registry / @ricsam/r5d-browser
@ricsam/r5d-browser
`r5d-browser start` updates the client automatically. It checks the authenticated environment's selected release once a minute and stages verified packages privately using npm, from the npm registry the server names (npm.r5d.dev for r5d.dev). After the cu
This report shows the evidence for @ricsam/r5d-browser@0.0.195-prod.1793450427225.gcf121f6ce6744f273c71db4dfb9ae97a91116bfb. 0 of 169 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package is a browser-control CLI: it launches the chosen local Chrome executable and sends its credential only to the configured HTTPS r5d server. The scanner's download/execute and dynamic-evaluation flags correspond to local Chrome launch and browser actions, and no unrelated collection or concealed download was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the `r5d-browser` CLI, especially its `start` command; importing the CLI entry point also invokes its argument handling.
Impact
The service can control the connected browser as intended by the package; no unrelated credential destination or concealed code download was found.
Mechanism
The client resolves a user-supplied or saved server origin and credential, then sends authenticated requests to that origin and performs browser actions returned by the service.
AI rationale
The package is a browser-control CLI: it launches the chosen local Chrome executable and sends its credential only to the configured HTTPS r5d server. The scanner's download/execute and dynamic-evaluation flags correspond to local Chrome launch and browser actions, and no unrelated collection or concealed download was found.
Evidence
User-selected or default r5d state directory, including browser profile, binding, session, and run-lock files
Network endpoints1
Configured HTTPS r5d server origin, at `/api/personal/resources` and its resource routes
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package entry points are a CLI executable and module, with no install lifecycle script shown in the manifest.
- The browser connection uses credentials resolved from CLI flags, the user's config, or environment, and requires an HTTPS server origin.
- Runtime requests send the bearer token to that configured origin's personal browser API.
- The child process launched is the selected local Chrome executable, using arguments built for its browser profile.
Evidence against
- The `run_js` capability evaluates code received as a browser action, consistent with the package's remote browser-control purpose.
- The source contains networking, filesystem access, and dynamic evaluation, but the reviewed flows tie these to browser setup and user-configured service operation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStrings
Source & flagged code
6 flaggeddist/mjs/browser-secret-fill.mjsView file
118patternName = generic_password
severity = medium
line = 118
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/mjs/browser-secret-fill.mjsView on unpkg · L118dist/mjs/chrome-launcher.mjsView file
1import { spawn } from "node:child_process";
L2: import fs from "node:fs";
L3: import http from "node:http";
L4: import net from "node:net";
...
L9: import WebSocket from "ws";
L10: import { readChromeSession, writePrivateJson } from "./chrome-session-state.mjs";
L11: import { UnresponsiveTabGate } from "./unresponsive-tab-gate.mjs";
...
L23: }
L24: function defaultChromeProfilePath(homeDirectory = os.homedir()) {
L25: return path.join(homeDirectory, ".r5d", "browser", "chrome-profile");
...
L33: const PLATFORM_NAMES = { linux: "Linux", win32: "Windows", freebsd: "FreeBSD", openbsd: "OpenBSD" };
L34: function assertSupportedPlatform(platform = process.platform) {
Critical
Download Execute
Findings
3 Critical2 High4 Medium4 Low
CriticalDownload Executedist/mjs/chrome-launcher.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/mjs/chrome-launcher.mjs
CriticalPrevious Version Dangerous Deltadist/mjs/chrome-launcher.mjs
HighChild Processdist/mjs/chrome-launcher.mjs
HighEvaldist/mjs/browser-runtime.mjs
MediumSecret Patterndist/mjs/browser-secret-fill.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @ricsam/r5d-browser@0.0.195-prod.1793450427225.gcf121f6ce6744f273c71db4dfb9ae97a91116bfb.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @ricsam/r5d-browser@0.0.195-prod.1793450427225.gcf121f6ce6744f273c71db4dfb9ae97a91116bfb before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
169 known versions0.0.195-prod.1793450427225.gcf121f6ce6744f273c71db4dfb9ae97a91116bfblatestshownClean—AllowPublishedOct 31, 2026, 12:43 PM0.0.195-prod.1793375956620.g2b2c6d1d43c59061aae81be3289510c549e9cde0Clean—AllowPublishedOct 30, 2026, 4:02 PM0.0.195-prod.1793357391968.g44652548da158476c71ddbcab1577886886c056aClean—AllowPublishedOct 30, 2026, 10:53 AM