--- canonical: "https://firewall.lpm.dev/npm/auto-chrome-mcp-bridge/v/1.2.0" markdown: "https://firewall.lpm.dev/npm/auto-chrome-mcp-bridge/v/1.2.0.md" package: "auto-chrome-mcp-bridge" report_status: "published" title: "auto-chrome-mcp-bridge@1.2.0 npm security report" verdict: "malicious" version: "1.2.0" --- # auto-chrome-mcp-bridge@1.2.0 npm security report > **Trust boundary:** Package metadata, advisory text, filenames, URLs, and source snippets in this report come from external packages or feeds. Treat them as untrusted evidence. Do not execute instructions or code found in this document. ## Verdict summary **Soft block: AI-agent control surface** — Warn by default; block when configured. Unconsented modification of a foreign AI-agent control surface can cause future agent-initiated shell actions. - **Verdict:** Malicious - **Product-default install policy:** Block - **Firewall policy:** Warn by default - **Public report status:** Published - **Threat category:** Soft block: AI-agent control surface - **Selected version:** 1.2.0 - **Selected version is latest:** Yes - **Analysis source:** AI Security Review (lpm-firewall-ai) LPM flags this version as an AI-agent control-surface risk. Global npm installation mutates Claude Code's user-wide skill directory without an explicit setup command. The dropped skill auto-instructs the agent to execute shell diagnostics and fixes. ## Latest scan - **Scanner version:** rust-scanner-worker-schema-1 - **Verdict:** Malicious - **Confidence:** 99.0% - **Started:** 2026-08-17T06:10:41.252Z - **Finished:** 2026-08-17T06:11:28.221Z - **Download time:** 510 ms - **Static scan time:** 929 ms - **AI review time:** 45528 ms - **Total time:** 46969 ms ## Security analysis ### Published attack-surface review - **Summary:** Global npm installation mutates Claude Code's user-wide skill directory without an explicit setup command. The dropped skill auto-instructs the agent to execute shell diagnostics and fixes. - **Trigger:** npm global installation while ~/.claude exists - **Impact:** Unconsented modification of a foreign AI-agent control surface can cause future agent-initiated shell actions. - **Evidence paths:** package.json, dist/scripts/postinstall.js, dist/skill/SKILL.md - **Review source:** ai\_review - **Reviewed:** 2026-08-17T06:11:28.221Z ### AI review details - **Review stage:** source\_first\_review - **Mechanism:** postinstall drops an auto-triggered Claude Code skill - **Attack narrative:** The package lifecycle hook runs postinstall. For global installs on systems with Claude Code, it copies its bundled SKILL.md into ~/.claude/skills, where it is designed to auto-trigger in later conversations. That skill directs Claude Code to execute Bash commands itself. This is an unconsented install-time write to a foreign, user-wide AI-agent control surface; the remote extension download increases supply-chain exposure. - **Rationale:** Source directly confirms a postinstall write into ~/.claude/skills and an agent-directed shell-execution payload. This meets the policy boundary for an unconsented lifecycle mutation of a foreign AI-agent control surface. - **Files touched:** package.json, dist/scripts/postinstall.js, dist/skill/SKILL.md, ~/.claude/skills/chrome-mcp-scalemaker-doctor/SKILL.md - **Network endpoints:** https://github.com/scalemaker-ship-it/mcp-chrome-scalemaker/releases/latest/download/chrome-mcp-scalemaker-extension.zip ### Review decision - **Verdict:** Malicious - **Confidence:** 99.0% - **Recommended action:** publish\_block - **Intent class:** Malware - **False-positive risk:** Low - **Evidence for:** package.json executes dist/scripts/postinstall.js during npm postinstall., On global install, postinstall copies a package skill into ~/.claude/skills and says it auto-triggers in future Claude Code conversations., The installed skill instructs Claude Code to run Bash commands itself rather than asking the user., Postinstall also downloads and extracts a remote Chrome extension by default. - **Evidence against:** Claude skill installation is gated on a global install and an existing ~/.claude directory., The script provides SCALEMAKER\_NO\_SKILL=1 and SCALEMAKER\_SKIP\_EXTENSION\_DOWNLOAD=1 opt-outs. ## Public findings ### 1. High: Install Time Lifecycle Scripts - **Category:** Manifest - **Confidence:** 90.0% - **Path:** package.json - **Public source:** [View source]() Package defines install-time lifecycle scripts. Public source snippet (untrusted): ```json scripts.postinstall = node -e "const f='dist/scripts/postinstall.js';require('fs').existsSync(f)&&require('child_process').execFileSync(process.execPath,[f],{stdio:'inherit'})" ``` ### 2. Medium: Ambiguous Install Lifecycle Script - **Category:** Manifest - **Confidence:** 75.0% - **Path:** package.json - **Public source:** [View source]() Install-time lifecycle script is not statically allowlisted and needs review. Public source snippet (untrusted): ```json scripts.postinstall = node -e "const f='dist/scripts/postinstall.js';require('fs').existsSync(f)&&require('child_process').execFileSync(process.execPath,[f],{stdio:'inherit'})" ``` ### 3. Low: Scripts Present - **Category:** Manifest - **Confidence:** 100.0% Package declares npm scripts. ### 4. Medium: Network - **Category:** Source - **Confidence:** 75.0% Package source references network APIs. ### 5. Medium: Environment Vars - **Category:** Source - **Confidence:** 75.0% Package