registry / Credential exfiltration / qa-foundry
qa-foundry
QA Foundry - AI-Powered QA Automation Platform. Record tests, generate with AI, run Playwright tests, review with HITL, track results.
This report shows the evidence for qa-foundry@0.2.6. 1 of 4 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe auth-codegen fallback sends a recorded login script that may contain target-site credentials to Gemini when regex extraction is incomplete. This is credential disclosure to a service unrelated to those credentials, so the package should be blocked.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
When an authenticated user stops auth-codegen and regex extraction misses a username or password.
Impact
Login values recorded for the target site may be exposed to Google’s Generative AI service.
Mechanism
The package includes the recorded Playwright script in a credential-extraction prompt and sends it to Gemini; the response is returned as credentials.
Attack narrative
When auth-codegen finishes, the package reads the recorded Playwright script. If regex extraction misses either login field, it sends the script in a credential-extraction prompt to Gemini, then returns the extracted values. The script may contain credentials intended for the tested site, so this fallback exposes them to a separate service without a specific consent step for sharing the login script.
AI rationale
The auth-codegen fallback sends a recorded login script that may contain target-site credentials to Gemini when regex extraction is incomplete. This is credential disclosure to a service unrelated to those credentials, so the package should be blocked.
Evidence
dist/controllers/generate.controller.jsdist/routes/generate.routes.jstest-runner/specs/auth_codegen_<sessionId>.spec.ts
Network endpoints1
Google Generative AI API via @google/generative-ai; hostname is not hard-coded in the package.
Decision evidence
public snapshotAI called this Malicious at 87.0% confidence as Malware with low false-positive risk.
Evidence for block
- The credential-extraction prompt includes the recorded Playwright script, which can contain login values.
- When regex extraction misses either field, auth-codegen calls the AI fallback with that script.
- The fallback sends its prompt to Gemini and returns the extracted credentials.
Evidence against
- The route is behind authentication and role-based access control, and the flow is explicitly for capturing login credentials.
- The package’s postinstall installs Playwright browsers, which fits its browser-testing purpose.
- The Gemini API key is passed to Google’s own Generative AI SDK service.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedProtestwareTelemetryUrlStrings
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node -e "if (!process.env.QA_FOUNDRY_SKIP_BROWSER_INSTALL) require('child_process').execSync('npx playwright install --with-deps chromium firefox webkit', {stdio:'inherit', cwd:__d...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "if (!process.env.QA_FOUNDRY_SKIP_BROWSER_INSTALL) require('child_process').execSync('npx playwright install --with-deps chromium firefox webkit', {stdio:'inherit', cwd:__d...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/cli.jsView file
11const fs = require('fs');
L12: const { spawn } = require('child_process');
L13:
High
Child Process
Package source references child process execution.
Findings
1 Critical6 High5 Medium6 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/cli.js
HighSame File Env Network Executiondist/frontend/assets/index-Dp2Bk49z.js
HighCross File Remote Execution Contextbin/cli.js
HighRuntime Package Installdist/index.js
HighSemantic Analysis Limiteddist/services/AgentPlannerService.js#virtual:normalized:round1
MediumDynamic Requirebin/server.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to qa-foundry@0.2.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing qa-foundry@0.2.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.