registry / @ricsam/r5d-browser / 0.0.195-prod.1792393750386.gb3276490e1b6b422c981fb91170b66cd79b34497
@ricsam/r5d-browser@0.0.195-prod.1792393750386.gb3276490e1b6b422c981fb91170b66cd79b34497
`r5d-browser start` updates the client automatically. It checks the authenticated environment's selected release once a minute and stages verified packages privately using npm. After the current action finishes, it reconnects a new CLI process to the same
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe manifest and runtime paths support a user-started browser connector, and the credential requests use the resolved HTTPS server origin with redirects rejected. Chrome launch, page-code evaluation, and navigation monitoring are runtime browser features; the inspected source did not establish an attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the r5d-browser CLI to start the browser client.
Impact
No unauthorized credential transfer or other concrete attack effect was established.
Mechanism
The client registers with the resolved HTTPS server, launches local Chrome, and handles browser actions, including supplied page code.
AI rationale
The manifest and runtime paths support a user-started browser connector, and the credential requests use the resolved HTTPS server origin with redirects rejected. Chrome launch, page-code evaluation, and navigation monitoring are runtime browser features; the inspected source did not establish an attack.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI entry and runtime dependencies; its inspected manifest contains no lifecycle script.
- The CLI parses user arguments and starts the browser client from its command path.
- Connection settings come from flags, config, or environment; the client requires an HTTPS origin and a credential.
- Registration sends the credential to that origin, rejects redirects, and is called with the resolved origin and token during browser startup.
- Chrome is launched as a local executable, and the browser runtime evaluates supplied code as part of its artifact action.
- The navigation observer watches page navigation events and checks requested URL patterns.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/mjs/chrome-launcher.mjsView file
1import { spawn } from "node:child_process";
L2: import fs from "node:fs";
L3: import http from "node:http";
L4: import net from "node:net";
...
L9: import WebSocket from "ws";
L10: import { readChromeSession, writePrivateJson } from "./chrome-session-state.mjs";
L11: import { UnresponsiveTabGate } from "./unresponsive-tab-gate.mjs";
...
L22: }
L23: function defaultChromeProfilePath(homeDirectory = os.homedir()) {
L24: return path.join(homeDirectory, ".r5d", "browser", "chrome-profile");
...
L32: const PLATFORM_NAMES = { linux: "Linux", win32: "Windows", freebsd: "FreeBSD", openbsd: "OpenBSD" };
L33: function assertSupportedPlatform(platform = process.platform) {
Critical
Download Execute
Source downloads or fetches remote code and executes it.
dist/mjs/chrome-launcher.mjsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/mjs/main.mjs -> dist/mjs/chrome-launcher.mjs
L1: import { spawn } from "node:child_process";
L2: import fs from "node:fs";
L3: import http from "node:http";
L4: import net from "node:net";
...
L9: import WebSocket from "ws";
L10: import { readChromeSession, writePrivateJson } from "./chrome-session-state.mjs";
L11: import { UnresponsiveTabGate } from "./unresponsive-tab-gate.mjs";
...
L22: }
L23: function defaultChromeProfilePath(homeDirectory = os.homedir()) {
L24: return path.join(homeDirectory, ".r5d", "browser", "chrome-profile");
...
L32: const PLATFORM_NAMES = { linux: "Linux", win32: "Windows", freebsd: "FreeBSD", openbsd: "OpenBSD" };
L33: function assertSupportedPlatform(platform = process.platform) {
Findings
3 Critical2 High3 Medium4 Low
CriticalDownload Executedist/mjs/chrome-launcher.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/mjs/chrome-launcher.mjs
CriticalPrevious Version Dangerous Deltadist/mjs/chrome-launcher.mjs
HighChild Processdist/mjs/chrome-launcher.mjs
HighEvaldist/mjs/browser-runtime.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @ricsam/r5d-browser@0.0.195-prod.1792393750386.gb3276490e1b6b422c981fb91170b66cd79b34497.
See all versions of @ricsam/r5d-browser for other recorded verdicts.
- Review the evidence and your use of @ricsam/r5d-browser@0.0.195-prod.1792393750386.gb3276490e1b6b422c981fb91170b66cd79b34497 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.