registry / auto-chrome-mcp-bridge / 1.10.1

auto-chrome-mcp-bridge@1.10.1

Auto Chrome MCP — Chrome Native-Messaging host (Node). Non-interference background work mode, per-session work tabs, Force Reconnect, Playwright CDP fallback.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation mutates Claude Code’s user-wide skill control surface without an explicit setup command. A global install also retrieves and extracts an unpinned remote extension archive.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm global installation runs postinstall on a machine that already has Claude Code installed.

Impact

Future Claude Code conversations can be steered to execute the package’s troubleshooting commands; the downloaded extension can change independently of the reviewed package.

Mechanism

automatic Claude Code skill installation and remote extension retrieval

Policy narrative

The postinstall hook launches an installer. During a global install it downloads an unpinned extension archive, then copies its bundled SKILL.md into the user’s Claude Code skills directory. The copied skill is intended to activate in later conversations and directs the agent to run Bash commands itself. This is an unconsented install-time write to a foreign AI-agent control surface, with a remotely mutable additional payload.

Rationale

This package automatically installs an active Claude Code skill during npm postinstall and fetches a mutable remote extension. That is a concrete unconsented AI-agent control-surface mutation, not ordinary package setup.

Evidence

package.jsondist/scripts/postinstall.jsdist/skill/SKILL.md~/.claude/skills/auto-chrome-mcp-doctor/SKILL.md~/.auto-chrome-mcp/extension.zip~/Downloads/auto-chrome-mcp-extension-v<version>/

Network endpoints1

github.com/cw02326/auto-chrome-mcp/releases/latest/download/auto-chrome-mcp-extension.zip

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The npm postinstall hook executes the package installer automatically.
On global install, that installer downloads and extracts a mutable remote extension archive.
The installer copies a package skill into Claude Code’s user-wide skills directory and says it activates in the next conversation.
The installed skill instructs Claude Code to run shell commands directly rather than defer to the user.

Evidence against

The Claude Code mutation is limited to global installs where ~/.claude already exists and has an opt-out variable.
No source evidence shows credential harvesting or exfiltration.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 34 file(s), 352 KB of source, external domains: 127.0.0.1, github.com

Source & flagged code

9 flagged

package.jsonView file

Lines 67-89json

67 }

68 },

69 "lint-staged": {

70 "*.{js,ts}": [

71 "eslint --fix",

72 "prettier --write"

73 ],

74 "*.{json,md}": [

75 "prettier --write"

76 ]

77 },

78 "scripts": {

79 "dev": "nodemon --watch src --ext ts,js,json --ignore dist/ --exec \"npm run build && npm run register:dev\"",

80 "build": "ts-node src/scripts/build.ts",

81 "test": "jest",

82 "test:watch": "jest --watch",

83 "lint": "eslint 'src/**/*.{js,ts}'",

84 "lint:fix": "eslint 'src/**/*.{js,ts}' --fix",

85 "format": "prettier --write 'src/**/*.{js,ts,json}'",

86 "register:dev": "node dist/scripts/register-dev.js",

87 "postinstall": "node -e \"const f='dist/scripts/postinstall.js';require('fs').existsSync(f)&&require('child_process').execFileSync(process.execPath,[f],{stdio:'inherit'})\""

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L87

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L87

88 }

89}

dist/scripts/doctor.jsView file

Lines 408-448javascript

408 });

409 return fixes;

410}

411// ============================================================================

412// JSON File Reading

413// ============================================================================

414function readJsonFile(filePath) {

415 try {

416 const raw = fs_1.default.readFileSync(filePath, 'utf8');

417 return { ok: true, value: JSON.parse(raw) };

418 }

419 catch (e) {

420 return { ok: false, error: stringifyError(e) };

421 }

422}

423function resolveFetch() {

424 var _a;

425 if (typeof globalThis.fetch === 'function') {

426 return globalThis.fetch.bind(globalThis);

427 }

428 try {

429 const mod = require('node-fetch');

430 return ((_a = mod.default) !== null && _a !== void 0 ? _a : mod);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/scripts/doctor.jsView on unpkg · L428

431 }

432 catch (_b) {

433 return null;

434 }

435}

436/**

437 * auto-chrome-mcp fork v1.0.30+: bridge 의 actual listen port 들을 탐색.

438 *

439 * 동작:

440 * 1. `ps aux` 로 auto-chrome-mcp-bridge process (`dist/index.js`) 의 pid 들 수집.

441 * 2. 각 pid 에 `lsof -aPi -p <pid>` 호출 → LISTEN 라인의 port 파싱.

442 * 3. 그 port 들에 /ping 시도 → 응답 있는 port 만 responsivePorts 에 포함.

443 *

444 * Unix only (lsof + ps 사용). Windows 는 빈 결과 반환.

445 */

446async function probeActiveBridgePorts() {

447 const empty = { ports: [], responsivePorts: [] };

448 if (process.platform === 'win32')

dist/run_host.shView file

•path = dist/run_host.sh kind = build_helper sizeBytes = 9885 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/run_host.shView on unpkg

dist/scripts/postinstall.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/scripts/postinstall.js#virtual:normalized:round1View on unpkg

dist/scripts/utils.jsView file

•matchType = normalized_sha256 matchedPackage = logod-chrome-mcp@1.0.0 matchedPath = dist/scripts/utils.js matchedIdentity = npm:bG9nb2QtY2hyb21lLW1jcA:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/utils.jsView on unpkg

dist/scripts/browser-config.jsView file

•matchType = normalized_sha256 matchedPackage = logod-chrome-mcp@1.0.0 matchedPath = dist/scripts/browser-config.js matchedIdentity = npm:bG9nb2QtY2hyb21lLW1jcA:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/browser-config.jsView on unpkg

dist/scripts/report.jsView file

•matchType = normalized_sha256 matchedPackage = logod-chrome-mcp@1.0.0 matchedPath = dist/scripts/report.js matchedIdentity = npm:bG9nb2QtY2hyb21lLW1jcA:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/report.jsView on unpkg

dist/transports/playwright/cdp-client.jsView file

•matchType = normalized_sha256 matchedPackage = logod-chrome-mcp@1.0.0 matchedPath = dist/transports/playwright/cdp-client.js matchedIdentity = npm:bG9nb2QtY2hyb21lLW1jcA:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/transports/playwright/cdp-client.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const f='dist/scripts/postinstall.js';require('fs').existsSync(f)&&require('child_process').execFileSync(process.execPath,[f],{stdio:'inherit'})"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node -e "const f='dist/scripts/postinstall.js';require('fs').existsSync(f)&&require('child_process').execFileSync(process.execPath,[f],{stdio:'inherit'})"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/scripts/doctor.jsView file

428package = auto-chrome-mcp-bridge; repositoryIdentity = auto-chrome-mcp; dependency = node-fetch L428: try { L429: const mod = require('node-fetch'); L430: return ((_a = mod.default) !== null && _a !== void 0 ? _a : mod);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/scripts/doctor.jsView on unpkg · L428

dist/run_host.shView file

•path = dist/run_host.sh kind = build_helper sizeBytes = 9885 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/run_host.shView on unpkg

dist/scripts/postinstall.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/scripts/postinstall.js#virtual:normalized:round1View on unpkg

dist/scripts/utils.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/utils.jsView on unpkg

dist/scripts/browser-config.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/browser-config.jsView on unpkg

dist/scripts/report.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/report.jsView on unpkg

dist/transports/playwright/cdp-client.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/transports/playwright/cdp-client.jsView on unpkg

Findings

7 High5 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighCopied Package Dependency Bridgedist/scripts/doctor.js

HighSemantic Analysis Limiteddist/scripts/postinstall.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/scripts/utils.js

HighKnown Malware Source Similaritydist/scripts/browser-config.js

HighKnown Malware Source Similaritydist/scripts/report.js

HighKnown Malware Source Similaritydist/transports/playwright/cdp-client.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/run_host.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings