registry / @ricsam/r5d-browser / 0.0.195-prod.1792260550650.gd8f2d7fc7c9762d014a957938fc657a9fe6a1c04
@ricsam/r5d-browser@0.0.195-prod.1792260550650.gd8f2d7fc7c9762d014a957938fc657a9fe6a1c04
`r5d-browser start` updates the client automatically. It checks the authenticated environment's selected release once a minute and stages verified packages privately using npm. After the current action finishes, it reconnects a new CLI process to the same
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe inspected entrypoint and flagged files support ordinary browser automation, with no install hook or verified remote payload execution. Scanner matches for process launch and dynamic evaluation are explained by starting Chrome and executing caller-supplied browser actions.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user starts the browser CLI or invokes the browser run_js action.
Impact
No malicious impact was established from the inspected behavior.
Mechanism
The launcher starts the configured Chrome executable; run_js evaluates code provided to the browser action.
AI rationale
The inspected entrypoint and flagged files support ordinary browser automation, with no install hook or verified remote payload execution. Scanner matches for process launch and dynamic evaluation are explained by starting Chrome and executing caller-supplied browser actions.
Evidence
package.jsondist/mjs/main.mjsdist/mjs/chrome-launcher.mjsdist/mjs/browser-runtime.mjsdist/mjs/navigation-observer.mjs
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to the browser CLI entrypoint and lists its runtime dependencies; no install lifecycle hook is present.
- The launcher starts the selected Chrome executable with browser launch arguments.
- Dynamic evaluation occurs in the browser run_js action using code supplied to that action.
- Navigation observation registers and removes page navigation, close, and crash handlers.
Evidence against
- No source inspected shows the package downloading or executing remote code; the launcher starts Chrome and the dynamic evaluation runs caller-supplied browser code.
- The observed runtime behavior is consistent with browser automation and navigation tracking; no concrete attack surface was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/mjs/chrome-launcher.mjsView file
1import { spawn } from "node:child_process";
L2: import fs from "node:fs";
L3: import http from "node:http";
L4: import net from "node:net";
...
L9: import WebSocket from "ws";
L10: import { readChromeSession, writePrivateJson } from "./chrome-session-state.mjs";
L11: import { UnresponsiveTabGate } from "./unresponsive-tab-gate.mjs";
...
L22: }
L23: function defaultChromeProfilePath(homeDirectory = os.homedir()) {
L24: return path.join(homeDirectory, ".r5d", "browser", "chrome-profile");
...
L46: function resolveChromeExecutable(options = {}) {
L47: const env = options.env ?? process.env;
Critical
Download Execute
Source downloads or fetches remote code and executes it.
dist/mjs/chrome-launcher.mjsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/mjs/main.mjs -> dist/mjs/personal-main.mjs -> dist/mjs/chrome-launcher.mjs
L1: import { spawn } from "node:child_process";
L2: import fs from "node:fs";
L3: import http from "node:http";
L4: import net from "node:net";
...
L9: import WebSocket from "ws";
L10: import { readChromeSession, writePrivateJson } from "./chrome-session-state.mjs";
L11: import { UnresponsiveTabGate } from "./unresponsive-tab-gate.mjs";
...
L22: }
L23: function defaultChromeProfilePath(homeDirectory = os.homedir()) {
L24: return path.join(homeDirectory, ".r5d", "browser", "chrome-profile");
...
L46: function resolveChromeExecutable(options = {}) {
L47: const env = options.env ?? process.env;
Findings
2 Critical2 High3 Medium5 Low
CriticalDownload Executedist/mjs/chrome-launcher.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/mjs/chrome-launcher.mjs
HighChild Processdist/mjs/chrome-launcher.mjs
HighEvaldist/mjs/browser-runtime.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @ricsam/r5d-browser@0.0.195-prod.1792260550650.gd8f2d7fc7c9762d014a957938fc657a9fe6a1c04.
See all versions of @ricsam/r5d-browser for other recorded verdicts.
- Review the evidence and your use of @ricsam/r5d-browser@0.0.195-prod.1792260550650.gd8f2d7fc7c9762d014a957938fc657a9fe6a1c04 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.