registry / @ethanwilkins/mcp-chrome-bridge-2026 / 2.6.10

@ethanwilkins/mcp-chrome-bridge-2026@2.6.10

⚠ Under review

Chrome Native-Messaging host (Node)

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 22 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 58 file(s), 1.22 MB of source, external domains: 127.0.0.1, api.deepseek.com, example.com, json-schema.org

Source & flagged code

15 flagged

package.jsonView file

Lines 3-43json

3 "version": "2.6.10",

4 "description": "Chrome Native-Messaging host (Node)",

5 "main": "dist/index.js",

6 "bin": {

7 "mcp-chrome-bridge": "./dist/cli.js",

8 "chrome-mcp-bridge": "./dist/cli.js",

9 "mcp-chrome-stdio": "./dist/mcp/mcp-server-stdio.js"

10 },

11 "scripts": {

12 "dev": "nodemon --watch src --ext ts,js,json --ignore dist/ --exec \"npm run build && npm run register:dev\"",

13 "prebuild": "pnpm --filter @ethanwilkins/chrome-mcp-shared-2026 build",

14 "build": "ts-node src/scripts/build.ts",

15 "prepack": "npm run build",

16 "test": "jest --runInBand",

17 "test:coverage": "jest --runInBand --coverage",

18 "test:watch": "jest --watch",

19 "lint": "eslint src",

20 "lint:fix": "eslint src --fix",

21 "format": "prettier --write src",

22 "register:dev": "node dist/scripts/register-dev.js",

23 "postinstall": "node -e \"try{require('./dist/scripts/postinstall.js')}catch(e){if(e.code!=='MODULE_NOT_FOUND')throw e}\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L23

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

24 },

25 "files": [

26 "dist",

27 "!dist/node_path.txt",

28 "!dist/**/*.map"

29 ],

30 "engines": {

31 "node": ">=24.0.0"

32 },

33 "preferGlobal": true,

34 "keywords": [

35 "mcp",

36 "chrome",

37 "browser"

38 ],

39 "author": "hangye",

40 "license": "MIT",

41 "dependencies": {

42 "@anthropic-ai/claude-agent-sdk": "^0.1.69",

43 "@fastify/cors": "^11.0.1",

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

dist/observability.jsView file

Lines 1-25javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.createTraceId = createTraceId;

4exports.redactForLog = redactForLog;

5exports.structuredLog =

dist/run_host.shView file

•path = dist/run_host.sh kind = build_helper sizeBytes = 9803 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/run_host.shView on unpkg

dist/scripts/utils.jsView file

•matchType = normalized_sha256 matchedPackage = @ethanwilkins/mcp-chrome-bridge-2026@2.4.4 matchedPath = dist/scripts/utils.js matchedIdentity = npm:[redacted]:2.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High