Playwright Browser Automation
Warn
Audited by Socket on Aug 29, 2026
1 alert found:
SecuritySecurityrun.js
MEDIUMSecurityMEDIUM
run.js
No overt hidden malware payload is visible in this snippet, but it is inherently high-risk: it reads attacker-controlled JavaScript from argv/stdin or a file, writes it to disk, and executes it via require() with full Node privileges. It also auto-runs npm/npx commands to install Playwright and Chromium when missing, increasing supply-chain and execution risk. This should only be used in trusted environments with trusted input, or redesigned with sandboxing and strict execution controls.
Confidence: 78%Severity: 88%
Audit Metadata