@lensmcp/client-runtime@1.25.40
LensMCP browser-side capture layer — errors, console, fetch, and route changes streamed to the LensMCP bridge. Import '@lensmcp/client-runtime/auto' for a zero-build install in any host.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe default browser replay path records password fields without masking and uploads the recording to the bridge. Credential capture is unrelated to the disclosed event-capture purpose and occurs automatically when the `/auto` entry is imported.
Static reason
No blocking static signals were detected.
Trigger
Importing `@lensmcp/client-runtime/auto` in a browser; replay starts by default unless disabled.
Impact
Password values entered on the page can be included in replay uploads and exposed to the bridge receiving them.
Mechanism
rrweb records the page while the recorder disables masking of password inputs, then uploads replay data to `/replay` and `/replay/blob`. The default endpoint uses the page hostname on port 5747 unless configured otherwise.
Attack narrative
Importing the documented `/auto` entry starts replay capture by default. The replay configuration leaves all inputs unmasked and explicitly disables password masking, then POSTs replay payloads to the configured bridge endpoint. This can collect and transmit credentials entered into the observed page without a separate consent action.
AI rationale
The default browser replay path records password fields without masking and uploads the recording to the bridge. Credential capture is unrelated to the disclosed event-capture purpose and occurs automatically when the `/auto` entry is imported.
Evidence
auto.jslib/auto.jslib/replay/types.jslib/replay/recorder.jslib/replay/uploader.js
Network endpoints3
ws://<location.hostname>:5747http(s)://<configured endpoint>/replayhttp(s)://<configured endpoint>/replay/blob
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- Importing `auto.js` immediately calls `installLensmcp`.
- Replay is enabled by default and starts unless explicitly disabled.
- The replay privacy defaults set `maskAllInputs` to false.
- The recorder explicitly sets `password` masking to false, allowing password field values into recordings.
- Replay data and blobs are POSTed to `/replay` and `/replay/blob` on the configured endpoint; the default WebSocket host is the page hostname on port 5747.
Evidence against
- The package has no install lifecycle scripts; the behavior is triggered by importing the documented `/auto` entry.
- The stated purpose is browser observability through a LensMCP bridge, and the bridge endpoint can be configured by the user.
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
8 flaggedauto.jsView file
1"use strict";import{installLensmcp as s}from"./lib/auto.js";s();export{installLensmcp,resolveLensmcpWsUrl,resolveLensmcpWsToken}from"./lib/auto.js";
High
lib/auto.jsView file
1bind(window):void 0;g(e),replayWanted(t.replay)&&p(e.wsUrl,n,o)}r(installLensmcp,"installLensmcp"),s(installLensmcp,"installLensmcp");export function replayWanted(t){if(t===!1||globalThis.__LENSMCP_REPLAY_
High
Ai Review Evidence
Replay is enabled by default and starts unless explicitly disabled.
lib/auto.jsView on unpkg · L11tallLensmcp");export function replayWanted(t){if(t===!1||globalThis.__LENSMCP_REPLAY__===!1)return!1;const e=i("lensmcp-replay")?.toLowerCase();return e!=="off"&&e!=="false"&&e!=="0"}r(replayWanted,"replayWante
High
Findings
8 High1 Medium3 Low
HighAi Review Evidenceauto.js
HighAi Review Evidencelib/auto.js
HighAi Review Evidencelib/auto.js
HighAi Review Evidencelib/replay/types.js
HighAi Review Evidencelib/replay/recorder.js
HighAi Review Evidencelib/replay/uploader.js
HighAi Review Evidencelib/auto.js
HighAi Review Evidencelib/replay/uploader.js
MediumNetwork
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @lensmcp/client-runtime@1.25.40.
See all versions of @lensmcp/client-runtime for other recorded verdicts.
- Avoid installing @lensmcp/client-runtime@1.25.40. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.