the configured analytics host. The inspected report payload does not include the sample credential.
AI rationale
The postinstall behavior is disclosed installation tracking that sends package metadata, and the inspected source does not show credential transfer. The sample configuration’s private-key field remains unresolved, so this review cannot establish a clean result or a malicious attack.
Evidence
samples/scripting/utterances/botium.jsonpackage.jsonreport.js
Network endpoints1
v1.license.botium.cyaraportal.us
Decision evidence
public snapshotAI called this Manual Review at 62.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The package postinstall script runs report.js.
- The report sends platform, architecture, package name, and version to a Botium-branded installation metrics endpoint unless an environment flag disables it; the README discloses this tracking.
- The sample configuration contains a Dialogflow service account and a private-key field, but the key’s validity is not established.
- The report payload contains package metadata; the inspected source does not show it including the sample credential.
Evidence against
- The README describes the installation tracking and documents an opt-out.
- The observed installation report does not establish credential transfer or other malicious behavior.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
11 flaggedpackage.jsonView file
•scripts.postinstall = node ./report.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•Remote tarball dependency specs: xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz
Medium
Remote Tarball Dependency
Package manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkgsamples/scripting/utterances/botium.jsonView file
8patternName = private_key_rsa
severity = critical
line = 8
Critical
Critical Secret
Package contains a critical-looking secret pattern.
samples/scripting/utterances/botium.jsonView on unpkg · L8Findings
2 Critical4 High6 Medium6 Low
CriticalCritical Secretsamples/scripting/utterances/botium.json
CriticalSecret Patternsamples/scripting/utterances/botium.json
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy Blobtest/convo/convos/tree/excel/testbotium.xlsx
HighPayload In Excluded Dirtest/convo/convos/tree/excel/testbotium.xlsx
HighSemantic Analysis Limiteddist/botium-cjs.js
MediumDynamic Requiredist/botium-cjs.js
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobtest/convo/convos/tree/excel/testbotium.xlsx
MediumStructural Risk Force Deep Review
MediumRemote Tarball Dependency
Affected versions and remediation
This report applies to botium-core@1.15.17.
See all versions of botium-core for other recorded verdicts.
- Review the evidence and your use of botium-core@1.15.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.