registry / Credential exfiltration / @ricsam/r5d-browser / 0.0.194-prod.1791018168423.gcd081a5cb1fea77555120f1ae1f661fdf937f80a
@ricsam/r5d-browser@0.0.194-prod.1791018168423.gcd081a5cb1fea77555120f1ae1f661fdf937f80a
`r5d-browser start --auto-update` enables automatic client updates for this environment and state directory. The setting persists; `--no-auto-update` disables it. The client checks the authenticated environment's selected release once a minute and stages
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe download and evaluation hints resolve to local Chrome launching and browser-page automation. Independent endpoint and saved credential selection creates a concrete conditional credential exposure that warrants a warning, not a publication block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Run r5d-browser start with an alternate server origin while a saved or environment-provided r5d credential remains selected.
Impact
An alternate server operator could obtain the r5d credential and potentially reuse its permissions.
Mechanism
Server selection and credential selection are independent; the client sends the reused credential to the selected origin without a service allowlist.
AI rationale
The download and evaluation hints resolve to local Chrome launching and browser-page automation. Independent endpoint and saved credential selection creates a concrete conditional credential exposure that warrants a warning, not a publication block.
Evidence
dist/mjs/cli-options.mjsdist/mjs/personal-main.mjsdist/mjs/main.mjs
Network endpoints1
r5d.dev
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI reads the existing r5dctl configuration and can reuse its saved token without a separately supplied credential.
- The server origin accepts any HTTPS host from options, environment variables, or configuration; no service destination allowlist is enforced.
- Requests send the selected token in a Bearer authorization header to that origin.
- The start command activates the personal browser client and its authenticated requests.
- Chrome execution launches a local executable, while run_js evaluates supplied code inside a browser page.
Evidence against
- The manifest has no install lifecycle hooks or runtime self-dependency.
- No hidden recipient, covert credential harvesting, or concrete malicious payload execution was established.
- Browser automation and local Chrome launching match the implemented CLI functionality.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
Source & flagged code
5 flaggeddist/mjs/chrome-launcher.mjsView file
1import { spawn } from "node:child_process";
L2: import fs from "node:fs";
L3: import http from "node:http";
L4: import net from "node:net";
...
L9: import WebSocket from "ws";
L10: import { readChromeSession, writePrivateJson } from "./chrome-session-state.mjs";
L11: const DEFAULT_STARTUP_TIMEOUT_MS = 15e3;
...
L21: }
L22: function defaultChromeProfilePath(homeDirectory = os.homedir()) {
L23: return path.join(homeDirectory, ".r5d", "browser", "chrome-profile");
...
L45: function resolveChromeExecutable(options = {}) {
L46: const env = options.env ?? process.env;
Critical
Download Execute
Source downloads or fetches remote code and executes it.
dist/mjs/chrome-launcher.mjsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/mjs/main.mjs -> dist/mjs/personal-main.mjs -> dist/mjs/chrome-launcher.mjs
L1: import { spawn } from "node:child_process";
L2: import fs from "node:fs";
L3: import http from "node:http";
L4: import net from "node:net";
...
L9: import WebSocket from "ws";
L10: import { readChromeSession, writePrivateJson } from "./chrome-session-state.mjs";
L11: const DEFAULT_STARTUP_TIMEOUT_MS = 15e3;
...
L21: }
L22: function defaultChromeProfilePath(homeDirectory = os.homedir()) {
L23: return path.join(homeDirectory, ".r5d", "browser", "chrome-profile");
...
L45: function resolveChromeExecutable(options = {}) {
L46: const env = options.env ?? process.env;
Findings
2 Critical3 High3 Medium4 Low
CriticalDownload Executedist/mjs/chrome-launcher.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/mjs/chrome-launcher.mjs
HighChild Processdist/mjs/chrome-launcher.mjs
HighEvaldist/mjs/browser-runtime.mjs
HighSemantic Analysis Limiteddist/mjs/browser-runtime.mjs#virtual:string-array:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @ricsam/r5d-browser@0.0.194-prod.1791018168423.gcd081a5cb1fea77555120f1ae1f661fdf937f80a.
See all versions of @ricsam/r5d-browser for other recorded verdicts.
- Review the evidence and your use of @ricsam/r5d-browser@0.0.194-prod.1791018168423.gcd081a5cb1fea77555120f1ae1f661fdf937f80a before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.