Loading npm security reports…

sibyl-test@1.0.10: Suspicious npm security report (Warn) | LPM Firewall

registry / sibyl-test / 1.0.10

sibyl-test@1.0.10

A lightweight, zero-dependency browser testing framework built on Web Components

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 46.3 KB of source, external domains: cdn.jsdelivr.net

Source & flagged code

4 flagged

bin/sb-test.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

3import { program } from "commander";

4import { spawn } from "child_process";

5import path from "path";

High

Child Process

Package source references child process execution.

bin/sb-test.jsView on unpkg · L3

6import fs from "fs";

7import { createRequire } from "module";

8import { generateTestHtml, generateSingleTestHtml } from "../scripts/generate-test-html.js";

9import { runTests } from "../scripts/run-tests.js";

11const require = createRequire(import.meta.url);

12const pkg = require("../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/sb-test.jsView on unpkg · L10

14async function installDependencies() {

15 console.log("Installing Playwright browsers...");

17 return new Promise((resolve, reject) => {

18 const child = spawn("npx", ["playwright", "install", "webkit", "chromium"], {

19 stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/sb-test.jsView on unpkg · L17

20 shell: true

21 });

High

Shell

Package source references shell execution.

bin/sb-test.jsView on unpkg · L19

23 child.on("close", (code) => {

24 if (code === 0) {

25 console.log("Playwright browsers installed successfully!");

26 resolve();

27 } else {

28 reject(new Error(`Playwright installation failed with code ${code}`));

29 }

30 });

32 child.on("error", (err) => {

33 reject(err);

34 });

35 });

36}

38async function installSelenium() {

39 console.log("Checking Firefox and Selenium setup...");

Source & flagged code

4 flagged · loading source

bin/sb-test.jsView file

3import { program } from "commander"; L4: import { spawn } from "child_process"; L5: import path from "path";

High

Child Process

Package source references child process execution.

bin/sb-test.jsView on unpkg · L3

19stdio: "inherit", L20: shell: true L21: });

High

Shell

Package source references shell execution.

bin/sb-test.jsView on unpkg · L19

17return new Promise((resolve, reject) => { L18: const child = spawn("npx", ["playwright", "install", "webkit", "chromium"], { L19: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/sb-test.jsView on unpkg · L17

10L11: const require = createRequire(import.meta.url); L12: const pkg = require("../package.json");

Medium

Dynamic Require

Findings

3 High4 Medium4 Low

HighChild Processbin/sb-test.js

HighShellbin/sb-test.js

HighRuntime Package Installbin/sb-test.js

MediumDynamic Requirebin/sb-test.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings