botium-core@1.15.18
The Selenium for Chatbots
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package performs limited install-time telemetry by default, which the review rules classify as suspicious even though the payload contains no user, project, or credential data. This warrants a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Package installation, through the postinstall lifecycle script.
Impact
Botium analytics receives installation metadata without the installer explicitly opting in.
Mechanism
report.js sends an HTTPS POST with platform, architecture, package name, and version. Telemetry can be disabled with BOTIUM_ANALYTICS=false.
AI rationale
The package performs limited install-time telemetry by default, which the review rules classify as suspicious even though the payload contains no user, project, or credential data. This warrants a warning rather than a publish block.
Evidence
package.jsonreport.js
Network endpoints1
v1.license.botium.cyaraportal.us:443/metrics/installation/core
Decision evidence
public snapshotAI called this Suspicious at 97.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The default postinstall script runs report.js.
- The install report sends only platform, architecture, package name, and version; it is enabled unless BOTIUM_ANALYTICS is set to false.
- The report posts to the Botium analytics host at /metrics/installation/core.
Evidence against
- The telemetry payload does not include credentials, project details, or file contents.
- The package entry point exports library modules and does not invoke the install report.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
12 flaggedpackage.jsonView file
•scripts.postinstall = node ./report.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•Remote tarball dependency specs: xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz
Medium
Remote Tarball Dependency
Package manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkgsamples/scripting/utterances/botium.jsonView file
8patternName = private_key_rsa
severity = critical
line = 8
Critical
Critical Secret
Package contains a critical-looking secret pattern.
samples/scripting/utterances/botium.jsonView on unpkg · L8Findings
2 Critical5 High6 Medium6 Low
CriticalCritical Secretsamples/scripting/utterances/botium.json
CriticalSecret Patternsamples/scripting/utterances/botium.json
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy Blobtest/convo/convos/tree/excel/testbotium.xlsx
HighPayload In Excluded Dirtest/convo/convos/tree/excel/testbotium.xlsx
HighSemantic Analysis Limiteddist/botium-cjs.js
HighPrevious Version Dangerous Deltadist/botium-cjs.js
MediumDynamic Requiredist/botium-cjs.js
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobtest/convo/convos/tree/excel/testbotium.xlsx
Medium
Affected versions and remediation
This report applies to botium-core@1.15.18.
See all versions of botium-core for other recorded verdicts.
- Review the evidence and your use of botium-core@1.15.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.