chromatic@17.8.0
Automate visual testing across browsers. Gather UI feedback. Versioned documentation.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection found a normal Chromatic CLI package: no lifecycle hook, no import-time malicious behavior, and risky primitives are tied to explicit CLI build/upload workflows. Network telemetry/API use and child process execution are package-aligned and user-invoked.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs chromatic/chroma CLI or imports package entrypoints
Impact
Expected visual testing CLI behavior; no install-time persistence, credential harvesting, or agent control-surface mutation found
Mechanism
Storybook build, metadata collection, upload, and service polling
AI rationale
Static inspection found a normal Chromatic CLI package: no lifecycle hook, no import-time malicious behavior, and risky primitives are tied to explicit CLI build/upload workflows. Network telemetry/API use and child process execution are package-aligned and user-invoked.
Evidence
package.jsonisChromatic.jsisChromatic.mjsdist/bin.cjsdist/node.cjsdist/main-D2_P43hc.cjsdist/node-src-NjW8_TQU.cjsdist/build-CjuKDeXS.cjsdist/execa-B9cO2acC.cjs
Network endpoints3
www.chromatic.comstatus.chromatic.com4fa173db2ef3fb073b8ea153a5466d28@o4504181686599680.ingest.us.sentry.io/4507930289373184
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no lifecycle scripts; bin only maps chroma/chromatic/chromatic-cli to dist/bin.cjs
- isChromatic.js and isChromatic.mjs only inspect browser userAgent/location for Chromatic markers
- dist/bin.cjs dispatches explicit CLI subcommands and loads dotenv config; no install-time execution
- dist/node-src-NjW8_TQU.cjs network calls use Chromatic build/share APIs and user/project tokens for the CLI service
- child_process/execa use is for user-invoked Storybook/React Native build commands, not hidden execution
- scanner unicode hit is bundled parser/entity Unicode tables in dist/build-CjuKDeXS.cjs, not Trojan Source control flow
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
Source & flagged code
4 flaggeddist/build-CjuKDeXS.cjsView file
4contains invisible/control Unicode U+FEFF (zero width no-break space)
`?(c++,u=0):e?u+=e.length:u++,e&&(s+=e.length),e}let C={default(){switch(y){case` `:case`\v`:case`\f`:case` `:case`\xA0`:case`<U+FEFF>`:case`
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/build-CjuKDeXS.cjsView on unpkg · L42!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`),t=require(`./src-C0CbP6lv.cjs`),n=require(`./meow-BJmmmeH9.cjs`),r=require(`./execa-B9cO2acC.cjs`);let a=require(`fs`),o=require(`path`);o=e...
L4: `?(c++,u=0):e?u+=e.length:u++,e&&(s+=e.length),e}let C={default(){switch(y){case` `:case`\v`:case`\f`:case` `:case`\xA0`:case``:case`
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/build-CjuKDeXS.cjsView on unpkg · L2dist/node-src-NjW8_TQU.cjsView file
Findings
2 Critical1 High4 Medium4 Low
CriticalTrojan Source Unicodedist/build-CjuKDeXS.cjs
CriticalManifest Confusionpackage.json
HighOversized Source Filedist/node-src-NjW8_TQU.cjs
MediumDynamic Requiredist/build-CjuKDeXS.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to chromatic@17.8.0.
See all versions of chromatic for other recorded verdicts.
- Review the evidence and your use of chromatic@17.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.