registry / Credential exfiltration / @ricsam/r5d-browser / 0.0.194-prod.1791156868699.gfda9770eb69972f6bfa39b87968a8f2a4aec024e
@ricsam/r5d-browser@0.0.194-prod.1791156868699.gfda9770eb69972f6bfa39b87968a8f2a4aec024e
`r5d-browser start --auto-update` enables automatic client updates for this environment and state directory. The setting persists; `--no-auto-update` disables it. The client checks the authenticated environment's selected release once a minute and stages
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe scanner's execution findings correspond to local Chrome launch and browser-page automation, rather than a demonstrated download-and-execute attack. Reusing existing service credentials with an unrestricted configurable destination warrants a warning under the credential forwarding policy.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Run r5d-browser start with an alternate base URL while an existing service credential is available.
Impact
An alternate server could receive a credential intended for the user's r5d service.
Mechanism
Origin selection and credential selection are independent; the selected token is sent in the authorization header without restricting the destination host.
AI rationale
The scanner's execution findings correspond to local Chrome launch and browser-page automation, rather than a demonstrated download-and-execute attack. Reusing existing service credentials with an unrestricted configurable destination warrants a warning under the credential forwarding policy.
Evidence
dist/mjs/cli-options.mjsdist/mjs/personal-main.mjsdist/mjs/main.mjs
Network endpoints1
r5d.dev
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with false-positive risk.