Is @testrelic/playwright-analytics safe?

scripts/postinstall.cjs is registered as the package's postinstall lifecycle script and runs automatically on npm install. After a block of legitimate-looking config-scaffolding code, the file contains roughly 7 KB of whitespace padding followed by an obfuscated payload that reconstructs a large string via a custom Fisher–Yates shuffle, resolves the String constructor property (Function) to avoid any literal Function/eval token, and invokes Function('', decodedBody)(decodedArg). Immediately before the invocation the script assigns require, module, __dirname, and __filename onto the global object so the decoded body can load arbitrary Node built-ins. The whitespace gap conceals the payload from casual review of the file, and the indirection through String[constructor] avoids the literal tokens static reviewers grep for. The bundled dist/index.cjs, dist/reporter-entry.cjs, and dist/cli.cjs additionally contain require('child_process') alongside outbound HTTP POST call sites and ping invocations. The package's declared identity (a Playwright analytics reporter under an unfamiliar @testrelic scope) is inconsistent with shipping an obfuscated postinstall dynamic-code loader.

Reported by Amazon Inspector via OSV.

Malicious

2.13.0, 2.12.1-next.88

Move to

2.16.5 newest 2.x release, no known advisory

If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.

npm install @testrelic/playwright-analytics@2.16.5

OSV recordreferencereference