registry / Credential exfiltration / @ricsam/r5d-browser / 0.0.194-prod.1790937756490.gb31a279f9acdb65e28736a489174ca6b156fd429
@ricsam/r5d-browser@0.0.194-prod.1790937756490.gb31a279f9acdb65e28736a489174ca6b156fd429
`r5d-browser start --auto-update` enables automatic client updates for this environment and state directory. The setting persists; `--no-auto-update` disables it. The client checks the authenticated environment's selected release once a minute and stages
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource supports a warning for conditional forwarding of existing credentials to an unrestricted operator-selected HTTPS origin. The scanner's execution findings are browser functionality, and no concrete malicious chain warrants blocking.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Run the start command with a changed base URL while an existing configuration or environment credential is available.
Impact
An unintended server could obtain a credential for the user's r5d account.
Mechanism
Destination selection and credential fallback are independent; the client sends the resulting token in an authorization header.
AI rationale
Source supports a warning for conditional forwarding of existing credentials to an unrestricted operator-selected HTTPS origin. The scanner's execution findings are browser functionality, and no concrete malicious chain warrants blocking.
Evidence
dist/mjs/cli-options.mjsdist/mjs/personal-main.mjsdist/mjs/main.mjs
Network endpoints1
r5d.dev
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.