registry / Credential exfiltration / @ricsam/r5d-browser / 0.0.189-prod.1790146867418.ga463eb7e121d573b25c819384111ecbc91abedac
@ricsam/r5d-browser@0.0.189-prod.1790146867418.ga463eb7e121d573b25c819384111ecbc91abedac
`r5d-browser start --auto-update` enables automatic client updates for this environment and state directory. The setting persists; `--no-auto-update` disables it. The client checks the authenticated environment's selected release once a minute and stages
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe active client forwards an existing token to an unrestricted HTTPS origin selected through configuration. This supports a warning for conditional credential exposure, but there is no evidence of covert export or install-time execution.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running the r5d-browser start command with a configured or supplied non-default service origin.
Impact
An operator-selected service could receive an existing service credential; this is conditional exposure, not confirmed theft.
Mechanism
The client builds requests to the selected origin and places the resolved token in the Authorization header.
AI rationale
The active client forwards an existing token to an unrestricted HTTPS origin selected through configuration. This supports a warning for conditional credential exposure, but there is no evidence of covert export or install-time execution.
Evidence
dist/mjs/personal-main.mjs
Network endpoints1
r5d.dev
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package metadata exposes a CLI entrypoint and contains no lifecycle scripts.