chromatic@18.0.1
⚠ Under reviewAutomate visual testing across browsers. Gather UI feedback. Versioned documentation.
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 13 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
Oversized source lightweight scan
dist/node-src-sDIzIkBG.cjs2.46 MB file, sampled 256 KB
ChildProcessEnvironmentVarsDynamicRequireObfuscatedHighEntropyStringsMinifiedUrlStringsstatus.chromatic.comwww.chromatic.com
Source & flagged code
6 flaggeddist/noPackageJson-BaD27O3j.cjsView file
2!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`),t=require(`./meow-CSiqYQZC.cjs`);let n=require(`fs`);n=e.a(n,1);let r=require(`path`);r=e.a(r,1);let i=require(`os`);i=e.a(i,1);let a=requir...
L4: `,t-1),[i,a]=re(n);return{line:r===-1?i:e.slice(0,r+1).match(/\n/g).length+i,column:t-r-1+a}}function ae(e,t,n){if(typeof e!=`string`)throw TypeError(`Text parameter should be a st...
High
Child Process
Package source references child process execution.
dist/noPackageJson-BaD27O3j.cjsView on unpkg · L22!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`),t=require(`./meow-CSiqYQZC.cjs`);let n=require(`fs`);n=e.a(n,1);let r=require(`path`);r=e.a(r,1);let i=require(`os`);i=e.a(i,1);let a=requir...
L4: `,t-1),[i,a]=re(n);return{line:r===-1?i:e.slice(0,r+1).match(/\n/g).length+i,column:t-r-1+a}}function ae(e,t,n){if(typeof e!=`string`)throw TypeError(`Text parameter should be a st...
L5: `);let t=0;for(;e[t]&&e[t].trim().match(/^(#|$)/);)t++;let n=e.length,r=t+1;for(;r<n&&e[r].trim();)r++;return e.slice(t,r).join(` `).trim()}})),_e=e.t(((e,t)=>{t.exports={topLevel:...
L6: `:`
L7: `,r=t.whitespace?` = `:`=`,i=[],a=t.
High
Same File Env Network Execution
Findings
2 Critical3 High4 Medium4 Low
CriticalTrojan Source Unicodedist/build-lRyJHy8j.cjs
CriticalManifest Confusionpackage.json
HighChild Processdist/noPackageJson-BaD27O3j.cjs
HighSame File Env Network Executiondist/noPackageJson-BaD27O3j.cjs
HighOversized Source Filedist/node-src-sDIzIkBG.cjs
MediumDynamic Requiredist/node.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to chromatic@18.0.1.
See all versions of chromatic for other recorded verdicts.
- Review the evidence and your use of chromatic@18.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.