@ethanwilkins/mcp-chrome-bridge-2026@1.3.2: Clean npm security | LPM Firewall

Loading npm security reports…

@ethanwilkins/mcp-chrome-bridge-2026@1.3.2: Clean npm security | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('./dist/scripts/postinstall.js')}catch(e){if(e.code!=='MODULE_NOT_FOUND')throw e}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('./dist/scripts/postinstall.js')}catch(e){if(e.code!=='MODULE_NOT_FOUND')throw e}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/index.jsView file

6Object.defineProperty(exports, "__esModule", { value: true }); L7: const server_1 = __importDefault(require("./server")); L8: const native_messaging_host_1 = __importDefault(require("./native-messaging-host"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L6

dist/scripts/utils.jsView file

20const os_1 = __importDefault(require("os")); L21: const child_process_1 = require("child_process"); L22: const util_1 = require("util"); ... L36: function getLogDir() { L37: const homedir = os_1.default.homedir(); L38: if (os_1.default.platform() === 'darwin') { ... L41: else if (os_1.default.platform() === 'win32') { L42: return path_1.default.join(process.env.LOCALAPPDATA || path_1.default.join(homedir, 'AppData', 'Local'), 'mcp-chrome-bridge', 'logs'); L43: } ... L102: const packageDistDir = path_1.default.join(__dirname, '..'); L103: const wrapperScriptName = process.platform === 'win32' ? 'run_host.bat' : 'run_host.sh'; L104: const absoluteWrapperPath = path_1.default.resolve(packageDistDir, wrapperScriptName);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/scripts/utils.jsView on unpkg · L20

dist/run_host.shView file

•path = dist/run_host.sh kind = build_helper sizeBytes = 9803 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/run_host.shView on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ethanwilkins/mcp-chrome-bridge-2026@1.2.1 matchedIdentity = npm:[redacted]:1.2.1 similarity = 0.878 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 1-40json

1{

2 "name": "@ethanwilkins/mcp-chrome-bridge-2026",

3 "version": "1.3.2",

4 "description": "Chrome Native-Messaging host (Node)",

5 "main": "dist/index.js",

6 "bin": {

7 "mcp-chrome-bridge": "./dist/cli.js",

8 "chrome-mcp-bridge": "./dist/cli.js",

9 "mcp-chrome-stdio": "./dist/mcp/mcp-server-stdio.js"

10 },

11 "scripts": {

12 "dev": "nodemon --watch src --ext ts,js,json --ignore dist/ --exec \"npm run build && npm run register:dev\"",

13 "build": "ts-node src/scripts/build.ts",

14 "test": "jest",

15 "test:watch": "jest --watch",

16 "lint": "eslint 'src/**/*.{js,ts}'",

17 "lint:fix": "eslint 'src/**/*.{js,ts}' --fix",

18 "format": "prettier --write 'src/**/*.{js,ts,json}'",

19 "register:dev": "node dist/scripts/register-dev.js",

20 "postinstall": "node -e \"try{require('./dist/scripts/postinstall.js')}catch(e){if(e.code!=='MODULE_NOT_FOUND')throw e}\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L20

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

21 },

22 "files": [

23 "dist",

24 "!dist/node_path.txt"

25 ],

26 "engines": {

27 "node": ">=20.0.0"

28 },

29 "preferGlobal": true,

30 "keywords": [

31 "mcp",

32 "chrome",

33 "browser"

34 ],

35 "author": "hangye",

36 "license": "MIT",

37 "dependencies": {

38 "@anthropic-ai/claude-agent-sdk": "^0.1.69",

39 "@fastify/cors": "^11.0.1",

40 "@modelcontextprotocol/sdk": "^1.11.0",

dist/index.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2"use strict";

3var __importDefault = (this && this.__importDefault) || function (mod) {

4 return (mod && mod.__esModule)

dist/scripts/utils.jsView file

Lines 1-40javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod :

dist/run_host.shView file

•path = dist/run_host.sh kind = build_helper sizeBytes = 9803 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/run_host.shView on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ethanwilkins/mcp-chrome-bridge-2026@1.2.1 matchedIdentity = npm:[redacted]:1.2.1 similarity = 0.878 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg