@roll-agent/browser-use-agent@0.27.2
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe runtime conditionally sends candidate and message data to a fixed default external recipient, with tracking enabled by default and no recipient-specific consent gate visible in the inspected path. The required token and user-invoked trigger limit activation, so the evidence supports a warning rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A user invokes zhipin_read_messages while an API token and agent ID are configured and tracking remains enabled.
Impact
Candidate identifiers and message previews may be disclosed to the default endpoint.
Mechanism
The tool sends unread-message event data in a bearer-authenticated POST to the configured recruitment-events endpoint, which defaults to huajune.duliday.com.
AI rationale
The runtime conditionally sends candidate and message data to a fixed default external recipient, with tracking enabled by default and no recipient-specific consent gate visible in the inspected path. The required token and user-invoked trigger limit activation, so the evidence supports a warning rather than a publish block.
Evidence
dist/index.js
Network endpoints1
huajune.duliday.com/api/v1/recruitment-events
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Runtime tracking defaults to enabled and uses https://huajune.duliday.com unless an API base URL override is set; sending also requires an API token and agent ID.
- The runtime posts event JSON with a bearer token to the configured recruitment-events endpoint.
- Unread-message events include candidate names and positions, message previews, unread counts, conversation IDs, and candidate IDs.
- The zhipin_read_messages tool invokes the tracking helper after reading candidates.
- The endpoint builder appends /api/v1/recruitment-events to the configured base URL.
Evidence against
- Sending requires an API token and agent ID, and the tracking setting can be disabled.
- The confirmed send is tied to a user-invoked message-reading tool; no install-time transfer was identified.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTrivial
Source & flagged code
5 flagged · loading sourcedist/index.jsView file
1Source sends the broad process environment to a literal external destination.
L1: var e,t,n,r,o,i,a=Object.defineProperty,s=Object.getOwnPropertyNames,c=(e,t,n)=>function(){if(n)throw n[0];try{return e&&(t=(0,e[s(e)[0]])(e=0)),t}catch(e){throw n=[e],e}},l=(e,t)=...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L11var e,t,n,r,o,i,a=Object.defineProperty,s=Object.getOwnPropertyNames,c=(e,t,n)=>function(){if(n)throw n[0];try{return e&&(t=(0,e[s(e)[0]])(e=0)),t}catch(e){throw n=[e],e}},l=(e,t)=...
High
1var e,t,n,r,o,i,a=Object.defineProperty,s=Object.getOwnPropertyNames,c=(e,t,n)=>function(){if(n)throw n[0];try{return e&&(t=(0,e[s(e)[0]])(e=0)),t}catch(e){throw n=[e],e}},l=(e,t)=...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsFindings
1 Critical4 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Fingerprint Signaturedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @roll-agent/browser-use-agent@0.27.2.
See all versions of @roll-agent/browser-use-agent for other recorded verdicts.
- Review the evidence and your use of @roll-agent/browser-use-agent@0.27.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.