registry / Credential exfiltration / @ricsam/r5d-browser / 0.0.191-prod.1790755082246.gf3f4694014aacc595c9d50bf037817ad4cf1b39b
@ricsam/r5d-browser@0.0.191-prod.1790755082246.gf3f4694014aacc595c9d50bf037817ad4cf1b39b
`r5d-browser start --auto-update` enables automatic client updates for this environment and state directory. The setting persists; `--no-auto-update` disables it. The client checks the authenticated environment's selected release once a minute and stages
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe active CLI can forward existing service credentials to an unrestricted configured HTTPS origin. This conditional dangerous capability warrants a warning rather than a publication block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Run r5d-browser start with an alternate configured origin while an existing r5d token is available.
Impact
Conditional disclosure of an existing r5d token to the configured server.
Mechanism
Endpoint selection and credential fallback are independent; the request sends bearer authorization without restricting the destination to the credential's intended service.
AI rationale
The active CLI can forward existing service credentials to an unrestricted configured HTTPS origin. This conditional dangerous capability warrants a warning rather than a publication block.
Evidence
dist/mjs/cli-options.mjsdist/mjs/personal-main.mjsdist/mjs/main.mjs
Network endpoints1
r5d.dev
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning