registry / browserstack-node-sdk / 1.63.2

browserstack-node-sdk@1.63.2

Node SDK for browserstack selenium-webdriver tests

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The explicit setup CLI can persist an update action in the consuming project's `package.json`. The bundled Chrome extension has broad page permissions if the AI SDK browser-extension path is activated; no unconsented install-time execution was found.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `npx setup` or invokes SDK functionality that activates the bundled browser extension.

Impact

Future dependency installs may update this SDK; activated extension code can access matching browser pages.

Mechanism

Project postinstall mutation and broad-permission bundled Chrome extension.

Rationale

The package shows no concrete malicious chain or unconsented install-time foreign control-surface mutation. Warn because explicit setup persists automatic updates in a consumer project and the bundled extension has broad page permissions behind obfuscated code.

Evidence

package.jsonREADME.mdsrc/bin/setup.jssrc/ai-sdk-node/bundle.jssrc/ai-sdk-node/extensions/chrome_extension.crxbrowserstack.yml

Network endpoints4

browserstack.comaccessibility.browserstack.com/apicollector-observability.browserstack.comupload-observability.browserstack.com

Decision evidence

public snapshot

AI called this Suspicious at 81.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`src/bin/setup.js` runs only as explicit `setup` CLI but writes the consumer `package.json`.
That setup path adds a `postinstall` command containing `npm update browserstack-node-sdk`.
`src/ai-sdk-node/extensions/chrome_extension.crx` embeds a Chrome extension with `<all_urls>` host access.
The extension includes background and content scripts, increasing browser-page access when its AI SDK path is used.
Core package and CLI sources are heavily obfuscated, limiting straightforward auditability.

Evidence against

`package.json` has no npm `preinstall`, `install`, or `postinstall` lifecycle hook.
README.md documents `npx setup`, so the project mutation is user-invoked rather than install-time.
Observed endpoints are BrowserStack/Percy/observability service domains consistent with SDK functionality.
No inspected source established credential exfiltration, remote payload download-and-execute, or destructive behavior.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 234 file(s), 4.76 MB of source, external domains: accessibility.browserstack.com, api-cloud-devtestops.bsstag.com, api-cloud.browserstack.com, api-preprod.bsstag.com, api.browserstack.com, apidevtestops.bsstag.com, app-automate-devtestops.bsstag.com, app-automate-preprod.bsstag.com, app-automate.browserstack.com, automate-devtestops.bsstag.com, automate-preprod.bsstag.com, automate.browserstack.com, automation-preprod.bsstag.com, automation.browserstack.com, browserstack.com, collector-observability-devtestops.bsstag.com, collector-observability-preprod.bsstag.com, collector-observability.browserstack.com, eds.browserstack.com, edsstaging.bsstag.com, github.com, graph.microsoft.com, grid-devhst.bsstag.com, grid-preprod.bsstag.com, grid.browserstack.com, hub-devtestops.bsstag.com, hub-preprod.bsstag.com, hub-use-only.browserstack.com, hub.browserstack.com, nroujxly-hub.browserstack-ats.com, observability-devtestops.bsstag.com, tcg-preprod.bsstag.com, tcg.browserstack.com, tcg.bsstag.com, upload-observability-devtestops-ssi.bsstag.com, upload-observability-preprod.bsstag.com, upload-observability.browserstack.com, www.browserstack.com, www.googleapis.com, your-jira.yourdomain.com

Source & flagged code

13 flagged

ats/src/templates/hubharesources/bitnami-kafka.yamlView file

Lines 99-187yaml

99 app.kubernetes.io/name: kafka

100 app.kubernetes.io/version: 3.9.0

101 helm.sh/chart: kafka-31.1.1

102 app.kubernetes.io/component: kafka

103automountServiceAccountToken: false

104---

105# Source: kafka/templates/secrets.yaml

106apiVersion: v1

107kind: Secret

108metadata:

109 name: turboscale-kafka-user-passwords

110 namespace: <HubHaNameSpace>

111 labels:

112 app.kubernetes.io/instance: turboscale

113 app.kubernetes.io/managed-by: Helm

114 app.kubernetes.io/name: kafka

115 app.kubernetes.io/version: 3.9.0

116 helm.sh/chart: kafka-31.1.1

117type: Opaque

118data:

119 system-user-password: "RXB5ZDVuWGJSSw=="

Medium

Secret Pattern

Package contains a possible secret pattern.

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L119

120 inter-broker-password: "TmlZOTRGd0tLSw=="

Medium

Secret Pattern

Hardcoded password in ats/src/templates/hubharesources/bitnami-kafka.yaml

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L120

121 controller-password: "N0dwWTlIUFVTag=="

Medium

Secret Pattern

Hardcoded password in ats/src/templates/hubharesources/bitnami-kafka.yaml

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L121

122---

123# Source: kafka/templates/secrets.yaml

124apiVersion: v1

125kind: Secret

126metadata:

127 name: turboscale-kafka-kraft-cluster-id

128 namespace: <HubHaNameSpace>

129 labels:

130 app.kubernetes.io/instance: turboscale

131 app.kubernetes.io/managed-by: Helm

132 app.kubernetes.io/name: kafka

133 app.kubernetes.io/version: 3.9.0

134 helm.sh/chart: kafka-31.1.1

135type: Opaque

136data:

137 kraft-cluster-id: "QXcyZzBOdnJxQUVLb1Ntc2VPWVR2Rw=="

138---

139# Source: kafka/templates/controller-eligible/configmap.yaml

140apiVersion: v1

141kind: ConfigMap

147 app.kubernetes.io/managed-by: Helm

148 app.kubernetes.io/name: kafka

149 app.kubernetes.io/version: 3.9.0

150 helm.sh/chart: kafka-31.1.1

151 app.kubernetes.io/component: controller-eligible

152 app.kubernetes.io/part-of: kafka

153data:

154 server.properties: |-

155 # Listeners configuration

156 listeners=CLIENT://:9092,INTERNAL://:9094,CONTROLLER://:9093

157 advertised.listeners=CLIENT://advertised-address-placeholder:9092,INTERNAL://advertised-address-placeholder:9094

158 listener.security.protocol.map=CLIENT:SASL_PLAINTEXT,INTERNAL:SASL_PLAINTEXT,CONTROLLER:SASL_PLAINTEXT

159 # KRaft process roles

160 process.roles=controller,broker

161 #node.id=

162 controller.listener.names=CONTROLLER

163 controller.quorum.voters=0@turboscale-kafka-controller-0.turboscale-kafka-controller-headless.<HubHaNameSpace>.svc.cluster.local:9093,1@turboscale-kafka-controller-1.turboscale-kafka-controller-headless.<HubHaNameSpace>.svc.cluster.local:9093,2@turboscale-kafka-controller-2.turboscale-kafka-controller-headless.<HubHaNameSpace>.svc.cluster.local:9093

164 # Kraft Controller listener SASL settings

165 sasl.mechanism.controller.protocol=PLAIN

166 listener.name.controller.sasl.enabled.mechanisms=PLAIN

167 listener.name.controller.plain.sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="controller_user" password="controller-password-placeholder" user_controller_user="controller-password-placeholder";

Medium

Secret Pattern

Hardcoded password in ats/src/templates/hubharesources/bitnami-kafka.yaml

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L167

168 # Kafka data logs directory

169 log.dir=/bitnami/kafka/data

170 # Kafka application logs directory

171 logs.dir=/opt/bitnami/kafka/logs

172

173 # Turboscale Kafka Configuration

174 log.retention.hours=4

175 # log.retention.minutes=30

176 auto.create.topics.enable=true

177 num.partitions=40

178

179 # Common Kafka Configuration

180

181 sasl.enabled.mechanisms=PLAIN,SCRAM-SHA-256,SCRAM-SHA-512

182 # Interbroker configuration

183 inter.broker.listener.name=INTERNAL

184 sasl.mechanism.inter.broker.protocol=PLAIN

185 # Listeners SASL JAAS configuration

186 listener.name.client.plain.sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required user_user1="password-placeholder-0";

187 listener.name.client.scram-sha-256.sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required;

189patternName = generic_password severity = medium line = 189 matchedText = listener...-0";

Medium

Secret Pattern

Hardcoded password in ats/src/templates/hubharesources/bitnami-kafka.yaml

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L189

190patternName = generic_password severity = medium line = 190 matchedText = listener...er";

Medium

Secret Pattern

Hardcoded password in ats/src/templates/hubharesources/bitnami-kafka.yaml

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L190

191patternName = generic_password severity = medium line = 191 matchedText = listener...er";

Medium

Secret Pattern

Hardcoded password in ats/src/templates/hubharesources/bitnami-kafka.yaml

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L191

273patternName = generic_password severity = medium line = 273 matchedText = local pa...ue}"

Medium

Secret Pattern

Hardcoded password in ats/src/templates/hubharesources/bitnami-kafka.yaml

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L273

ats/src/utils/utilityMethods.js#virtual:normalized:round1View file

1const a37_0xbf08e5=a37_0x40bb;(function(_0x424a37,_0x40af1a){const _0x28d774=a37_0x40bb,_0x2f1c52=_0x424a37();while(!![]){try{const _0x1e5996=parseInt(_0x28d774(0x138))/0x1*(parseI...

High

Child Process

Package source references child process execution.

ats/src/utils/utilityMethods.js#virtual:normalized:round1View on unpkg · L1

generated/sdk_pb.jsView file

Lines 1-32javascript

1// source: sdk.proto

2/**

3 * @fileoverview

4 * @enhanceable

5 * @suppress {missingRequire} reports error on implicit type usages.

6 * @suppress {messageConventions} JS Compiler reports an error if a variable or

7 * field starts with 'MSG_' and isn't a translatable message.

8 * @public

9 */

src/helpers/helper.jsView file

Lines 1-1javascript

1const a138_0x5c5c36=a138_0x14f7;function a138_0x1299(){const _0x2746b9=['gtnNl','nlWrx','OJxxu','JgpsY','qqWAU','LgDdO','sNbyW','-browserstack','defineProperty','faYld','getPwChannelLogPath','AZFpt','annotate',

ats/src/config/constants.jsView file

Lines 1-1javascript

1const a22_0x1abd31=a22_0x3e1b;(function(_0x5887dc,_0x29e6ad){const _0x23541a=a22_0x3e1b,_0x248794=_0x5887dc();while(!![]){try{const _0x3a7811=parseInt(_0x23541a(0x214))/0x1+parseInt

src/ai-sdk-node/extensions/chrome_extension.crxView file

•path = src/ai-sdk-node/extensions/chrome_extension.crx kind = high_entropy_blob sizeBytes = 53660 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/ai-sdk-node/extensions/chrome_extension.crxView on unpkg

Source & flagged code

13 flagged · loading source

ats/src/templates/hubharesources/bitnami-kafka.yamlView file

119patternName = generic_password severity = medium line = 119 matchedText = system-u...w=="

Medium

Secret Pattern

Package contains a possible secret pattern.

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L119

120patternName = generic_password severity = medium line = 120 matchedText = inter-br...w=="

Medium

Secret Pattern

Hardcoded password in ats/src/templates/hubharesources/bitnami-kafka.yaml

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L120

121patternName = generic_password severity = medium line = 121 matchedText = controll...g=="

Medium

Secret Pattern

Hardcoded password in ats/src/templates/hubharesources/bitnami-kafka.yaml

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L121

167patternName = generic_password severity = medium line = 167 matchedText = listener...er";

Medium

Secret Pattern

Hardcoded password in ats/src/templates/hubharesources/bitnami-kafka.yaml

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L167

189patternName = generic_password severity = medium line = 189 matchedText = listener...-0";

Medium

Secret Pattern

Hardcoded password in ats/src/templates/hubharesources/bitnami-kafka.yaml

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L189

190patternName = generic_password severity = medium line = 190 matchedText = listener...er";

Medium

Secret Pattern

Hardcoded password in ats/src/templates/hubharesources/bitnami-kafka.yaml

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L190

191patternName = generic_password severity = medium line = 191 matchedText = listener...er";

Medium

Secret Pattern

Hardcoded password in ats/src/templates/hubharesources/bitnami-kafka.yaml

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L191

273patternName = generic_password severity = medium line = 273 matchedText = local pa...ue}"

Medium

Secret Pattern

Hardcoded password in ats/src/templates/hubharesources/bitnami-kafka.yaml

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L273

ats/src/utils/utilityMethods.js#virtual:normalized:round1View file

1const a37_0xbf08e5=a37_0x40bb;(function(_0x424a37,_0x40af1a){const _0x28d774=a37_0x40bb,_0x2f1c52=_0x424a37();while(!![]){try{const _0x1e5996=parseInt(_0x28d774(0x138))/0x1*(parseI...