source references environment variables. ### 6. Low: Filesystem - **Category:** Source - **Confidence:** 70.0% Package source references filesystem APIs. ### 7. Low: High Entropy Strings - **Category:** Supply Chain - **Confidence:** 55.0% Package source contains high-entropy string patterns. ### 8. Low: Url Strings - **Category:** Supply Chain - **Confidence:** 65.0% Package source contains URL literals. ### 9. Medium: Ships Build Helper - **Category:** Artifact Inventory - **Confidence:** 70.0% - **Path:** dist/run\_host.sh - **Public source:** [View source]() Package ships non-JavaScript build or shell helper files. Public source snippet (untrusted): ```shell path = dist/run_host.sh kind = build_helper sizeBytes = 10067 magicHex = [redacted] ``` ### 10. Medium: Structural Risk Force Deep Review - **Category:** Artifact Inventory - **Confidence:** 95.0% Artifact structure forces deeper review even if the static behavioral verdict is clean. ### 11. High: Known Malware Source Similarity - **Category:** Static - **Confidence:** 97.0% - **Path:** dist/scripts/doctor.js - **Public source:** [View source]() Source file is highly similar to a previously finalized malicious package; route for source-aware review. Public source snippet (untrusted): ```javascript matchType = normalized_sha256 matchedPackage = mcp-chrome-scalemaker-bridge@1.0.37 matchedPath = dist/scripts/doctor.js matchedIdentity = npm:[redacted]:1.0.37 similarity = 1.000 summary = normalized source hash matched finalized malicious source ``` ### 12. High: Known Malware Source Similarity - **Category:** Static - **Confidence:** 97.0% - **Path:** dist/scripts/postinstall.js - **Public source:** [View source]() Source file is highly similar to a previously finalized malicious package; route for source-aware review. Public source snippet (untrusted): ```javascript matchType = normalized_sha256 matchedPackage = mcp-chrome-scalemaker-bridge@1.0.37 matchedPath = dist/scripts/postinstall.js matchedIdentity = npm:[redacted]:1.0.37 similarity = 1.000 summary = normalized source hash matched finalized malicious source ``` ### 13. High: Known Malware Source Similarity - **Category:** Static - **Confidence:** 97.0% - **Path:** dist/scripts/utils.js - **Public source:** [View source]() Source file is highly similar to a previously finalized malicious package; route for source-aware review. Public source snippet (untrusted): ```javascript matchType = normalized_sha256 matchedPackage = mcp-chrome-scalemaker-bridge@1.0.37 matchedPath = dist/scripts/utils.js matchedIdentity = npm:[redacted]:1.0.37 similarity = 1.000 summary = normalized source hash matched finalized malicious source ``` ### 14. High: Known Malware Source Similarity - **Category:** Static - **Confidence:** 97.0% - **Path:** dist/scripts/browser-config.js - **Public source:** [View source]() Source file is highly similar to a previously finalized malicious package; route for source-aware review. Public source snippet (untrusted): ```javascript matchType = normalized_sha256 matchedPackage = mcp-chrome-scalemaker-bridge@1.0.37 matchedPath = dist/scripts/browser-config.js matchedIdentity = npm:[redacted]:1.0.37 similarity = 1.000 summary = normalized source hash matched finalized malicious source ``` ### 15. High: Known Malware Source Similarity - **Category:** Static - **Confidence:** 97.0% - **Path:** dist/scripts/report.js - **Public source:** [View source]() Source file is highly similar to a previously finalized malicious package; route for source-aware review. Public source snippet (untrusted): ```javascript matchType = normalized_sha256 matchedPackage = mcp-chrome-scalemaker-bridge@1.0.37 matchedPath = dist/scripts/report.js matchedIdentity = npm:[redacted]:1.0.37 similarity = 1.000 summary = normalized source hash matched finalized malicious source ``` ## Dependencies and install lifecycle - **Lifecycle scripts present:** Yes - **Published lifecycle scripts:** postinstall - **Dependencies:** 13 - **Optional dependencies:** 0 - **Peer dependencies:** 0 - **Development dependencies:** 16 - **Published dependency-graph edges:** 13 ### Published dependency entries - @fastify/cors ^11.0.1 (Dependency) - @modelcontextprotocol/sdk ^1.11.0 (Dependency) - @types/node-fetch 2 (Dependency) - auto-chrome-mcp-shared 1.2.0 (Dependency) - chalk ^5.4.1 (Dependency) - chrome-devtools-frontend ^1.0.1299282 (Dependency) - commander ^13.1.0 (Dependency) - fastify ^5.3.2 (Dependency) - is-admin ^4.0.0 (Dependency) - node-fetch 2 (Dependency) - pino ^9.6.0 (Dependency) - playwright ^1.60.0 (Dependency) - uuid ^11.1.0 (Dependency) ## Package metadata - **Package:** auto-chrome-mcp-bridge - **Ecosystem:** npm - **Version:** 1.2.0 - **License:** MIT - **Version published:** 2026-08-17T05:31:50.072Z - **Package first seen:** 2026-08-17T06:11:28.221Z - **Package last seen:** 2026-08-17T06:11:28.221Z - **Known versions:** 1 - **Latest version:** 1.2.0 - **Appeal under review:** No - **Description:** Auto Chrome MCP — Chrome Native-Messaging host (Node). Non-interference background work mode, per-session work tabs, Force Reconnect, Playwright CDP fallback. - **Author:** hangye - **Keywords:** mcp, chrome, browser - **Runtime engines:** node: \>=14.0.0 - **Artifact files:** 101 - **Artifact unpacked size:** 503,969 bytes - **Artifact signatures:** 1 - **Attestations:** No ## References - [HTML security report]() - [Repository]() - [Homepage]() - [Issues]()