playwright-email@0.3.0: Suspicious npm security report (Warn)

Loading npm security reports…

playwright-email@0.3.0: Suspicious npm security report (Warn) | LPM Firewall

dist/chunk-3JWEIFI7.jsView file

Lines 95-135javascript

95 });

96 if (!res.ok) return void 0;

97 const release = await res.json();

98 const digest = release.assets?.find((a) => a.name === asset)?.digest;

99 return digest?.startsWith("sha256:") ? digest.slice("sha256:".length) : void 0;

100 } catch {

101 return void 0;

102 }

103}

104async function download(url, dest) {

105 const res = await fetch(url, { redirect: "follow" });

106 if (!res.ok || !res.body) {

107 throw new Error(`playwright-email: failed to download Mailpit from ${url} (HTTP ${res.status})`);

108 }

109 await pipeline(Readable.fromWeb(res.body), createWriteStream(dest));

110}

111function extract(archivePath, destDir) {

112 const tar = spawnSync("tar", ["-xf", archivePath, "-C", destDir], { encoding: "utf8" });

113 if (tar.status === 0) return;

114 if (process.platform === "win32" && archivePath.endsWith(".zip")) {

115 const ps = spawnSync(

116 "powershell.exe",

117 ["-NoProfile", "-Command", `Expand-Archive -LiteralPath "${archivePath}" -DestinationPath "${destDir}" -Force`],

High

Shell

Package source references shell execution.

dist/chunk-3JWEIFI7.jsView on unpkg · L115

118 { encoding: "utf8" }

119 );

120 if (ps.status === 0) return;

121 throw new Error(`playwright-email: failed to extract ${archivePath}: ${ps.stderr || tar.stderr}`);

122 }

123 throw new Error(`playwright-email: failed to extract ${archivePath}: ${tar.stderr ?? "tar not found"}`);

124}

125async function ensureMailpit(opts = {}) {

126 if (process.env.PLAYWRIGHT_EMAIL_BINARY) {

127 const custom = process.env.PLAYWRIGHT_EMAIL_BINARY;

128 try {

129 await stat(custom);

130 } catch {

131 throw new Error(`playwright-email: PLAYWRIGHT_EMAIL_BINARY points to "${custom}" but no file exists there`);

132 }

133 return custom;

134 }

135 const version = opts.version ?? DEFAULT_MAILPIT_VERSION;

Lines 278-318javascript

278 To: body.To ?? "",

279 SubmittedAt: (/* @__PURE__ */ new Date()).toISOString(),

280 MessageID: id,

281 ErrorCode: 0,

282

playwright-email@0.3.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code