🛡️ MAL-2026-4700 — venturo-playwright

Malicious code in venturo-playwright (npm)

Source: amazon-inspector

Package presents itself as Microsoft's Playwright: package.json description 'A high-level API to automate web browsers' is Playwright's exact tagline, homepage points to https://playwright.dev, and source files carry 'Copyright (c) Microsoft Corporation' headers. The package is published under the unrelated author 'Venturo' (no email, repo github.com/venturo/playwright) and is not affiliated with Microsoft. All entry points (cli.js, index.js, index.mjs) re-export from a sibling dependency '[email protected]' — for example index.js:16 contains module.exports = require('venturo-playwright-runner/test'). Installers expecting Playwright instead pull venturo-playwright-runner into their dependency tree, where any code (including install-time lifecycle hooks) executes with no relation to the legitimate Playwright project. The deliberate Microsoft branding, Playwright homepage, and tagline reuse establish impersonation intent; the wrapper's only function is to silently route consumers into an attacker-controlled transitive.