registry / Credential exfiltration / @ricsam/r5d-browser / 0.0.194-prod.1790940298432.g8969a1bb95007525e6334fe76e573971d9a31022
@ricsam/r5d-browser@0.0.194-prod.1790940298432.g8969a1bb95007525e6334fe76e573971d9a31022
`r5d-browser start --auto-update` enables automatic client updates for this environment and state directory. The setting persists; `--no-auto-update` disables it. The client checks the authenticated environment's selected release once a minute and stages
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe scanner's execution findings correspond to local Chrome launching and browser-page scripting. Independent source inspection establishes unrestricted forwarding of existing service credentials, warranting a warning rather than a publication block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Run the start command with an alternate base URL while an existing credential is available.
Impact
An alternate server could obtain a credential intended for another r5d service.
Mechanism
Connection setup chooses the destination independently of the saved credential, then sends the credential as Bearer authentication.
AI rationale
The scanner's execution findings correspond to local Chrome launching and browser-page scripting. Independent source inspection establishes unrestricted forwarding of existing service credentials, warranting a warning rather than a publication block.
Evidence
dist/mjs/cli-options.mjsdist/mjs/personal-main.mjsdist/mjs/main.mjs
Network endpoints1
r5d.dev
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.