registry / @ricsam/r5d-browser / 0.0.195-prod.1793226453499.gd230f00c81a5c6aa140e8a80544fd8b42794e205
@ricsam/r5d-browser@0.0.195-prod.1793226453499.gd230f00c81a5c6aa140e8a80544fd8b42794e205
`r5d-browser start` updates the client automatically. It checks the authenticated environment's selected release once a minute and stages verified packages privately using npm. After the current action finishes, it reconnects a new CLI process to the same
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe inspected credential flow is bound to the configured service, and browser startup requires HTTPS. The dynamic evaluation and network operations are tied to user-invoked browser actions; no unrelated credential transfer was established.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes the browser start or authentication command.
Impact
No unrelated credential recipient or other concrete attack impact was established.
Mechanism
The client resolves its configured service and credential, requires HTTPS, then registers and relays browser activity to that service; secret filling is restricted to the expected page origin.
AI rationale
The inspected credential flow is bound to the configured service, and browser startup requires HTTPS. The dynamic evaluation and network operations are tied to user-invoked browser actions; no unrelated credential transfer was established.
Evidence
dist/mjs/personal-main.mjsdist/mjs/main.mjs
Network endpoints1
r5d.dev
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The manifest points to a CLI entrypoint and declares no install lifecycle hook.
- Browser startup resolves the service origin and credential from caller options, configuration, or environment, requires HTTPS, and sends bearer-authenticated requests to that origin with redirects rejected.
- Registration sends the selected credential to the configured service; saved browser state is scoped to a hash of that origin.
- Secret-fill requests use the same configured service, and page-side insertion checks that the current page matches the expected origin.
- JavaScript evaluation is an explicit browser action; navigation observation listens for navigation events and removes its listeners when finished.
- The core bundle includes a helper that starts a Node subprocess for a page-specific dashboard daemon.
- The utilities bundle includes a subprocess helper that adds an optional target argument before spawning a command.
- The locale files contain localized validation-message sizing or formatting code; kh.js is a compatibility wrapper that delegates to km.js.
Evidence against
Behavioral surface
Source & flagged code
5 flaggeddist/mjs/browser-secret-fill.mjsView file
118patternName = generic_password
severity = medium
line = 118
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/mjs/browser-secret-fill.mjsView on unpkg · L118dist/mjs/chrome-launcher.mjsView file
1import { spawn } from "node:child_process";
L2: import fs from "node:fs";
L3: import http from "node:http";
L4: import net from "node:net";
...
L9: import WebSocket from "ws";
L10: import { readChromeSession, writePrivateJson } from "./chrome-session-state.mjs";
L11: import { UnresponsiveTabGate } from "./unresponsive-tab-gate.mjs";
...
L22: }
L23: function defaultChromeProfilePath(homeDirectory = os.homedir()) {
L24: return path.join(homeDirectory, ".r5d", "browser", "chrome-profile");
...
L32: const PLATFORM_NAMES = { linux: "Linux", win32: "Windows", freebsd: "FreeBSD", openbsd: "OpenBSD" };
L33: function assertSupportedPlatform(platform = process.platform) {
Critical
Download Execute
Findings
2 Critical2 High4 Medium4 Low
CriticalDownload Executedist/mjs/chrome-launcher.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/mjs/chrome-launcher.mjs
HighChild Processdist/mjs/chrome-launcher.mjs
HighEvaldist/mjs/browser-runtime.mjs
MediumSecret Patterndist/mjs/browser-secret-fill.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @ricsam/r5d-browser@0.0.195-prod.1793226453499.gd230f00c81a5c6aa140e8a80544fd8b42794e205.
See all versions of @ricsam/r5d-browser for other recorded verdicts.
- Review the evidence and your use of @ricsam/r5d-browser@0.0.195-prod.1793226453499.gd230f00c81a5c6aa140e8a80544fd8b42794e205 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.