registry / Credential exfiltration / @ricsam/r5d-browser / 0.0.194-prod.1791067619004.gfa5cc46443e667ebccc04ca8eb4d46b6c42345b6
@ricsam/r5d-browser@0.0.194-prod.1791067619004.gfa5cc46443e667ebccc04ca8eb4d46b6c42345b6
`r5d-browser start --auto-update` enables automatic client updates for this environment and state directory. The setting persists; `--no-auto-update` disables it. The client checks the authenticated environment's selected release once a minute and stages
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource proves conditional forwarding of existing credentials to an unrestricted configured HTTPS origin, warranting a warning. The scanner's execution findings do not establish a malicious download-and-execute chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Run r5d-browser start with an overridden base URL while an existing token remains available.
Impact
The selected server can receive an existing service credential.
Mechanism
The origin and credential are selected independently, then registration sends the credential in an authorization header without binding it to its original service.
AI rationale
Source proves conditional forwarding of existing credentials to an unrestricted configured HTTPS origin, warranting a warning. The scanner's execution findings do not establish a malicious download-and-execute chain.
Evidence
dist/mjs/cli-options.mjsdist/mjs/personal-main.mjsdist/mjs/main.mjsconfig.json
Network endpoints1
r5d.dev
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.