registry / Credential exfiltration / @ricsam/r5d-browser / 0.0.189-prod.1790199849874.g2f5310c3e02821d01c18340c980952a3afabc137
@ricsam/r5d-browser@0.0.189-prod.1790199849874.g2f5310c3e02821d01c18340c980952a3afabc137
`r5d-browser start --auto-update` enables automatic client updates for this environment and state directory. The setting persists; `--no-auto-update` disables it. The client checks the authenticated environment's selected release once a minute and stages
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe token-forwarding path is active and its destination is not restricted to the intended service. There is no install-time execution or other concrete malware behavior in the inspected sources.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the browser command with a selected service configuration.
Impact
A misconfigured or attacker-controlled service origin could receive an existing r5d credential.
Mechanism
The client reads a token, constructs an HTTPS request to the selected origin, and places the token in the Authorization header.
AI rationale
The token-forwarding path is active and its destination is not restricted to the intended service. There is no install-time execution or other concrete malware behavior in the inspected sources.
Evidence
dist/mjs/personal-main.mjs
Network endpoints1
r5d.dev
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes a browser command entrypoint.
- Its service origin can come from command options, environment variables, or local configuration and is limited only to HTTPS.