registry / craftdriver / 1.0.1

craftdriver@1.0.1

Modern WebDriver automation library for NodeJS

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 446 KB of source, external domains: 127.0.0.1, api.github.com, example.com, googlechromelabs.github.io, www.npmjs.com

Source & flagged code

6 flagged

dist/cli/index.jsView file

Lines 1-32javascript

1/**

2 * CLI entry point — `bin/craftdriver` invokes this after compile.

3 *

4 * Three modes:

5 *

6 * 1. `daemon start` — fork into a long-running daemon process.

7 * 2. `--ephemeral` — short-lived browser, read commands from stdin

8 * (one per line). Required for sandboxed cloud

9 * agents that can't keep a daemon between calls.

10 * 3. default — talk to the running daemon over the socket;

11 * auto-start one if none is up.

12 */

13import { spawn } from 'child_process';

14import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L12

15import { Browser } from '../lib/browser.js';

16import { ErrorCode } from '../lib/errors.js';

17import { createBrowserHandle, dispatch } from './dispatcher.js';

18import { parseArgv, HELP_TEXT } from './parseArgs.js';

19import { DaemonClient } from './client.js';

20import { runDaemon, toWireError } from './daemon.js';

21import { DAEMON_SOCKET_PATH } from './defaults.js';

22import { runInit, SUPPORTED_FLAVORS } from './init.js';

23import { runMcpServer } from './mcp/server.js';

24const VERSION = '0.1.0';

25export async function main(argv) {

26 const parsed = parseArgv(argv);

27 if (parsed === null) {

28 process.stdout.write(HELP_TEXT);

29 return 0;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.jsView on unpkg · L12

30 }

31 if (parsed.cmd === '__version__') {

32 process.stdout.write(VERSION + '\n');

dist/lib/driverManager.jsView file

Lines 1-39javascript

1/**

2 * Automatic driver resolution for Chrome and Firefox.

3 *

4 * Resolution chain (first match wins):

5 * 1. options.binaryPath (explicit)

6 * 2. CRAFTDRIVER_DRIVER_PATH

7 * 3. Legacy env vars (CHROMEDRIVER_PATH, SE_CHROMEDRIVER, etc.)

8 * 4. node_modules/.bin/chromedriver|geckodriver

9 * 5. PATH probe

10 * [CRAFTDRIVER_OFFLINE → throw here if no match yet]

11 * 6. System browser detect + driver-only download from CfT / GitHub

dist/lib/clock.jsView file

Lines 96-136javascript

96 earliest = t;

97 }

98 }

99 }

100 if (!earliest) break;

101

102 state.virtualNow = earliest.deadline;

103

104 if (earliest.interval !== null) {

bin/craftdriver.mjsView file

Lines 3-27javascript

3 * craftdriver — CLI entry shim.

4 *

5 * Resolves the compiled CLI in `dist/cli/index.js` and invokes its

6 * `main()`. If the dist tree is missing, fail with a clear message

7 * pointing at `npm run build` rather than a stack trace.

8 */

Source & flagged code

6 flagged · loading source

dist/cli/index.jsView file

12*/ L13: import { spawn } from 'child_process'; L14: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L12

12Cross-file remote execution chain: dist/cli/index.js spawns dist/lib/browser.js; helper contains network access plus dynamic code execution. L12: */ L13: import { spawn } from 'child_process'; L14: import { fileURLToPath } from 'url'; ... L27: if (parsed === null) { L28: process.stdout.write(HELP_TEXT); L29: return 0; ... L100: if (flags.headless === true) L101: process.env.HEADLESS = 'true'; L102: else if (flags.headless === false) ... L171: const dryRun = parsed.args['dry-run'] === true || parsed.args.dryRun === true; L172: const result = runInit({ flavor: flavor, cwd: process.cwd(), force, dryRun }); L173: const prefix = dryRun ? '[dry-run] ' : '';

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.jsView on unpkg · L12

dist/lib/driverManager.jsView file

186// if the cache path contains special characters. L187: const r = spawnSync('powershell', [ L188: '-NoProfile', '-Command',

High

Shell

Package source references shell execution.

dist/lib/driverManager.jsView on unpkg · L186

19import os from 'os'; L20: import https from 'https'; L21: import { spawnSync } from 'child_process'; L22: import { fileURLToPath } from 'url'; ... L25: function cacheDir() { L26: return process.env.CRAFTDRIVER_CACHE_DIR ?? path.join(os.homedir(), '.cache', 'craftdriver'); L27: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/lib/driverManager.jsView on unpkg · L19

dist/lib/clock.jsView file

116// eslint-disable-next-line no-new-func L117: new Function(earliest.fn)(); L118: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib/clock.jsView on unpkg · L116

bin/craftdriver.mjsView file

23L24: const mod = await import(pathToFileURL(distEntry).href); L25: const rc = await mod.main(process.argv.slice(2));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/craftdriver.mjsView on unpkg · L23

Findings

4 High4 Medium6 Low

HighChild Processdist/cli/index.js

HighShelldist/lib/driverManager.js

HighSame File Env Network Executiondist/lib/driverManager.js

HighCross File Remote Execution Contextdist/cli/index.js

MediumDynamic Requirebin/craftdriver.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/lib/clock.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/cli/index.jsView file

Lines 1-32javascript

1/**

2 * CLI entry point — `bin/craftdriver` invokes this after compile.

