auto-chrome-mcp-bridge@1.8.0: Suspicious npm security report | LPM Firewall

Loading npm security reports…

auto-chrome-mcp-bridge@1.8.0: Suspicious npm security report | LPM Firewall

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const f='dist/scripts/postinstall.js';require('fs').existsSync(f)&&require('child_process').execFileSync(process.execPath,[f],{stdio:'inherit'})"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•matchType = token_shingles matchedPackage = auto-chrome-mcp-bridge@1.10.0 matchedPath = package.json matchedIdentity = npm:YXV0by1jaHJvbWUtbWNwLWJyaWRnZQ:1.10.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

package.jsonView on unpkg

•scripts.postinstall = node -e "const f='dist/scripts/postinstall.js';require('fs').existsSync(f)&&require('child_process').execFileSync(process.execPath,[f],{stdio:'inherit'})"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/scripts/doctor.jsView file

424package = auto-chrome-mcp-bridge; repositoryIdentity = auto-chrome-mcp; dependency = node-fetch L424: try { L425: const mod = require('node-fetch'); L426: return ((_a = mod.default) !== null && _a !== void 0 ? _a : mod);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/scripts/doctor.jsView on unpkg · L424

•matchType = normalized_sha256 matchedPackage = auto-chrome-mcp-bridge@1.6.0 matchedPath = dist/scripts/doctor.js matchedIdentity = npm:YXV0by1jaHJvbWUtbWNwLWJyaWRnZQ:1.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/doctor.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = auto-chrome-mcp-bridge@1.13.0 matchedIdentity = npm:YXV0by1jaHJvbWUtbWNwLWJyaWRnZQ:1.13.0 similarity = 0.606 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/scripts/doctor.jsView on unpkg

dist/run_host.shView file

•path = dist/run_host.sh kind = build_helper sizeBytes = 9803 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/run_host.shView on unpkg

dist/scripts/postinstall.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/scripts/postinstall.js#virtual:normalized:round1View on unpkg

dist/scripts/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = auto-chrome-mcp-bridge@1.6.0 matchedPath = dist/scripts/postinstall.js matchedIdentity = npm:YXV0by1jaHJvbWUtbWNwLWJyaWRnZQ:1.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/postinstall.jsView on unpkg

dist/scripts/utils.jsView file

•matchType = normalized_sha256 matchedPackage = auto-chrome-mcp-bridge@1.10.0 matchedPath = dist/scripts/utils.js matchedIdentity = npm:YXV0by1jaHJvbWUtbWNwLWJyaWRnZQ:1.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/utils.jsView on unpkg

dist/scripts/browser-config.jsView file

•matchType = normalized_sha256 matchedPackage = auto-chrome-mcp-bridge@1.10.0 matchedPath = dist/scripts/browser-config.js matchedIdentity = npm:YXV0by1jaHJvbWUtbWNwLWJyaWRnZQ:1.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/browser-config.jsView on unpkg

dist/scripts/report.jsView file

•matchType = normalized_sha256 matchedPackage = auto-chrome-mcp-bridge@1.10.0 matchedPath = dist/scripts/report.js matchedIdentity = npm:YXV0by1jaHJvbWUtbWNwLWJyaWRnZQ:1.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/report.jsView on unpkg

dist/mcp/mcp-server-stdio.jsView file

•matchType = normalized_sha256 matchedPackage = auto-chrome-mcp-bridge@1.10.0 matchedPath = dist/mcp/mcp-server-stdio.js matchedIdentity = npm:YXV0by1jaHJvbWUtbWNwLWJyaWRnZQ:1.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp/mcp-server-stdio.jsView on unpkg

dist/file-handler.jsView file

•matchType = normalized_sha256 matchedPackage = auto-chrome-mcp-bridge@1.10.0 matchedPath = dist/file-handler.js matchedIdentity = npm:YXV0by1jaHJvbWUtbWNwLWJyaWRnZQ:1.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/file-handler.jsView on unpkg

dist/transports/playwright/cdp-client.jsView file

•matchType = normalized_sha256 matchedPackage = auto-chrome-mcp-bridge@1.10.0 matchedPath = dist/transports/playwright/cdp-client.js matchedIdentity = npm:YXV0by1jaHJvbWUtbWNwLWJyaWRnZQ:1.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/transports/playwright/cdp-client.jsView on unpkg