registry / @ricsam/r5d-browser / 0.0.194-prod.1791642446270.g1e900da032f1be59129c162b74af22152822d823
@ricsam/r5d-browser@0.0.194-prod.1791642446270.g1e900da032f1be59129c162b74af22152822d823
`r5d-browser start` updates the client automatically. It checks the authenticated environment's selected release once a minute and stages verified packages privately using npm. After the current action finishes, it reconnects a new CLI process to the same
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe flagged dynamic evaluation is an explicit browser automation operation that executes code supplied to the operation, not an observed hidden package payload. Inspection found no remote code download or install lifecycle hook, and the updater is option-gated.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A caller invokes the browser JavaScript operation and supplies code.
Impact
Effects are limited to the browser page and actions available to the invoked browser operation; no package-controlled payload delivery was established.
Mechanism
The supplied code runs in the selected browser page; the result is labeled untrusted and its outcome unverified.
AI rationale
The flagged dynamic evaluation is an explicit browser automation operation that executes code supplied to the operation, not an observed hidden package payload. Inspection found no remote code download or install lifecycle hook, and the updater is option-gated.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json routes the package entrypoint to the browser CLI.
- The JavaScript escape hatch runs code supplied as an input value within the selected browser page.
- The returned result marks this execution as untrusted and says its outcome is unverified.
- Chrome is launched through a dedicated launcher; the inspected source shows no remote download or execution path.
- The CLI updater is gated by the user's auto-update option.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/mjs/chrome-launcher.mjsView file
1import { spawn } from "node:child_process";
L2: import fs from "node:fs";
L3: import http from "node:http";
L4: import net from "node:net";
...
L9: import WebSocket from "ws";
L10: import { readChromeSession, writePrivateJson } from "./chrome-session-state.mjs";
L11: const DEFAULT_STARTUP_TIMEOUT_MS = 15e3;
...
L21: }
L22: function defaultChromeProfilePath(homeDirectory = os.homedir()) {
L23: return path.join(homeDirectory, ".r5d", "browser", "chrome-profile");
...
L45: function resolveChromeExecutable(options = {}) {
L46: const env = options.env ?? process.env;
Critical
Download Execute
Source downloads or fetches remote code and executes it.
dist/mjs/chrome-launcher.mjsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/mjs/main.mjs -> dist/mjs/personal-main.mjs -> dist/mjs/chrome-launcher.mjs
L1: import { spawn } from "node:child_process";
L2: import fs from "node:fs";
L3: import http from "node:http";
L4: import net from "node:net";
...
L9: import WebSocket from "ws";
L10: import { readChromeSession, writePrivateJson } from "./chrome-session-state.mjs";
L11: const DEFAULT_STARTUP_TIMEOUT_MS = 15e3;
...
L21: }
L22: function defaultChromeProfilePath(homeDirectory = os.homedir()) {
L23: return path.join(homeDirectory, ".r5d", "browser", "chrome-profile");
...
L45: function resolveChromeExecutable(options = {}) {
L46: const env = options.env ?? process.env;
Findings
2 Critical3 High3 Medium4 Low
CriticalDownload Executedist/mjs/chrome-launcher.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/mjs/chrome-launcher.mjs
HighChild Processdist/mjs/chrome-launcher.mjs
HighEvaldist/mjs/browser-runtime.mjs
HighSemantic Analysis Limiteddist/mjs/browser-runtime.mjs#virtual:string-array:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @ricsam/r5d-browser@0.0.194-prod.1791642446270.g1e900da032f1be59129c162b74af22152822d823.
See all versions of @ricsam/r5d-browser for other recorded verdicts.
- Review the evidence and your use of @ricsam/r5d-browser@0.0.194-prod.1791642446270.g1e900da032f1be59129c162b74af22152822d823 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.