romainmenke/webdriverio

API keys, passwords or tokens committed into the repo.

• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  __mocks__/fetch.ts:4
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/wdio-config/tests/__fixtures__/wdio.array.conf.ts:7
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/wdio-config/tests/__fixtures__/wdio.conf.rdc.ts:7
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/wdio-config/tests/__fixtures__/wdio.conf.multiremote.rdc.ts:7
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/wdio-config/tests/__fixtures__/wdio.conf.ts:7
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/wdio-config/tests/node/configparser.test.ts:46
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/wdio-config/tests/node/configparser.test.ts:378
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/wdio-config/tests/node/configparser.test.ts:875
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/webdriver/src/constants.ts:152
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/webdriverio/tests/utils/detectBackend.test.ts:47
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/webdriverio/tests/utils/detectBackend.test.ts:69
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/webdriverio/tests/utils/detectBackend.test.ts:80
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/webdriverio/tests/utils/detectBackend.test.ts:91
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/webdriverio/tests/utils/detectBackend.test.ts:103
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/webdriverio/tests/utils/detectBackend.test.ts:114
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/webdriverio/tests/utils/detectBackend.test.ts:126
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/webdriverio/tests/utils/detectBackend.test.ts:138
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/webdriverio/tests/utils/detectBackend.test.ts:151
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/webdriverio/tests/utils/detectBackend.test.ts:197
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/webdriverio/tests/utils/detectBackend.test.ts:212
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/webdriverio/tests/utils/detectBackend.test.ts:242
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  website/docusaurus.config.ts:19
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  website/docusaurus.config.ts:52
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2026-27699 basic-ftp: basic-ftp: File overwrite due to path traversal
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-27699). Fix: Update that package to its patched version.
• Serious CVE-2026-25896 fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-25896). Fix: Update that package to its patched version.
• Serious CVE-2025-7783 form-data: Unsafe random function in form-data
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious CVE-2026-9277 shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious CVE-2026-54466 websocket-driver is a WebSocket protocol handler with pluggable I/O. P ...
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
• Serious CVE-2026-9277 shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators
  website/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious CVE-2026-54466 websocket-driver is a WebSocket protocol handler with pluggable I/O. P ...
  website/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44728 Babel is a compiler for writing next generation JavaScript. From 7.12. ...
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-44728). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39244 adm-zip: adm-zip: Denial of Service via crafted ZIP file leading to excessive memory allocation
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-39244). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-69873 ajv: ReDoS via $data reference
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-69873 ajv: ReDoS via $data reference
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-27152 axios: Possible SSRF and Credential Leakage via Absolute URL in axios Requests
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-27152). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-58754 axios: Axios DoS via lack of data size check
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-58754). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-25639 axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-25639). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-42033 axios: Axios: HTTP Transport Hijacking via Prototype Pollution
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-42033). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-42035 axios: Axios: Arbitrary HTTP header injection via prototype pollution
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-42035). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-42043 axios: Axios: NO_PROXY bypass via crafted URL
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-42043). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-42264 axios: Axios: Prototype pollution allows information disclosure and request manipulation
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-42264). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44486 axios: Axios: Information disclosure of proxy credentials via HTTP redirects
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-44486). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44487 axios: Axios: Information disclosure of proxy credentials via redirect flows
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-44487). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44488 axios: Axios: Denial of Service due to unenforced request and response size limits
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-44488). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44494 axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-44494). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-5rq4-664w-9x2c Basic FTP has Path Traversal Vulnerability in its downloadToDir() method
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-27699). Fix: Update that package to its patched version.
• Serious GHSA-m7jm-9gc2-mpf2 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-25896). Fix: Update that package to its patched version.
• Serious GHSA-m7jm-9gc2-mpf2 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-25896). Fix: Update that package to its patched version.
• Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious GHSA-2w6w-674q-4c4q Handlebars.js has JavaScript Injection via AST Type Confusion
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-33937). Fix: Update that package to its patched version.
• Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious GHSA-5xrq-8626-4rwp When Vitest UI server is listening, arbitrary file can be read and executed
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-47429). Fix: Update that package to its patched version.
• Serious GHSA-9crc-q9x8-hgqq Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-24964). Fix: Update that package to its patched version.
• Serious GHSA-xv26-6w52-cph6 websocket-driver: Message corruption via abuse of protocol length headers
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
• Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/website/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious GHSA-xv26-6w52-cph6 websocket-driver: Message corruption via abuse of protocol length headers
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/website/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
• Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing GHSA-fv7c-fp4j-7gwp @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-44728). Fix: Update that package to its patched version.
• Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing GHSA-x4c5-c7rf-jjgv @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-25285). Fix: Update that package to its patched version.
• Worth fixing GHSA-h5c3-5r3r-rr8q @octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-25288). Fix: Update that package to its patched version.
• Worth fixing GHSA-h5c3-5r3r-rr8q @octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-25288). Fix: Update that package to its patched version.
• Worth fixing GHSA-rmvr-2pp2-xj38 @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-25290). Fix: Update that package to its patched version.
• Worth fixing GHSA-rmvr-2pp2-xj38 @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-25290). Fix: Update that package to its patched version.
• Worth fixing GHSA-xx4v-prfh-6cgc @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-25289). Fix: Update that package to its patched version.
• Worth fixing GHSA-xx4v-prfh-6cgc @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-25289). Fix: Update that package to its patched version.
• Worth fixing GHSA-jfc7-64v2-mr8c @sigstore/core has DSSE payloadType type-binding failure
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-48758). Fix: Update that package to its patched version.
• Worth fixing GHSA-xcpc-8h2w-3j85 adm-zip: Crafted ZIP file triggers 4GB memory allocation
  /workdirs/scan-aa357cf7-6d40-4bb1-9f04-5e150203aeb6/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-39244). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout