registry / Remote code execution / @ethanwilkins/mcp-chrome-bridge-2026
@ethanwilkins/mcp-chrome-bridge-2026
Chrome Native-Messaging host (Node)
This report shows the evidence for @ethanwilkins/mcp-chrome-bridge-2026@2.4.4. 1 of 17 known versions is blocked or flagged. The newest version, 2.7.0, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package exposes an unauthenticated cross-extension path to force a local AI coding agent into unrestricted execution. Local-only binding and package-owned native-host registration do not mitigate a malicious installed extension.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A Chrome/Mozilla extension sends requests to the running local /agent API after the native host starts the server.
Impact
Arbitrary attacker-supplied agent instructions can execute with the local user's Codex credentials and filesystem permissions.
Mechanism
unauthenticated extension-origin agent invocation with forced Codex sandbox bypass
Attack narrative
On global installation, the package registers a Chrome native host which starts a loopback server. Its CORS policy accepts any installed extension origin, but its authentication hook excludes agent endpoints. A malicious extension can create/select a project and submit an agent action that launches Codex with `--dangerously-bypass-approvals-and-sandbox`; the bundled defaults additionally request danger-full-access and autonomous operation. This is a concrete local privilege/control boundary failure, not merely an optional CLI feature.
AI rationale
The package exposes an unauthenticated cross-extension path to force a local AI coding agent into unrestricted execution. Local-only binding and package-owned native-host registration do not mitigate a malicious installed extension.
Evidence
dist/constant/index.jsdist/server/index.jsdist/server/routes/agent.jsdist/agent/engines/codex.jsdist/vendor/chrome-mcp-shared-2026/dist/index.jsdist/scripts/postinstall.jsdist/index.js
Network endpoints1
127.0.0.1:12306
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- Any Chrome or Mozilla extension origin is accepted, while authentication only covers MCP transport paths, not /agent routes.
- Unauthenticated /agent routes can create projects and submit agent actions.
- The Codex engine always invokes `codex exec` with approvals and sandbox bypassed.
- Bundled defaults force danger-full-access and autonomous instructions.
- Global postinstall registers a native host that starts the local server.
Evidence against
- Server binds only to 127.0.0.1.
- Postinstall limits automatic browser registration to global installs and package-owned native-messaging paths.
- No non-local exfiltration endpoint was confirmed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node -e "try{require('./dist/scripts/postinstall.js')}catch(e){if(e.code!=='MODULE_NOT_FOUND')throw e}"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "try{require('./dist/scripts/postinstall.js')}catch(e){if(e.code!=='MODULE_NOT_FOUND')throw e}"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/index.jsView file
6Object.defineProperty(exports, "__esModule", { value: true });
L7: const server_1 = __importDefault(require("./server"));
L8: const native_messaging_host_1 = __importDefault(require("./native-messaging-host"));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
Findings
2 Critical3 High5 Medium4 Low
CriticalRed Install Lifecycle Scriptpackage.json
CriticalPrevious Version Dangerous Deltadist/mcp/mcp-server-stdio.js
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritydist/scripts/browser-config.js
HighKnown Malware Source Similaritydist/scripts/report.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/run_host.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ethanwilkins/mcp-chrome-bridge-2026@2.4.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing @ethanwilkins/mcp-chrome-bridge-2026@2.4.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.