registry / selenium-pw-migrator / 0.0.2-preview.1

selenium-pw-migrator@0.0.2-preview.1

Node/npm wrapper for the Selenium Playwright Migrator standalone CLI.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 10.7 KB of source, external domains: github.com

Source & flagged code

6 flagged

package.jsonView file

Lines 1-32json

2 "name": "selenium-pw-migrator",

3 "version": "0.0.2-preview.1",

4 "description": "Node/npm wrapper for the Selenium Playwright Migrator standalone CLI.",

5 "license": "MIT",

6 "homepage":

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/selenium-pw-migrator.jsView file

3L4: const childProcess = require('child_process'); L5: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/selenium-pw-migrator.jsView on unpkg · L3

3L4: const childProcess = require('child_process'); L5: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/selenium-pw-migrator.jsView on unpkg · L3

scripts/install.jsView file

3L4: const childProcess = require('child_process'); L5: const crypto = require('crypto'); L6: const fs = require('fs'); L7: const http = require('http'); L8: const https = require('https'); ... L15: L16: const env = process.env; L17: const skipDownload = isTruthy(readOption('SELENIUM_PW_MIGRATOR_SKIP_DOWNLOAD', 'selenium-pw-migrator-skip-download'));

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/install.jsView on unpkg · L3

•matchType = previous_version_dangerous_delta matchedPackage = selenium-pw-migrator@0.0.0-preview.8 matchedIdentity = npm:c2VsZW5pdW0tcHctbWlncmF0b3I:0.0.0-preview.8 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/install.jsView on unpkg

Findings

4 High5 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/selenium-pw-migrator.js

HighSame File Env Network Executionscripts/install.js

HighPrevious Version Dangerous Deltascripts/install.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/selenium-pw-migrator.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

bin/selenium-pw-migrator.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2'use strict';

4const childProcess = require('child_process');

5const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/selenium-pw-migrator.jsView on unpkg · L3

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/selenium-pw-migrator.jsView on unpkg · L3

6const path = require('path');

8const packageRoot = path.resolve(__dirname, '..');

9const SUPPORTED_RUNTIMES = new Set(['win-x64', 'linux-x64', 'osx-x64', 'osx-arm64']);

10const runtime = validateRuntime(process.env.SELENIUM_PW_MIGRATOR_RUNTIME || resolveRuntime());

11const exeName = runtime.startsWith('win-') ? 'selenium-pw-migrator.exe' : 'selenium-pw-migrator';

12const explicitInstallDir = process.env.SELENIUM_PW_MIGRATOR_INSTALL_DIR || '';

13const binaryPath = explicitInstallDir

14 ? path.join(explicitInstallDir, exeName)

15 : path.join(packageRoot, 'native', runtime, exeName);

17if (!fs.existsSync(binaryPath)) {

18 const installer = path.join(packageRoot, 'scripts', 'install.js');

19 const installResult = childProcess.spawnSync(process.execPath, [installer], { stdio: 'inherit' });

20 if (installResult.error) throw installResult.error;

21 if (installResult.status !== 0) process.exit(installResult.status || 1);

22}

scripts/install.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2'use strict';

4const childProcess = require('child_process');

5const crypto = require('crypto');

6const fs = require('fs');

7const http = require('http');

8const https = require('https');

9const os = require('os');

10const path = require('path');

12const packageRoot = path.resolve(__dirname, '..');

13const packageJson = require(path.join(packageRoot, 'package.json'));

14const SUPPORTED_RUNTIMES = new Set(['win-x64', 'linux-x64', 'osx-x64', 'osx-arm64']);

16const env = process.env;

17const skipDownload = isTruthy(readOption('SELENIUM_PW_MIGRATOR_SKIP_DOWNLOAD', 'selenium-pw-migrator-skip-download'));

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/install.jsView on unpkg · L3

18const version = readOption('SELENIUM_PW_MIGRATOR_VERSION', 'selenium-pw-migrator-version') || packageJson.version;

19const runtime = validateRuntime(readOption('SELENIUM_PW_MIGRATOR_RUNTIME', 'selenium-pw-migrator-runtime') || resolveRuntime());

20const baseUrlOverride = readOption('SELENIUM_PW_MIGRATOR_BASE_URL', 'selenium-pw-migrator-base-url');

21const baseUrl = normalizeBaseUrl(baseUrlOverride || `https://github.com/AlexanderLevenskikh/selenium-playwright-ast-migrator/releases/download/v${version}`);

22const archivePathOverride = readOption('SELENIUM_PW_MIGRATOR_ARCHIVE_PATH', 'selenium-pw-migrator-archive-path') || '';

23const checksumsPathOverride = readOption('SELENIUM_PW_MIGRATOR_CHECKSUMS_PATH', 'selenium-pw-migrator-checksums-path') || '';

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/install.jsView on unpkg