registry / pi-agent-browser-native / 0.2.70

pi-agent-browser-native@0.2.70

pi extension that exposes agent-browser as a native tool for browser automation

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 101 file(s), 1.12 MB of source, external domains: 127.0.0.1, agent-browser.dev, api.exa.ai, api.search.brave.com, app.example.com, example.com, github.com, redacted.invalid, shop.example

Source & flagged code

5 flagged

dist/extensions/agent-browser/lib/runtime.jsView file

Lines 40-80javascript

40function isStringArray(value) {

41 return Array.isArray(value) && value.every((item) => typeof item === "string");

42}

43function shouldRedactQueryParam(name) {

44 return SENSITIVE_QUERY_PARAM_PATTERN.test(name) || isSensitiveFieldName(name);

45}

46function redactUrlToken(token) {

47 let parsed;

48 try {

49 parsed = new URL(token);

50 }

51 catch {

52 return token;

53 }

54 let mutated = false;

55 if (parsed.username.length > 0) {

56 parsed.username = "[REDACTED]";

57 mutated = true;

58 }

59 if (parsed.password.length > 0) {

60 parsed.password = "[REDACTED]";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/extensions/agent-browser/lib/runtime.jsView on unpkg · L60

61 mutated = true;

62 }

63 for (const [name] of parsed.searchParams) {

64 if (shouldRedactQueryParam(name)) {

65 parsed.searchParams.set(name, "[REDACTED]");

66 mutated = true;

67 }

68 }

69 const hashText = parsed.hash.startsWith("#") ? parsed.hash.slice(1) : parsed.hash;

70 if (hashText.includes("=")) {

71 const hashParams = new URLSearchParams(hashText);

72 for (const [name] of hashParams) {

73 if (shouldRedactQueryParam(name)) {

74 hashParams.set(name, "[REDACTED]");

75 mutated = true;

76 }

77 }

78 if (mutated) {

79 parsed.hash = `#${hashParams.toString()}`;

80 }

scripts/platform-smoke.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * Purpose: Provide the Crabbox-backed platform smoke CLI for pi-agent-browser-native releases.

4 * Responsibilities: Load the project platform smoke config, validate target/suite names, run doctor, and fan out target suites.

5 * Scope: Maintainer release verification only; target command rendering and artifact assertions live under scripts/platform-smoke/.

6 */

8import { createRequire } from "node:module";

scripts/platform-smoke/browser-dogfood-windows.ps1View file

•path = scripts/platform-smoke/browser-dogfood-windows.ps1 kind = build_helper sizeBytes = 7145 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/platform-smoke/browser-dogfood-windows.ps1View on unpkg

dist/extensions/agent-browser/lib/config.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = pi-agent-browser-native@0.2.69 matchedIdentity = npm:cGktYWdlbnQtYnJvd3Nlci1uYXRpdmU:0.2.69 similarity = 0.919 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/extensions/agent-browser/lib/config.jsView on unpkg

dist/extensions/agent-browser/lib/results/presentation/batch.jsView file

Lines 56-96javascript

56 totalCount: steps.length,

57 };

58}

59function hasModelFacingArgRedaction(args) {

60 return args?.some((arg) =>

Source & flagged code

5 flagged · loading source

dist/extensions/agent-browser/lib/runtime.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code