registry / @ricsam/r5d-browser / 0.0.195-prod.1792965659952.gfe09c00f8f80bcc7111ce3630535710c70d46442
@ricsam/r5d-browser@0.0.195-prod.1792965659952.gfe09c00f8f80bcc7111ce3630535710c70d46442
`r5d-browser start` updates the client automatically. It checks the authenticated environment's selected release once a minute and stages verified packages privately using npm. After the current action finishes, it reconnects a new CLI process to the same
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe manifest exposes a CLI entrypoint without an install lifecycle hook, and the inspected runtime sends credentials to the resolved HTTPS r5d server for browser registration. Scanner flags map to ordinary browser automation, including a local browser-state check; no separate malicious behavior was identified.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes the browser CLI or an authentication command; the manifest declares no install lifecycle hook.
Impact
No unrelated credential transfer, stealth execution, or install-time mutation was identified.
Mechanism
The client resolves its credential and server from caller options or configuration, environment, and default settings, then registers the browser with that server. The launcher uses installed Chrome.
AI rationale
The manifest exposes a CLI entrypoint without an install lifecycle hook, and the inspected runtime sends credentials to the resolved HTTPS r5d server for browser registration. Scanner flags map to ordinary browser automation, including a local browser-state check; no separate malicious behavior was identified.
Network endpoints1
r5d.dev
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI entrypoint and lists dependencies without an install lifecycle hook; main.mjs handles user-invoked commands.
- The browser connection resolves its credential and server from caller options, configuration, environment, or the documented default; it requires HTTPS and sends the credential as a bearer token to that server’s browser registration route.
- The inspected evaluate call checks navigator.webdriver on a newly opened about:blank tab; navigation observation listens for events on a supplied browser page.
- The dependency excerpts show browser automation, protocol validation, artifact transfer, and localization modules; no unrelated credential recipient or install-time payload path was identified.
Evidence against
- The alleged download-and-execute behavior was not found in chrome-launcher; the inspected launcher starts a locally validated Chrome executable, and its evaluate call performs a browser-state check.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
5 flaggeddist/mjs/browser-secret-fill.mjsView file
118patternName = generic_password
severity = medium
line = 118
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/mjs/browser-secret-fill.mjsView on unpkg · L118dist/mjs/chrome-launcher.mjsView file
1import { spawn } from "node:child_process";
L2: import fs from "node:fs";
L3: import http from "node:http";
L4: import net from "node:net";
...
L9: import WebSocket from "ws";
L10: import { readChromeSession, writePrivateJson } from "./chrome-session-state.mjs";
L11: import { UnresponsiveTabGate } from "./unresponsive-tab-gate.mjs";
...
L22: }
L23: function defaultChromeProfilePath(homeDirectory = os.homedir()) {
L24: return path.join(homeDirectory, ".r5d", "browser", "chrome-profile");
...
L32: const PLATFORM_NAMES = { linux: "Linux", win32: "Windows", freebsd: "FreeBSD", openbsd: "OpenBSD" };
L33: function assertSupportedPlatform(platform = process.platform) {
Critical
Download Execute
Findings
2 Critical2 High4 Medium4 Low
CriticalDownload Executedist/mjs/chrome-launcher.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/mjs/chrome-launcher.mjs
HighChild Processdist/mjs/chrome-launcher.mjs
HighEvaldist/mjs/browser-runtime.mjs
MediumSecret Patterndist/mjs/browser-secret-fill.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @ricsam/r5d-browser@0.0.195-prod.1792965659952.gfe09c00f8f80bcc7111ce3630535710c70d46442.
See all versions of @ricsam/r5d-browser for other recorded verdicts.
- Review the evidence and your use of @ricsam/r5d-browser@0.0.195-prod.1792965659952.gfe09c00f8f80bcc7111ce3630535710c70d46442 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.