registry / Credential exfiltration / @ricsam/r5d-browser / 0.0.191-prod.1790700019803.gd6db591440ba9d63a9accdeb5954aa88e3b2f601
@ricsam/r5d-browser@0.0.191-prod.1790700019803.gd6db591440ba9d63a9accdeb5954aa88e3b2f601
`r5d-browser start --auto-update` enables automatic client updates for this environment and state directory. The setting persists; `--no-auto-update` disables it. The client checks the authenticated environment's selected release once a minute and stages
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe configurable destination and independently sourced credential create a concrete conditional exposure risk. Static inspection found no lifecycle trigger or separate evidence of malicious intent.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user runs the browser start command with an origin supplied through options, environment, or configuration.
Impact
A misconfigured or attacker-controlled HTTPS origin could receive an existing service credential.
Mechanism
The client selects that origin independently from the token source and posts requests with the token in a bearer authorization header.
AI rationale
The configurable destination and independently sourced credential create a concrete conditional exposure risk. Static inspection found no lifecycle trigger or separate evidence of malicious intent.
Evidence
dist/mjs/personal-main.mjs
Network endpoints1
r5d.dev
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Package metadata exposes a browser CLI and contains no install lifecycle hook.