chromatic@18.12.0
Automate visual testing across browsers. Gather UI feedback. Versioned documentation.
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the reviewed runtime behavior aligns with the package’s CLI and browser-helper roles. The scanner’s process, network, and Unicode indicators resolve to CLI support code and parser data in the inspected excerpts.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The CLI runs when a user invokes its binary; the browser helper runs when imported and called.
Impact
No concrete harmful effect was established from the inspected source.
Mechanism
The reviewed CLI code dispatches user-selected commands and uses project configuration, network, and process helpers.
AI rationale
The manifest has no install lifecycle hook, and the reviewed runtime behavior aligns with the package’s CLI and browser-helper roles. The scanner’s process, network, and Unicode indicators resolve to CLI support code and parser data in the inspected excerpts.
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes browser and Node entrypoints plus a CLI binary, and declares no install lifecycle hook.
- The browser helper checks window properties and returns a boolean.
- The CLI dispatches commands from user arguments; its Node entrypoint exports project operations.
- The CLI configuration accepts a project token and defaults its service index to Chromatic.
- The flagged invisible characters occur in HTML entity data and tokenizer whitespace handling.
- The reviewed proxy and process helpers are CLI support code; no concrete attack behavior was established.
Evidence against
- The CLI includes network and subprocess functionality, and handles a project token, consistent with its project publishing workflow.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
7 flaggeddist/execa-CoW7oosm.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = chromatic@18.9.5
matchedIdentity = npm:Y2hyb21hdGlj:18.9.5
similarity = 0.818
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/execa-CoW7oosm.cjsView on unpkg2!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`);let t=require(`node:util`),n=require(`node:child_process`),r=require(`node:fs`),i=require(`node:os`),a=require(`node:path`);a=e.a(a,1);let o...
L4: `?(--i,a+=1):e===`u`&&t[a+2]===`{`?a=t.indexOf(`}`,a+3):a+=De[e]??1}}let a=r===e.length;return a||n.push(e.slice(r)),{nextTokens:n,leadingWhitespaces:i,trailingWhitespaces:a}},Ee=n...
High
Child Process
Package source references child process execution.
dist/execa-CoW7oosm.cjsView on unpkg · L22!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`);let t=require(`node:util`),n=require(`node:child_process`),r=require(`node:fs`),i=require(`node:os`),a=require(`node:path`);a=e.a(a,1);let o...
L4: `?(--i,a+=1):e===`u`&&t[a+2]===`{`?a=t.indexOf(`}`,a+3):a+=De[e]??1}}let a=r===e.length;return a||n.push(e.slice(r)),{nextTokens:n,leadingWhitespaces:i,trailingWhitespaces:a}},Ee=n...
Findings
3 Critical4 High4 Medium4 Low
CriticalTrojan Source Unicodedist/projectFiles-DFs5bRIH.cjs
CriticalManifest Confusionpackage.json
CriticalPrevious Version Dangerous Deltadist/execa-CoW7oosm.cjs
HighChild Processdist/execa-CoW7oosm.cjs
HighShell
HighCross File Remote Execution Contextdist/node-src-BYDrKYrs.cjs
HighSemantic Analysis Limiteddist/projectFiles-DFs5bRIH.cjs
MediumDynamic Requiredist/execa-CoW7oosm.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to chromatic@18.12.0.
See all versions of chromatic for other recorded verdicts.
- Review the evidence and your use of chromatic@18.12.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.