registry / Credential exfiltration / @ricsam/r5d-browser / 0.0.193-prod.1790873622670.g6b118c2809e58c7652f8239d5a6a0e46c09ed82c
@ricsam/r5d-browser@0.0.193-prod.1790873622670.g6b118c2809e58c7652f8239d5a6a0e46c09ed82c
`r5d-browser start --auto-update` enables automatic client updates for this environment and state directory. The setting persists; `--no-auto-update` disables it. The client checks the authenticated environment's selected release once a minute and stages
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource proves conditional forwarding of existing service credentials to an unrestricted operator-selected HTTPS origin. This warrants a credential exposure warning, not a malware publication block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Run the start command with a custom base URL while an existing r5d credential is available.
Impact
A custom server could receive a credential intended for another r5d environment.
Mechanism
Endpoint selection and credential fallback are independent; the registration request forwards the credential in its authorization header.
AI rationale
Source proves conditional forwarding of existing service credentials to an unrestricted operator-selected HTTPS origin. This warrants a credential exposure warning, not a malware publication block.
Evidence
dist/mjs/personal-main.mjsdist/mjs/main.mjs
Network endpoints1
r5d.dev
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The connection accepts an operator-selected HTTPS origin without a service destination allowlist.