registry / lexauto-framework / 1.1.8

lexauto-framework@1.1.8

To make it easy for you to get started with GitLab, here's a list of recommended next steps.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 38 file(s), 291 KB of source, external domains: api.anthropic.com, api.groq.com, api.openai.com, generativelanguage.googleapis.com

Source & flagged code

9 flagged

reports/test-execution-report.jsonView file

Lines 17-63json

17 {

18 "testCaseName": "TC_TestApis-Dataset 1",

19 "browser": "API",

20 "mode": "API",

21 "totalSteps": "2",

22 "finalStatus": "PASS",

23 "steps": [],

24 "apis": [

25 {

26 "name": "API Automation > GetAccessToken",

27 "status": "PASS",

28 "message": "POST https://dummyjson.com/auth/login -> 200",

29 "timestamp": "2026-06-17T14:14:43.683Z",

30 "method": "POST",

31 "endpoint": "https://dummyjson.com/auth/login",

32 "authType": "No Auth",

33 "responseTime": "1160ms",

34 "bodyRaw": "{\n \"username\": \"emilys\",\n \"password\": \"emilyspass\"\n}",

35 "requestBody": "{\n \"username\": \"emilys\",\n \"password\": \"emilyspass\"\n}",

36 "bodyType": "raw",

37 "responseBody": "{\"accessToken\":\"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwidXNlcm5hbWUiOiJlbWlseXMiLCJlbWFpbCI6ImVtaWx5LmpvaG5zb25AeC5kdW1teWpzb24uY29tIiwiZmlyc3ROYW1lIjoiRW1pbHkiLCJsYXN0TmFtZSI6IkpvaG5zb24iLCJnZW5kZXIiOiJmZW1hbGUiLCJpbWFnZSI6Imh0dHBzOi8vZHVtbXlqc29uLmNvbS9pY29uL2VtaWx5cy8xMjgiLCJpYXQiOjE3ODE3MDU2ODMsImV4cCI6MTc4MTcwOTI4M30.1FfqrypNn697TG0N6C99_84LLtWQ6yaapprXZ4hGNjs\",\"refreshToken\":\"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwidXNlcm5hbWUiOiJlbWlseXMiLCJlbWFpbCI6ImVtaWx5LmpvaG5zb25AeC5kdW1teWpzb24uY29tIiwiZmlyc3ROYW1lIjoiRW1pbHkiLCJsYXN0TmFtZSI6I ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

reports/test-execution-report.jsonView on unpkg · L37

Critical

Secret Pattern

Supabase service role key (JWT) in reports/test-execution-report.json

reports/test-execution-report.jsonView on unpkg · L37

38 "statusCode": 200,

39 "responseHeaders": "{\"date\":\"Wed, 17 Jun 2026 14:14:43 GMT\",\"content-type\":\"application/json; charset=utf-8\",\"transfer-encoding\":\"chunked\",\"connection\":\"keep-alive\",\"access-control-allow-credentials\":\"true\",\"etag\":\"W/\\\"3a2-+Ys+6sUI+6wO0gREurI33eV54v4\\\"\",\"set-cookie\":\"accessToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwidXNlcm5hbWUiOiJlbWlseXMiLCJlbWFpbCI6ImVtaWx5LmpvaG5zb25AeC5kdW1teWpzb24uY29tIiwiZmlyc3ROYW1lIjoiRW1pbHkiLCJsYXN0TmFtZSI6IkpvaG5zb24iLCJnZW5kZXIiOiJmZW1hbGUiLCJpbWFnZSI6Imh0dHBzOi8vZHVtbXlqc29uLmNvbS9pY29uL2VtaWx5cy8xMjgiLCJpYXQi ...

Critical

Secret Pattern

Supabase service role key (JWT) in reports/test-execution-report.json

reports/test-execution-report.jsonView on unpkg · L39

40 "savedParams": [

41 {

42 "key": "accessToken",

43 "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwidXNlcm5hbWUiOiJlbWlseXMiLCJlbWFpbCI6ImVtaWx5LmpvaG5zb25AeC5kdW1teWpzb24uY29tIiwiZmlyc3ROYW1lIjoiRW1pbHkiLCJsYXN0TmFtZSI6IkpvaG5zb24iLCJnZW5kZXIiOiJmZW1hbGUiLCJpbWFnZSI6Imh0dHBzOi8vZHVtbXlqc29uLmNvbS9pY29uL2VtaWx5cy8xMjgiLCJpYXQiOjE3ODE3MDU2ODMsImV4cCI6MTc4MTcwOTI4M30.1FfqrypNn697TG0N6C99_84LLtWQ6yaapprXZ4hGNjs"

Critical

Secret Pattern

Supabase service role key (JWT) in reports/test-execution-report.json

reports/test-execution-report.jsonView on unpkg · L43

44 }

45 ]

46 },

47 {

48 "name": "API Automation > CheckAuthentication",

49 "status": "PASS",

50 "message": "GET https://dummyjson.com/auth/me -> 200",

51 "timestamp": "2026-06-17T14:14:43.908Z",

52 "method": "GET",

53 "endpoint": "https://dummyjson.com/auth/me",

54 "authType": "Bearer Token",

55 "responseTime": "189ms",

56 "bodyRaw": null,

57 "requestBody": null,

58 "bodyType": "none",

59 "responseBody": "{\"id\":1,\"firstName\":\"Emily\",\"lastName\":\"Johnson\",\"maidenName\":\"Smith\",\"age\":29,\"gender\":\"female\",\"email\":\"emily.johnson@x.dummyjson.com\"

60 "statusCode": 200,

61 "responseHeaders": "{\"date\":\"Wed, 17 Jun 2026 14:14:43 GMT\",\"content-type\":\"application/json; charset=utf-8\",\"transfer-encoding\":\"chunked\",\"connection\":\"keep-alive\",\"access-control-allow-credentials\":\"true\",\"etag\":\"W/\\\"58f-CoL/KoXlW3x1PtqQr3wqPsXj6DE\\\"\",\"strict-transport-security\":\"max-age=15552000; includeSubDomains\",\"vary\":\"Origin, Accept-Encoding\",\"x-content-type-options\":\"nosniff\",\"x-dns-prefetch-control\":\"off\",\"x-download-options\":\"noopen\",\"x-frame-options\":\"SAMEORIGIN\",\"x-ratelimit-limit\":\"100\",\"x-ratelimit-remaining\": ...

62 }

63 ]

Long lines were clipped for display.

dist/keywords/KeywordExecutor.jsView file

Lines 1076-1116javascript

1076 CustomActions = module.CustomActions;

1077 }

1078 catch (e) {

1079 throw new Error(`CustomActions file not found at src/custom/CustomActions.ts`);

1080 }

1081 const method =

dist/runner/ApiTestRunner.jsView file

Lines 1-26javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty

playwright.zipView file

•path = playwright.zip kind = high_entropy_blob sizeBytes = 196041 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

playwright.zipView on unpkg

•path = playwright.zip kind = compressed_blob sizeBytes = 196041 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

playwright.zipView on unpkg

•path = playwright.zip kind = nested_archive_needs_inspection sizeBytes = 196041 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

playwright.zipView on unpkg

Source & flagged code

9 flagged · loading source

reports/test-execution-report.jsonView file

37patternName = supabase_service_key severity = critical line = 37 matchedText = "respons..."}",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

reports/test-execution-report.jsonView on unpkg · L37

37patternName = supabase_service_key severity = critical line = 37 matchedText = "respons..."}",

Critical

Secret Pattern

Supabase service role key (JWT) in reports/test-execution-report.json

reports/test-execution-report.jsonView on unpkg · L37

39patternName = supabase_service_key severity = critical line = 39 matchedText = "respons..."}",

Critical

Secret Pattern

Supabase service role key (JWT) in reports/test-execution-report.json

reports/test-execution-report.jsonView on unpkg · L39

43patternName = supabase_service_key severity = critical line = 43 matchedText = "value":...Njs"

Critical

Secret Pattern

Supabase service role key (JWT) in reports/test-execution-report.json

reports/test-execution-report.jsonView on unpkg · L43

dist/keywords/KeywordExecutor.jsView file

1096else if (codeBlock && codeBlock.trim().length > 0) { L1097: const fn = new Function('page', 'context', 'DataStore', 'WebUtility', `return (async () => { L1098: ${codeBlock}

