web-test

This module is a high-risk automation controller that executes attacker-supplied JavaScript via AsyncFunction and intentionally supplies powerful capabilities, including direct filesystem read/write and browser automation APIs, without authentication on its localhost execution endpoint. While it may be intended for legitimate automation, the design is equivalent to an unauthenticated local code-execution agent with strong data-manipulation potential, making it a serious security concern if the code input or local port is not tightly controlled.