Loading npm security reports…

@ethanwilkins/mcp-chrome-bridge-2026@2.5.5: Suspicious npm | LPM Firewall

registry / @ethanwilkins/mcp-chrome-bridge-2026 / 2.5.5

@ethanwilkins/mcp-chrome-bridge-2026@2.5.5

⚠ Under review

Chrome Native-Messaging host (Node)

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 24 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 57 file(s), 1.20 MB of source, external domains: 127.0.0.1, api.deepseek.com, example.com, json-schema.org

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('./dist/scripts/postinstall.js')}catch(e){if(e.code!=='MODULE_NOT_FOUND')throw e}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('./dist/scripts/postinstall.js')}catch(e){if(e.code!=='MODULE_NOT_FOUND')throw e}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

dist/observability.js

Findings

2 Critical13 High5 Medium4 Low

CriticalRed Install Lifecycle Scriptpackage.json

CriticalPrevious Version Dangerous Deltadist/browser-profile-manager.js

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limitedpackage.json

HighKnown Malware Source Similaritydist/agent/engines/codex.js

HighKnown Malware Source Similaritydist/scripts/utils.js

HighKnown Malware Source Similaritydist/agent/engines/claude.js

HighKnown Malware Source Similaritydist/cli.js

HighKnown Malware Source Similaritydist/scripts/browser-config.js

HighKnown Malware Source Similaritydist/scripts/doctor.js

HighKnown Malware Source Similarity

Affected versions and remediation

This report applies to @ethanwilkins/mcp-chrome-bridge-2026@2.5.5.

See all versions of @ethanwilkins/mcp-chrome-bridge-2026 for other recorded verdicts.

Review the evidence and your use of @ethanwilkins/mcp-chrome-bridge-2026@2.5.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-05 10:44:50.206Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Source & flagged code

17 flagged

package.jsonView file

Lines 65-87json

65 },

66 "lint-staged": {

67 "*.{js,ts}": [

68 "eslint --fix",

69 "prettier --write"

70 ],

71 "*.{json,md}": [

72 "prettier --write"

73 ]

74 },

75 "scripts": {

76 "dev": "nodemon --watch src --ext ts,js,json --ignore dist/ --exec \"npm run build && npm run register:dev\"",

77 "prebuild": "pnpm --filter @ethanwilkins/chrome-mcp-shared-2026 build",

78 "build": "ts-node src/scripts/build.ts",

79 "test": "jest",

80 "test:watch": "jest --watch",

81 "lint": "eslint src",

82 "lint:fix": "eslint src --fix",

83 "format": "prettier --write src",

84 "register:dev": "node dist/scripts/register-dev.js",

85 "postinstall": "node -e \"try{require('./dist/scripts/postinstall.js')}catch(e){if(e.code!=='MODULE_NOT_FOUND')throw e}\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L85

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L85

86 }

87}

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

dist/observability.jsView file

Lines 1-25javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.createTraceId = createTraceId;

4exports.redactForLog = redactForLog;

5exports.structuredLog =

dist/run_host.shView file

•path = dist/run_host.sh kind = build_helper sizeBytes = 9803 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/run_host.shView on unpkg

dist/agent/engines/codex.jsView file

•matchType = normalized_sha256 matchedPackage = @ethanwilkins/mcp-chrome-bridge-2026@2.4.4 matchedPath = dist/agent/engines/codex.js matchedIdentity = npm:[redacted]:2.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agent/engines/codex.jsView on unpkg

dist/scripts/utils.jsView file

•matchType = normalized_sha256 matchedPackage = @ethanwilkins/mcp-chrome-bridge-2026@2.4.4 matchedPath = dist/scripts/utils.js matchedIdentity = npm:[redacted]:2.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/utils.jsView on unpkg

dist/agent/engines/claude.jsView file

•matchType = normalized_sha256 matchedPackage = @ethanwilkins/mcp-chrome-bridge-2026@2.4.4 matchedPath = dist/agent/engines/claude.js matchedIdentity = npm:[redacted]:2.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agent/engines/claude.jsView on unpkg

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = @ethanwilkins/mcp-chrome-bridge-2026@2.4.4 matchedPath = dist/cli.js matchedIdentity = npm:[redacted]:2.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

dist/scripts/browser-config.jsView file

•matchType = normalized_sha256 matchedPackage = auto-chrome-mcp-bridge@1.11.0 matchedPath = dist/scripts/browser-config.js matchedIdentity = npm:YXV0by1jaHJvbWUtbWNwLWJyaWRnZQ:1.11.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/browser-config.jsView on unpkg

dist/scripts/doctor.jsView file

•matchType = normalized_sha256 matchedPackage = @ethanwilkins/mcp-chrome-bridge-2026@2.4.4 matchedPath = dist/scripts/doctor.js matchedIdentity = npm:[redacted]:2.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/doctor.jsView on unpkg

dist/scripts/report.jsView file

•matchType = normalized_sha256 matchedPackage = auto-chrome-mcp-bridge@1.11.0 matchedPath = dist/scripts/report.js matchedIdentity = npm:YXV0by1jaHJvbWUtbWNwLWJyaWRnZQ:1.11.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/report.jsView on unpkg

dist/scripts/safe-upgrade.jsView file

•matchType = normalized_sha256 matchedPackage = @ethanwilkins/mcp-chrome-bridge-2026@2.4.4 matchedPath = dist/scripts/safe-upgrade.js matchedIdentity = npm:[redacted]:2.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/safe-upgrade.jsView on unpkg

dist/agent/db/client.jsView file

•matchType = normalized_sha256 matchedPackage = @ethanwilkins/mcp-chrome-bridge-2026@2.4.4 matchedPath = dist/agent/db/client.js matchedIdentity = npm:[redacted]:2.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agent/db/client.jsView on unpkg

dist/agent/ccr-detector.jsView file

•matchType = normalized_sha256 matchedPackage = @ethanwilkins/mcp-chrome-bridge-2026@2.4.4 matchedPath = dist/agent/ccr-detector.js matchedIdentity = npm:[redacted]:2.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agent/ccr-detector.jsView on unpkg

dist/file-handler.jsView file

•matchType = normalized_sha256 matchedPackage = @ethanwilkins/mcp-chrome-bridge-2026@2.4.4 matchedPath = dist/file-handler.js matchedIdentity = npm:[redacted]:2.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/file-handler.jsView on unpkg

dist/browser-profile-manager.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ethanwilkins/mcp-chrome-bridge-2026@2.3.1 matchedIdentity = npm:[redacted]:2.3.1 similarity = 0.875 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/browser-profile-manager.jsView on unpkg