tabwright@4.1.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

tabwright@4.1.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/network-inspector.jsView file

18patternName = generic_password severity = medium line = 18

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/network-inspector.jsView on unpkg · L18

dist/selector-generator.jsView file

5841} L5842: eval(expression) { L5843: return this.window.eval(expression);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/selector-generator.jsView on unpkg · L5841

dist/executor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = tabwright@3.5.0 matchedIdentity = npm:dGFid3JpZ2h0:3.5.0 similarity = 0.661 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/executor.jsView on unpkg

34const __dirname = path.dirname(__filename); L35: const require = createRequire(import.meta.url); L36: export class CodeExecutionTimeoutError extends Error {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/executor.jsView on unpkg · L34

33const __filename = fileURLToPath(import.meta.url); L34: const __dirname = path.dirname(__filename); L35: const require = createRequire(import.meta.url); ... L71: URL, L72: URLSearchParams, L73: fetch, ... L75: TextEncoder, L76: TextDecoder, L77: crypto, ... L148: const EXTENSION_NOT_CONNECTED_ERROR = `The Tabwright Chrome extension is not connected. Make sure you have: L149: 1. Installed the extension: https://chromewebstore.google.[redacted] L150: 2. Clicked the extension icon on a tab to enable it (or refreshed the page if just installed)

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/executor.jsView on unpkg · L33

dist/bippy.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bippy.js#virtual:normalized:round1View on unpkg

dist/browser-install.jsView file

•matchType = normalized_sha256 matchedPackage = tabwright@4.0.0 matchedPath = dist/browser-install.js matchedIdentity = npm:dGFid3JpZ2h0:4.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/browser-install.jsView on unpkg

dist/relay-client.jsView file

•matchType = normalized_sha256 matchedPackage = tabwright@4.0.0 matchedPath = dist/relay-client.js matchedIdentity = npm:dGFid3JpZ2h0:4.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/relay-client.jsView on unpkg

dist/bippy.jsView file

•matchType = normalized_sha256 matchedPackage = tabwright@4.0.0 matchedPath = dist/bippy.js matchedIdentity = npm:dGFid3JpZ2h0:4.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bippy.jsView on unpkg

dist/extension/background.jsView file

•matchType = normalized_sha256 matchedPackage = tabwright@4.0.0 matchedPath = dist/extension/background.js matchedIdentity = npm:dGFid3JpZ2h0:4.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/extension/background.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 61-91json

61 "diff": "^8.0.2",

62 "dom-accessibility-api": "^0.7.1",

63 "goke": "^6.12.1",

64 "hono": "^4.12.12",

65 "picocolors": "^1.1.1",

66 "posthtml": "^0.16.7",

67 "posthtml-beautify": "^0.7.0",

68 "string-dedent": "^3.0.2",

69 "strip-ansi": "^7.1.2",

70 "ws": "^8.18.3",

71 "zod": "^4.3.5",

72 "zustand": "^5.0.8",

73 "@xmorse/playwright-core": "^1.59.10"

74 },

75 "optionalDependencies": {

76 "@playwriter/patchright-core": "^1.61.0-playwriter.1",

77 "sharp": "^0.34.5"

78 },

79 "scripts": {

80 "build": "rm -rf dist *.tsbuildinfo && mkdir dist && bun scripts/build-client-bundles.ts && tsc -p tsconfig-build.json && bun scripts/build-extension-bundle.ts && bun scripts/build-resources.ts",

81 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L81

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L81

82 "watch": "tsc -w",

83 "cli": "vite-node src/cli.ts",

84 "typecheck": "tsc --noEmit",

85 "mcp": "vite-node src/mcp.ts",

86 "test": "vitest run --no-file-parallelism",

87 "test:unit": "vitest run src/executor.unit.test.ts src/network-inspector.test.ts src/cdp-resources.test.ts src/cdp-log.test.ts src/editor.test.ts src/wakaru.test.ts src/documentation.test.ts src/cli-help.test.ts src/skill-stub.test.ts src/tabwright-agent-skill.test.ts src/relay-state.test.ts src/protocol.test.ts src/retired-features.test.ts src/doctor.test.ts src/scoped-fs.test.ts",

88 "test:acceptance": "vitest run src/agent-debugging.test.ts src/cdp-resources.browser.test.ts --no-file-parallelism",

89 "test:watch": "vitest"

90 }

91}

dist/network-inspector.jsView file

Lines 1-38javascript

1import { getCDPResources } from './cdp-resources.js';

2const SENSITIVE_NAME = /cookie|auth|token|secret|api[-_]?key|session|csrf|xsrf|password/i

dist/selector-generator.jsView file

Lines 5821-5861javascript

5821 setBrowserName(browserName);

5822 this._setupGlobalListenersRemovalDetection();

5823 this._setupHitTargetInterceptors();

5824 if (isUnderTest)

5825 this.window.__injectedScript =

dist/executor.jsView file

Lines 13-54javascript

13import vm from 'node:vm';

14import * as acorn from 'acorn';

15import { createSmartDiff } from './diff-utils.js';

16import { getCdpUrl, parseRelayHost, shouldAutoEnableTabwright }

dist/bippy.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bippy.js#virtual:normalized:round1View on unpkg

dist/browser-install.jsView file

•matchType = normalized_sha256 matchedPackage = tabwright@4.0.0 matchedPath = dist/browser-install.js matchedIdentity = npm:dGFid3JpZ2h0:4.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/browser-install.jsView on unpkg

dist/relay-client.jsView file

•matchType = normalized_sha256 matchedPackage = tabwright@4.0.0 matchedPath = dist/relay-client.js matchedIdentity = npm:dGFid3JpZ2h0:4.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/relay-client.jsView on unpkg

dist/bippy.jsView file

•matchType = normalized_sha256 matchedPackage = tabwright@4.0.0 matchedPath = dist/bippy.js matchedIdentity = npm:dGFid3JpZ2h0:4.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bippy.jsView on unpkg

dist/extension/background.jsView file

•matchType = normalized_sha256 matchedPackage = tabwright@4.0.0 matchedPath = dist/extension/background.js matchedIdentity = npm:dGFid3JpZ2h0:4.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/extension/background.jsView on unpkg