fast-playwright
Fail
Audited by Socket on Mar 7, 2026
1 alert found:
Obfuscated FileObfuscated Filescripts/install.js
HIGHObfuscated FileHIGH
scripts/install.js
The script itself is benign and intended for developer convenience, but it synchronously executes package manager commands that contact the network and can run arbitrary lifecycle/install scripts. The primary security risk is supply-chain execution: if dependencies, lockfiles, or the registry are compromised, this script will execute that malicious code. Run installs in a controlled/sandboxed environment, validate lockfiles and registry sources, and avoid unattended execution of this script in untrusted contexts.
Confidence: 98%
Audit Metadata