High

Child Process

Package source references child process execution.

ats/src/utils/utilityMethods.js#virtual:normalized:round1View on unpkg · L1

generated/sdk_pb.jsView file

13L14: var jspb = require('google-protobuf'); L15: var goog = jspb;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

generated/sdk_pb.jsView on unpkg · L13

src/helpers/helper.jsView file

1const a138_0x5c5c36=a138_0x14f7;function a138_0x1299(){const _0x2746b9=['gtnNl','nlWrx','OJxxu','JgpsY','qqWAU','LgDdO','sNbyW','-browserstack','defineProperty','faYld','getPwChann...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/helpers/helper.jsView on unpkg · L1

ats/src/config/constants.jsView file

1const a22_0x1abd31=a22_0x3e1b;(function(_0x5887dc,_0x29e6ad){const _0x23541a=a22_0x3e1b,_0x248794=_0x5887dc();while(!![]){try{const _0x3a7811=parseInt(_0x23541a(0x214))/0x1+parseIn...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

ats/src/config/constants.jsView on unpkg · L1

src/ai-sdk-node/extensions/chrome_extension.crxView file

•path = src/ai-sdk-node/extensions/chrome_extension.crx kind = high_entropy_blob sizeBytes = 53660 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/ai-sdk-node/extensions/chrome_extension.crxView on unpkg

Findings

6 High12 Medium4 Low

HighChild Processats/src/utils/utilityMethods.js#virtual:normalized:round1

HighShell

HighSame File Env Network Executionsrc/helpers/helper.js

HighObfuscated Payload Loaderats/src/config/constants.js

HighObfuscated

HighShips High Entropy Blobsrc/ai-sdk-node/extensions/chrome_extension.crx

MediumSecret Patternats/src/templates/hubharesources/bitnami-kafka.yaml

MediumDynamic Requiregenerated/sdk_pb.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternats/src/templates/hubharesources/bitnami-kafka.yaml

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

13 flagged

ats/src/templates/hubharesources/bitnami-kafka.yamlView file

Lines 99-187yaml

99 app.kubernetes.io/name: kafka

100 app.kubernetes.io/version: 3.9.0

101 helm.sh/chart: kafka-31.1.1

102 app.kubernetes.io/component: kafka

103automountServiceAccountToken: false

104---

105# Source: kafka/templates/secrets.yaml

106apiVersion: v1

107kind: Secret

108metadata:

109 name: turboscale-kafka-user-passwords

110 namespace: <HubHaNameSpace>

111 labels:

112 app.kubernetes.io/instance: turboscale

113 app.kubernetes.io/managed-by: Helm

114 app.kubernetes.io/name: kafka

115 app.kubernetes.io/version: 3.9.0

116 helm.sh/chart: kafka-31.1.1

117type: Opaque

118data:

119 system-user-password: "RXB5ZDVuWGJSSw=="

Medium

Secret Pattern

Package contains a possible secret pattern.

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L119

120 inter-broker-password: "TmlZOTRGd0tLSw=="

Medium

Secret Pattern

Hardcoded password in ats/src/templates/hubharesources/bitnami-kafka.yaml

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L120

121 controller-password: "N0dwWTlIUFVTag=="

Medium

Secret Pattern

Hardcoded password in ats/src/templates/hubharesources/bitnami-kafka.yaml

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L121

122---

123# Source: kafka/templates/secrets.yaml

124apiVersion: v1

125kind: Secret

126metadata:

127 name: turboscale-kafka-kraft-cluster-id

128 namespace: <HubHaNameSpace>

129 labels:

130 app.kubernetes.io/instance: turboscale

131 app.kubernetes.io/managed-by: Helm

132 app.kubernetes.io/name: kafka

133 app.kubernetes.io/version: 3.9.0

134 helm.sh/chart: kafka-31.1.1

135type: Opaque

136data:

137 kraft-cluster-id: "QXcyZzBOdnJxQUVLb1Ntc2VPWVR2Rw=="

138---

139# Source: kafka/templates/controller-eligible/configmap.yaml

140apiVersion: v1

141kind: ConfigMap

147 app.kubernetes.io/managed-by: Helm

148 app.kubernetes.io/name: kafka

149 app.kubernetes.io/version: 3.9.0

150 helm.sh/chart: kafka-31.1.1

151 app.kubernetes.io/component: controller-eligible

152 app.kubernetes.io/part-of: kafka

153data:

154 server.properties: |-

155 # Listeners configuration

156 listeners=CLIENT://:9092,INTERNAL://:9094,CONTROLLER://:9093

157 advertised.listeners=CLIENT://advertised-address-placeholder:9092,INTERNAL://advertised-address-placeholder:9094

158 listener.security.protocol.map=CLIENT:SASL_PLAINTEXT,INTERNAL:SASL_PLAINTEXT,CONTROLLER:SASL_PLAINTEXT

159 # KRaft process roles

160 process.roles=controller,broker

161 #node.id=

162 controller.listener.names=CONTROLLER

164 # Kraft Controller listener SASL settings

165 sasl.mechanism.controller.protocol=PLAIN

166 listener.name.controller.sasl.enabled.mechanisms=PLAIN

Medium

Secret Pattern

Hardcoded password in ats/src/templates/hubharesources/bitnami-kafka.yaml

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L167

168 # Kafka data logs directory

169 log.dir=/bitnami/kafka/data

170 # Kafka application logs directory

171 logs.dir=/opt/bitnami/kafka/logs

172

173 # Turboscale Kafka Configuration

174 log.retention.hours=4

175 # log.retention.minutes=30

176 auto.create.topics.enable=true

177 num.partitions=40

178

179 # Common Kafka Configuration

180

181 sasl.enabled.mechanisms=PLAIN,SCRAM-SHA-256,SCRAM-SHA-512

182 # Interbroker configuration

183 inter.broker.listener.name=INTERNAL

184 sasl.mechanism.inter.broker.protocol=PLAIN

185 # Listeners SASL JAAS configuration

186 listener.name.client.plain.sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required user_user1="password-placeholder-0";

187 listener.name.client.scram-sha-256.sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required;

189patternName = generic_password severity = medium line = 189 matchedText = listener...-0";

Medium

Secret Pattern

Hardcoded password in ats/src/templates/hubharesources/bitnami-kafka.yaml

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L189

190patternName = generic_password severity = medium line = 190 matchedText = listener...er";

Medium

Secret Pattern

Hardcoded password in ats/src/templates/hubharesources/bitnami-kafka.yaml

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L190

191patternName = generic_password severity = medium line = 191 matchedText = listener...er";

Medium

Secret Pattern

Hardcoded password in ats/src/templates/hubharesources/bitnami-kafka.yaml

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L191

273patternName = generic_password severity = medium line = 273 matchedText = local pa...ue}"

Medium

Secret Pattern

Hardcoded password in ats/src/templates/hubharesources/bitnami-kafka.yaml

ats/src/templates/hubharesources/bitnami-kafka.yamlView on unpkg · L273

ats/src/utils/utilityMethods.js#virtual:normalized:round1View file

1const a37_0xbf08e5=a37_0x40bb;(function(_0x424a37,_0x40af1a){const _0x28d774=a37_0x40bb,_0x2f1c52=_0x424a37();while(!![]){try{const _0x1e5996=parseInt(_0x28d774(0x138))/0x1*(parseI...

High

Child Process

Package source references child process execution.

ats/src/utils/utilityMethods.js#virtual:normalized:round1View on unpkg · L1

generated/sdk_pb.jsView file

Lines 1-32javascript

1// source: sdk.proto

2/**

3 * @fileoverview

4 * @enhanceable

5 * @suppress {missingRequire} reports error on implicit type usages.

6 * @suppress {messageConventions} JS Compiler reports an error if a variable or

7 * field starts with 'MSG_' and isn't a translatable message.

8 * @public

9 */

src/helpers/helper.jsView file

Lines 1-1javascript

ats/src/config/constants.jsView file

Lines 1-1javascript

1const a22_0x1abd31=a22_0x3e1b;(function(_0x5887dc,_0x29e6ad){const _0x23541a=a22_0x3e1b,_0x248794=_0x5887dc();while(!![]){try{const _0x3a7811=parseInt(_0x23541a(0x214))/0x1+parseInt

src/ai-sdk-node/extensions/chrome_extension.crxView file

•path = src/ai-sdk-node/extensions/chrome_extension.crx kind = high_entropy_blob sizeBytes = 53660 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/ai-sdk-node/extensions/chrome_extension.crxView on unpkg