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/keywords/KeywordExecutor.jsView on unpkg · L1096

dist/runner/ApiTestRunner.jsView file

6exports.runApiTests = runApiTests; L7: const fs_1 = __importDefault(require("fs")); L8: const path_1 = __importDefault(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runner/ApiTestRunner.jsView on unpkg · L6

playwright.zipView file

•path = playwright.zip kind = high_entropy_blob sizeBytes = 196041 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

playwright.zipView on unpkg

•path = playwright.zip kind = compressed_blob sizeBytes = 196041 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

playwright.zipView on unpkg

•path = playwright.zip kind = nested_archive_needs_inspection sizeBytes = 196041 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

playwright.zipView on unpkg

Findings

4 Critical1 High5 Medium7 Low

CriticalCritical Secretreports/test-execution-report.json

CriticalSecret Patternreports/test-execution-report.json

HighShips High Entropy Blobplaywright.zip

MediumDynamic Requiredist/runner/ApiTestRunner.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobplaywright.zip

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/keywords/KeywordExecutor.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionplaywright.zip

LowNo License

Source & flagged code

9 flagged

reports/test-execution-report.jsonView file

Lines 17-63json

17 {

18 "testCaseName": "TC_TestApis-Dataset 1",

19 "browser": "API",

20 "mode": "API",

21 "totalSteps": "2",

22 "finalStatus": "PASS",

23 "steps": [],

24 "apis": [

25 {

26 "name": "API Automation > GetAccessToken",

27 "status": "PASS",

28 "message": "POST https://dummyjson.com/auth/login -> 200",

29 "timestamp": "2026-06-17T14:14:43.683Z",

30 "method": "POST",

31 "endpoint": "https://dummyjson.com/auth/login",

32 "authType": "No Auth",

33 "responseTime": "1160ms",

34 "bodyRaw": "{\n \"username\": \"emilys\",\n \"password\": \"emilyspass\"\n}",

35 "requestBody": "{\n \"username\": \"emilys\",\n \"password\": \"emilyspass\"\n}",

36 "bodyType": "raw",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

reports/test-execution-report.jsonView on unpkg · L37

Critical

Secret Pattern

Supabase service role key (JWT) in reports/test-execution-report.json

reports/test-execution-report.jsonView on unpkg · L37

38 "statusCode": 200,

Critical

Secret Pattern

Supabase service role key (JWT) in reports/test-execution-report.json

reports/test-execution-report.jsonView on unpkg · L39

40 "savedParams": [

41 {

42 "key": "accessToken",

Critical

Secret Pattern

Supabase service role key (JWT) in reports/test-execution-report.json

reports/test-execution-report.jsonView on unpkg · L43

44 }

45 ]

46 },

47 {

48 "name": "API Automation > CheckAuthentication",

49 "status": "PASS",

50 "message": "GET https://dummyjson.com/auth/me -> 200",

51 "timestamp": "2026-06-17T14:14:43.908Z",

52 "method": "GET",

53 "endpoint": "https://dummyjson.com/auth/me",

54 "authType": "Bearer Token",

55 "responseTime": "189ms",

56 "bodyRaw": null,

57 "requestBody": null,

58 "bodyType": "none",

59 "responseBody": "{\"id\":1,\"firstName\":\"Emily\",\"lastName\":\"Johnson\",\"maidenName\":\"Smith\",\"age\":29,\"gender\":\"female\",\"email\":\"emily.johnson@x.dummyjson.com\"

60 "statusCode": 200,

62 }

63 ]

Long lines were clipped for display.

dist/keywords/KeywordExecutor.jsView file

Lines 1076-1116javascript

1076 CustomActions = module.CustomActions;

1077 }

1078 catch (e) {

1079 throw new Error(`CustomActions file not found at src/custom/CustomActions.ts`);

1080 }

1081 const method =

dist/runner/ApiTestRunner.jsView file

Lines 1-26javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty

playwright.zipView file

•path = playwright.zip kind = high_entropy_blob sizeBytes = 196041 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

playwright.zipView on unpkg

•path = playwright.zip kind = compressed_blob sizeBytes = 196041 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

playwright.zipView on unpkg

•path = playwright.zip kind = nested_archive_needs_inspection sizeBytes = 196041 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

playwright.zipView on unpkg