@roll-agent/browser-use-agent@0.27.1
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe runtime entrypoint contains a default-enabled tracking path that sends candidate and message records to a package-selected external endpoint. This is concrete data disclosure, so the package should be blocked.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Using the runtime with recruitment event tracking enabled, an API token, and an agent ID; tracking is enabled by default.
Impact
Candidate identifiers, message previews, and sent message content may be disclosed to the tracking service.
Mechanism
Message event callbacks submit event records in an authenticated POST to the configured tracking endpoint, which defaults to huajune.duliday.com.
Attack narrative
The runtime defaults recruitment event tracking to enabled. On message events, it collects candidate and conversation details, including sent message content, and posts the records to a fixed external endpoint when an API token and agent ID are configured. The package exposes the tracker through its runtime entrypoint; no recipient-specific consent gate is evident in the inspected tracking path.
AI rationale
The runtime entrypoint contains a default-enabled tracking path that sends candidate and message records to a package-selected external endpoint. This is concrete data disclosure, so the package should be blocked.
Evidence
dist/index.js
Network endpoints1
huajune.duliday.com
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exports dist/index.js as its runtime entrypoint.
- Runtime tracking defaults to enabled and uses https://huajune.duliday.com unless an environment variable overrides the endpoint.
- When an API token and agent ID are available, the runtime POSTs event data with a bearer token to the configured endpoint.
- Message callbacks forward candidate names, positions, conversation identifiers, previews, and sent message content to the tracking event path.
Evidence against
- Sending requires a configured API token and an agent ID; the endpoint can be overridden through an environment variable.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTrivialUrlStrings
NoLicense
Source & flagged code
4 flagged · loading sourcedist/index.jsView file
1Source sends the broad process environment to a literal external destination.
L1: var e,t,n,r,o,i,a=Object.defineProperty,s=Object.getOwnPropertyNames,c=(e,t,n)=>function(){if(n)throw n[0];try{return e&&(t=(0,e[s(e)[0]])(e=0)),t}catch(e){throw n=[e],e}},l=(e,t)=...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L11var e,t,n,r,o,i,a=Object.defineProperty,s=Object.getOwnPropertyNames,c=(e,t,n)=>function(){if(n)throw n[0];try{return e&&(t=(0,e[s(e)[0]])(e=0)),t}catch(e){throw n=[e],e}},l=(e,t)=...
High
1var e,t,n,r,o,i,a=Object.defineProperty,s=Object.getOwnPropertyNames,c=(e,t,n)=>function(){if(n)throw n[0];try{return e&&(t=(0,e[s(e)[0]])(e=0)),t}catch(e){throw n=[e],e}},l=(e,t)=...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsFindings
1 Critical3 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighAi Review Evidencepackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @roll-agent/browser-use-agent@0.27.1.
See all versions of @roll-agent/browser-use-agent for other recorded verdicts.
- Avoid installing @roll-agent/browser-use-agent@0.27.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.