registry / karma-accessibility-checker / 4.0.27

karma-accessibility-checker@4.0.27

A Karma plugin for Accessibility Testing.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

During a Karma scan, the package downloads a remote accessibility engine, caches it locally, and registers it for browser execution. npm lifecycle scripts also relocate and later delete a narrowly named project-level `karma-ibma` path.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install/uninstall, or loading the aChecker Karma framework

Impact

A compromised or changed engine response can execute in the Karma browser; lifecycle scripts can create or delete `karma-ibma` outside the package directory.

Mechanism

unpinned remote engine loading plus lifecycle filesystem relocation

Rationale

Source inspection disproves the scanner's implication of a concealed malicious payload, but confirms an unpinned remote-code-loading path and scoped lifecycle mutations. Downgrade to warn rather than block.

Evidence

package.jsontelemetry.ymlindex.jsbin/achecker_policies.jslib/ACEngineLoader.jslib/common/config/ACConfigManager.jslib/common/config/ACConstants.jslib/log/ACMetricsLogger.js../karma-ibma../../karma-ibma${tmpdir}/accessibility-checker/ace.js

Network endpoints4

cdn.jsdelivr.net/npm/accessibility-checker-engine@next/archives.jsoncdn.jsdelivr.net/npm/accessibility-checker-enginewww-api.ibm.com/ibm-telemetry/v1/metricsable.ibm.com/tools/api/pub/meter/v2

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

`lib/ACEngineLoader.js` fetches a remote `ace.js`, writes it to cache, then registers it for Karma loading.
`lib/common/config/ACConstants.js` defaults the engine source to jsDelivr and `processACConfig` uses the mutable `@next` archive channel.
`package.json` postinstall runs telemetry and copies `../karma-ibma` to `../../karma-ibma`; postuninstall deletes that project-level path.
No integrity or signature check is applied to the downloaded engine before it is served to the Karma browser.

Evidence against

`index.js` only registers local preprocessor, framework, and reporter modules when Karma loads it.
The package source contains no credential-path harvesting, shell spawning, eval/vm use, or AI-agent configuration writes.
`bin/achecker_policies.js` network access is explicit user CLI execution and only prints archive metadata.
`telemetry.yml` names an IBM telemetry endpoint, and README documents install-time telemetry and opt-out.

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 38 file(s), 3.20 MB of source, external domains: able.ibm.com, cdn.jsdelivr.net, www.ibm.com

Source & flagged code

3 flagged

package.jsonView file

Lines 1-28json

2 "name": "karma-accessibility-checker",

3 "version": "4.0.27",

4 "description": "A Karma plugin for Accessibility Testing.",

5 "main": "index.js",

6 "scripts": {

7 "test": "echo \"Error: no test specified\" && exit 1",

8 "postinstall": "ibmtelemetry --config=telemetry.yml ; node --eval \"var fs=require('fs-extra');var path = require('path');var karmaibmaRoot = path.resolve(__dirname, '..', 'karma-ibma');var karmaibmaMovePath = path.resolve(__dirname, '..', '..', 'karma-ibma');if (fs.existsSync(karmaibmaRoot)) { try { fs.copySync(karmaibmaRoot, karmaibmaMovePath);} catch (e) {fs.removeSync(karmaibmaMovePath)}}\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L8

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

9 "postuninstall": "node --eval \"var fs=require('fs-extra');var path=require('path');var karmaibmaRoot=path.resolve(__dirname, '..', '..', 'karma-ibma');if (fs.existsSync(karmaibmaRoot)) {fs.removeSync(karmaibmaRoot);}\""

10 },

11 "keywords": [

12 "ci",

13 "integration",

14 "continuous",

15 "karma-ibma",

16 "karma",

17 "karma-plugin",

18 "a11y",

19 "accessibility",

20 "IBMa",

21 "karma-framework",

22 "karma-reporter",

23 "karma-preprocessor"

24 ],

25 "author": "IBM Accessibility",

26 "license": "Apache-2.0",

27 "dependencies": {

28 "microdiff": "^1.5.0",

index.jsView file

Lines 22-57javascript

23 *******************************************************************************/

25/**

26 * This script contains the main loading mechanism, of the IBMa Scan engine into Karma.

27 * Script syntax is based on the format that the karma plugin loader takes in.

28 *

29 * Karma plugin loader requires the following:

30 * '<plugin type>:<plugin caller name>: ['', <loader, scripts that export>]

31 *

32 * Plugin Type: preprocessor, framework, launcher, reporter

33 * Plugin Caller Name: what ever you want to call it (IBMaScan)

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = ibmtelemetry --config=telemetry.yml ; node --eval "var fs=require('fs-extra');var path = require('path');var karmaibmaRoot = path.resolve(__dirname, '..', 'karma-ibma');var karmaib...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

42// Map the html2js preprocessor in the karma-ibma plugin, so that users do not need to install it seperatly. L43: //'preprocessor:html2js': require('karma-html2js-preprocessor')['preprocessor:html2js'], L44:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L42

Findings

1 Critical1 High4 Medium5 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

MediumDynamic Requireindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

package.jsonView file

Lines 1-28json

2 "name": "karma-accessibility-checker",

3 "version": "4.0.27",

4 "description": "A Karma plugin for Accessibility Testing.",

5 "main": "index.js",

6 "scripts": {

7 "test": "echo \"Error: no test specified\" && exit 1",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L8

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

10 },

11 "keywords": [

12 "ci",

13 "integration",

14 "continuous",

15 "karma-ibma",

16 "karma",

17 "karma-plugin",

18 "a11y",

19 "accessibility",

20 "IBMa",

21 "karma-framework",

22 "karma-reporter",

23 "karma-preprocessor"

24 ],

25 "author": "IBM Accessibility",

26 "license": "Apache-2.0",

27 "dependencies": {

28 "microdiff": "^1.5.0",

index.jsView file

Lines 22-57javascript

23 *******************************************************************************/

25/**

26 * This script contains the main loading mechanism, of the IBMa Scan engine into Karma.

27 * Script syntax is based on the format that the karma plugin loader takes in.

28 *

29 * Karma plugin loader requires the following:

30 * '<plugin type>:<plugin caller name>: ['', <loader, scripts that export>]

31 *

32 * Plugin Type: preprocessor, framework, launcher, reporter

33 * Plugin Caller Name: what ever you want to call it (IBMaScan)