chromatic@18.10.1
⚠ Under reviewAutomate visual testing across browsers. Gather UI feedback. Versioned documentation.
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe inspected source supports normal CLI and configuration functionality, but substantial bundled runtime code remains unresolved. The evidence does not establish an attack, so manual review is appropriate.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user invokes the Chromatic CLI or imports the package runtime.
Impact
The available source excerpts do not establish a malicious effect, but they are insufficient to resolve all bundled runtime behavior.
Mechanism
The package bundles CLI, network, configuration, and subprocess support; the inspected excerpts do not establish harmful behavior.
AI rationale
The inspected source supports normal CLI and configuration functionality, but substantial bundled runtime code remains unresolved. The evidence does not establish an attack, so manual review is appropriate.
Network endpoints1
index.chromatic.com
Decision evidence
public snapshotAI called this Manual Review at 57.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest maps the CLI commands to the package’s bundled CLI entrypoint.
- The runtime excerpt parses proxy CONNECT response headers.
- The configuration excerpt strips a byte order mark and parses the configuration file.
- The CLI client uses the configured Chromatic index URL for GraphQL requests.
- The inspected bundle excerpts show Unicode parsing tables and subprocess support code.
- The init helper writes a Chromatic script into the project package file.
Evidence against
- The CLI bundles many large modules, and the inspected excerpts do not resolve all of their runtime behavior.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
9 flaggeddist/execa-CoW7oosm.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = chromatic@18.9.5
matchedIdentity = npm:Y2hyb21hdGlj:18.9.5
similarity = 0.848
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/execa-CoW7oosm.cjsView on unpkg2!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`);let t=require(`node:util`),n=require(`node:child_process`),r=require(`node:fs`),i=require(`node:os`),a=require(`node:path`);a=e.a(a,1);let o...
L4: `?(--i,a+=1):e===`u`&&t[a+2]===`{`?a=t.indexOf(`}`,a+3):a+=De[e]??1}}let a=r===e.length;return a||n.push(e.slice(r)),{nextTokens:n,leadingWhitespaces:i,trailingWhitespaces:a}},Ee=n...
High
Child Process
Package source references child process execution.
dist/execa-CoW7oosm.cjsView on unpkg · L22!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`);let t=require(`node:util`),n=require(`node:child_process`),r=require(`node:fs`),i=require(`node:os`),a=require(`node:path`);a=e.a(a,1);let o...
L4: `?(--i,a+=1):e===`u`&&t[a+2]===`{`?a=t.indexOf(`}`,a+3):a+=De[e]??1}}let a=r===e.length;return a||n.push(e.slice(r)),{nextTokens:n,leadingWhitespaces:i,trailingWhitespaces:a}},Ee=n...
Findings
3 Critical5 High4 Medium5 Low
CriticalTrojan Source Unicodedist/v1-D13i-z9u.cjs
CriticalManifest Confusionpackage.json
CriticalPrevious Version Dangerous Deltadist/execa-CoW7oosm.cjs
HighChild Processdist/execa-CoW7oosm.cjs
HighShell
HighSame File Env Network Executiondist/noPackageJson-XI_fi2hi.cjs
HighCross File Remote Execution Contextdist/node-src-DPVizTG8.cjs
HighSemantic Analysis Limiteddist/v1-D13i-z9u.cjs
MediumDynamic Requiredist/execa-CoW7oosm.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
Affected versions and remediation
This report applies to chromatic@18.10.1.
See all versions of chromatic for other recorded verdicts.
- Review the evidence and your use of chromatic@18.10.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.