registry / browser4-cli / 0.1.27

browser4-cli@0.1.27

Browser automation CLI for AI agents

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 21.7 KB of source, external domains: browser4.oss-cn-beijing.aliyuncs.com, github.com, rustup.rs

Source & flagged code

6 flagged

package.jsonView file

Lines 7-47json

7 "bin",

8 "scripts",

9 "skill-data",

10 "skills"

11 ],

12 "bin": {

13 "browser4-cli": "./bin/browser4-cli.js",

14 "browser4": "./bin/browser4-cli.js"

15 },

16 "scripts": {

17 "version:sync": "node ../bin/version.mjs cli sync",

18 "version": "npm run version:sync && git add browser4-cli/Cargo.toml browser4-cli/Cargo.lock",

19 "build:native": "npm run version:sync && cargo build --release --manifest-path browser4-cli/Cargo.toml && node scripts/copy-native.js",

20 "build:linux": "npm run version:sync && docker compose -f docker/docker-compose.yml run --rm build-linux",

21 "build:macos": "npm run version:sync && (cargo build --release --manifest-path browser4-cli/Cargo.toml --target aarch64-apple-darwin & cargo build --release --manifest-path browser4-cli/Cargo.toml --target x86_64-apple-darwin & wait) && cp cli/target/aarch64-apple-darwin/release/browser4 bin/browser4-darwin-arm64 && cp cli/target/x86_64-apple-darwin/release/browser4 bin/browser4-darwin-x64",

22 "build:windows": "npm run version:sync && docker compose -f docker/docker-compose.yml run --rm build-windows",

23 "build:all-platforms": "npm run version:sync && (npm run build:linux & npm run build:windows & wait)",

24 "build:docker": "docker build -t browser4-builder -f docker/Dockerfile.build .",

25 "publish:if-needed": "node scripts/publish-if-needed.js",

26 "release": "npm run publish:if-needed",

27 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 },

29 "keywords": [

30 "browser",

31 "browser4",

32 "browser4-cli",

33 "automation",

34 "headless",

35 "chrome",

36 "cdp",

37 "cli",

38 "agent"

39 ],

40 "license": "Apache-2.0",

41 "repository": {

42 "type": "git",

43 "url": "git+https://github.com/platonai/Browser4.git"

44 },

45 "bugs": {

46 "url": "https://github.com/platonai/Browser4/issues"

47 },

scripts/postinstall.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

3/**

4 * Postinstall script for browser4

5 *

6 * Downloads the platform-specific native binary if not present.

7 * On global installs, patches npm's bin entry to use the native binary directly:

8 * - Windows: Overwrites .cmd/.ps1 shims

9 * - Mac/Linux: Replaces symlink to point to native binary

10 */

12import { existsSync, mkdirSync, chmodSync, createWriteStream, unlinkSync, writeFileSync, symlinkSync, lstatSync } from

bin/browser4-cli-linux-arm64View file

•path = bin/browser4-cli-linux-arm64 kind = native_binary sizeBytes = 9742368 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/browser4-cli-linux-arm64View on unpkg

scripts/build-all-platforms.ps1View file

•path = scripts/build-all-platforms.ps1 kind = build_helper sizeBytes = 3339 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-all-platforms.ps1View on unpkg

scripts/tests/install-browser4-cli.tests.ps1View file

•path = scripts/tests/install-browser4-cli.tests.ps1 kind = payload_in_excluded_dir sizeBytes = 13741 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

scripts/tests/install-browser4-cli.tests.ps1View on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

15import { platform, arch } from 'os'; L16: import { get } from 'https'; L17: import { execSync } from 'child_process'; L18: L19: const __dirname = dirname(fileURLToPath(import.meta.url)); L20: const projectRoot = join(__dirname, '..'); ... L41: // Package info L42: const packageJson = JSON.parse( L43: (await import('fs')).readFileSync(join(projectRoot, 'package.json'), 'utf8') L44: ); ... L53: // 1 — Locale env vars (Unix, Git Bash, WSL, Docker) L54: const lang = process.env.LC_ALL

