registry / craftdriver / 1.7.0

craftdriver@1.7.0

Modern WebDriver automation library for NodeJS

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 78 file(s), 696 KB of source, external domains: 127.0.0.1, api.github.com, example.com, googlechromelabs.github.io, www.npmjs.com

Source & flagged code

9 flagged

dist/cli/index.jsView file

Lines 1-32javascript

1/**

2 * CLI entry point — `bin/craftdriver` invokes this after compile.

3 *

4 * Three modes:

5 *

6 * 1. `daemon start` — fork into a long-running daemon process.

7 * 2. `--ephemeral` — short-lived browser, read commands from stdin

8 * (one per line). Required for sandboxed cloud

9 * agents that can't keep a daemon between calls.

10 * 3. default — talk to the running daemon over the socket;

11 * auto-start one if none is up.

12 */

13import { spawn } from 'child_process';

14import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L12

15import { Browser } from '../lib/browser.js';

16import { ErrorCode } from '../lib/errors.js';

17import { createBrowserHandle, dispatch } from './dispatcher.js';

18import { parseArgv, HELP_TEXT } from './parseArgs.js';

19import { DaemonClient } from './client.js';

20import { runDaemon, toWireError } from './daemon.js';

21import { DAEMON_SOCKET_PATH } from './defaults.js';

22import { runInit, SUPPORTED_FLAVORS } from './init.js';

23import { runMcpServer } from './mcp/server.js';

24const VERSION = '0.1.0';

25export async function main(argv) {

26 const parsed = parseArgv(argv);

27 if (parsed === null) {

28 process.stdout.write(HELP_TEXT);

29 return 0;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.jsView on unpkg · L12

30 }

31 if (parsed.cmd === '__version__') {

32 process.stdout.write(VERSION + '\n');

dist/lib/electronDeeplink.jsView file

Lines 39-79javascript

39 */

40export function appendUserDataDir(url, userDataDir) {

41 const parsed = new URL(url);

42 parsed.searchParams.

dist/lib/clock.jsView file

Lines 96-136javascript

96 earliest = t;

97 }

98 }

99 }

100 if (!earliest) break;

101

102 state.virtualNow = earliest.deadline;

103

104

bin/craftdriver.mjsView file

Lines 3-27javascript

3 * craftdriver — CLI entry shim.

4 *

5 * Resolves the compiled CLI in `dist/cli/index.js` and invokes its

6 * `main()`. If the dist tree is missing, fail with a clear message

dist/lib/driverManager.jsView file

Lines 5-45javascript

5 * 1. options.binaryPath (explicit)

6 * 2. CRAFTDRIVER_DRIVER_PATH

7 * 3. Legacy env vars (CHROMEDRIVER_PATH, SE_CHROMEDRIVER, etc.)

docs/public/traces/vitest-login.zipView file

•path = docs/public/traces/vitest-login.zip kind = high_entropy_blob sizeBytes = 58409 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

docs/public/traces/vitest-login.zipView on unpkg

•path = docs/public/traces/vitest-login.zip kind = compressed_blob sizeBytes = 58409 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

docs/public/traces/vitest-login.zipView on unpkg

•path = docs/public/traces/vitest-login.zip kind = nested_archive_needs_inspection sizeBytes = 58409 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

docs/public/traces/vitest-login.zipView on unpkg

Source & flagged code

9 flagged · loading source

dist/cli/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code