3 *

4 * Three modes:

5 *

6 * 1. `daemon start` — fork into a long-running daemon process.

7 * 2. `--ephemeral` — short-lived browser, read commands from stdin

8 * (one per line). Required for sandboxed cloud

9 * agents that can't keep a daemon between calls.

10 * 3. default — talk to the running daemon over the socket;

11 * auto-start one if none is up.

12 */

13import { spawn } from 'child_process';

14import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L12

15import { Browser } from '../lib/browser.js';

16import { ErrorCode } from '../lib/errors.js';

17import { createBrowserHandle, dispatch } from './dispatcher.js';

18import { parseArgv, HELP_TEXT } from './parseArgs.js';

19import { DaemonClient } from './client.js';

20import { runDaemon, toWireError } from './daemon.js';

21import { DAEMON_SOCKET_PATH } from './defaults.js';

22import { runInit, SUPPORTED_FLAVORS } from './init.js';

23import { runMcpServer } from './mcp/server.js';

24const VERSION = '0.1.0';

25export async function main(argv) {

26 const parsed = parseArgv(argv);

27 if (parsed === null) {

28 process.stdout.write(HELP_TEXT);

29 return 0;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.jsView on unpkg · L12

30 }

31 if (parsed.cmd === '__version__') {

32 process.stdout.write(VERSION + '\n');

dist/lib/driverManager.jsView file

Lines 1-39javascript

1/**

2 * Automatic driver resolution for Chrome and Firefox.

3 *

4 * Resolution chain (first match wins):

5 * 1. options.binaryPath (explicit)

6 * 2. CRAFTDRIVER_DRIVER_PATH

7 * 3. Legacy env vars (CHROMEDRIVER_PATH, SE_CHROMEDRIVER, etc.)

8 * 4. node_modules/.bin/chromedriver|geckodriver

9 * 5. PATH probe

10 * [CRAFTDRIVER_OFFLINE → throw here if no match yet]

11 * 6. System browser detect + driver-only download from CfT / GitHub

dist/lib/clock.jsView file

Lines 96-136javascript

96 earliest = t;

97 }

98 }

99 }

100 if (!earliest) break;

101

102 state.virtualNow = earliest.deadline;

103

104 if (earliest.interval !== null) {

bin/craftdriver.mjsView file

Lines 3-27javascript

3 * craftdriver — CLI entry shim.

4 *

5 * Resolves the compiled CLI in `dist/cli/index.js` and invokes its

6 * `main()`. If the dist tree is missing, fail with a clear message

7 * pointing at `npm run build` rather than a stack trace.

8 */

Lines 166-206javascript

166 resolve(httpsDownload(location, dest, depth + 1));

167 return;

168 }

169 if (res.statusCode !== 200) {

170 reject(new Error(`HTTP ${res.statusCode} downloading from ${url}`));

171 return;

172 }

173 const out = fs.createWriteStream(dest);

174 res.pipe(out);

175 out.on('finish', () => out.close((err) => err ? reject(err) : resolve()));

176 out.on('error', reject);

177 res.on('error', reject);

178 }).on('error', reject);

179 });

180}

181// ─── Archive extraction ───────────────────────────────────────────────────────

182function extractZip(zipPath, destDir) {

183 fs.mkdirSync(destDir, { recursive: true });

184 if (os.platform() === 'win32') {

185 // Pass path and destination as separate arguments to avoid string injection

186 // if the cache path contains special characters.

187 const r = spawnSync('powershell', [

188 '-NoProfile', '-Command',

High

Shell

Package source references shell execution.

dist/lib/driverManager.jsView on unpkg · L186

189 'Expand-Archive',

190 '-Force',

191 '-Path', zipPath,

192 '-DestinationPath', destDir,

193 ], { stdio: ['ignore', 'pipe', 'pipe'] });

194 if (r.status !== 0) {

195 throw new Error(`Zip extraction failed: ${String(r.stderr)}`);

196 }

197 }

198 else {

199 const r = spawnSync('unzip', ['-o', '-q', zipPath, '-d', destDir], {

200 stdio: ['ignore', 'pipe', 'pipe'],

201 });

202 if (r.status !== 0) {

203 throw new Error(`unzip failed: ${String(r.stderr)}`);

204 }

205 }

206}