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.jsView on unpkg · L15

bin/browser4-cli-linux-arm64View file

•path = bin/browser4-cli-linux-arm64 kind = native_binary sizeBytes = 9742368 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/browser4-cli-linux-arm64View on unpkg

scripts/build-all-platforms.ps1View file

•path = scripts/build-all-platforms.ps1 kind = build_helper sizeBytes = 3339 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-all-platforms.ps1View on unpkg

scripts/tests/install-browser4-cli.tests.ps1View file

•path = scripts/tests/install-browser4-cli.tests.ps1 kind = payload_in_excluded_dir sizeBytes = 13741 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

scripts/tests/install-browser4-cli.tests.ps1View on unpkg

Findings

3 High6 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilityscripts/postinstall.js

HighPayload In Excluded Dirscripts/tests/install-browser4-cli.tests.ps1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarybin/browser4-cli-linux-arm64

MediumShips Build Helperscripts/build-all-platforms.ps1

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 7-47json

7 "bin",

8 "scripts",

9 "skill-data",

10 "skills"

11 ],

12 "bin": {

13 "browser4-cli": "./bin/browser4-cli.js",

14 "browser4": "./bin/browser4-cli.js"

15 },

16 "scripts": {

17 "version:sync": "node ../bin/version.mjs cli sync",

18 "version": "npm run version:sync && git add browser4-cli/Cargo.toml browser4-cli/Cargo.lock",

19 "build:native": "npm run version:sync && cargo build --release --manifest-path browser4-cli/Cargo.toml && node scripts/copy-native.js",

20 "build:linux": "npm run version:sync && docker compose -f docker/docker-compose.yml run --rm build-linux",

22 "build:windows": "npm run version:sync && docker compose -f docker/docker-compose.yml run --rm build-windows",

23 "build:all-platforms": "npm run version:sync && (npm run build:linux & npm run build:windows & wait)",

24 "build:docker": "docker build -t browser4-builder -f docker/Dockerfile.build .",

25 "publish:if-needed": "node scripts/publish-if-needed.js",

26 "release": "npm run publish:if-needed",

27 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 },

29 "keywords": [

30 "browser",

31 "browser4",

32 "browser4-cli",

33 "automation",

34 "headless",

35 "chrome",

36 "cdp",

37 "cli",

38 "agent"

39 ],

40 "license": "Apache-2.0",

41 "repository": {

42 "type": "git",

43 "url": "git+https://github.com/platonai/Browser4.git"

44 },

45 "bugs": {

46 "url": "https://github.com/platonai/Browser4/issues"

47 },

scripts/postinstall.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

3/**

4 * Postinstall script for browser4

5 *

6 * Downloads the platform-specific native binary if not present.

7 * On global installs, patches npm's bin entry to use the native binary directly:

8 * - Windows: Overwrites .cmd/.ps1 shims

9 * - Mac/Linux: Replaces symlink to point to native binary

10 */

12import { existsSync, mkdirSync, chmodSync, createWriteStream, unlinkSync, writeFileSync, symlinkSync, lstatSync } from

bin/browser4-cli-linux-arm64View file

•path = bin/browser4-cli-linux-arm64 kind = native_binary sizeBytes = 9742368 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/browser4-cli-linux-arm64View on unpkg

scripts/build-all-platforms.ps1View file

•path = scripts/build-all-platforms.ps1 kind = build_helper sizeBytes = 3339 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-all-platforms.ps1View on unpkg

scripts/tests/install-browser4-cli.tests.ps1View file

•path = scripts/tests/install-browser4-cli.tests.ps1 kind = payload_in_excluded_dir sizeBytes = 13741 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

scripts/tests/install-browser4-cli.tests.ps1View on unpkg