chromatic@18.12.2
Automate visual testing across browsers. Gather UI feedback. Versioned documentation.
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe source inspected supports ordinary Chromatic CLI and browser-helper behavior. Scanner flags for bundled process and network primitives did not establish credential disclosure, hidden execution, or unconsented mutation.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The CLI runs when a user invokes its command; project setup runs through `chromatic init`.
Impact
No confirmed malicious effect was found.
Mechanism
The browser helper checks browser markers. The inspected telemetry initialization is disabled, and the inspected process and HTTP code does not establish an attack chain.
AI rationale
The source inspected supports ordinary Chromatic CLI and browser-helper behavior. Scanner flags for bundled process and network primitives did not establish credential disclosure, hidden execution, or unconsented mutation.
Decision evidence
public snapshotAI called this Clean at 82.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- package.json exposes a Chromatic CLI and a separate browser helper.
- The browser helper only checks the browser user agent and URL for Chromatic markers.
- The main bundle’s Sentry initialization is disabled by a constant-false condition.
- The flagged projectFiles, node-src, build, and v1 files are bundled CLI chunks; inspected excerpts show module assembly.
- The init bundle exposes project setup through the explicit `chromatic init` command.
- The execa chunk provides ordinary child-process spawn helpers for CLI use.
Evidence against
- The bundles include process execution and HTTP code, but the inspected excerpts do not establish hidden execution, credential transfer, or an unrelated recipient.
- The init code can add a `chromatic` project script, but this is part of the explicit init command.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
10 flaggeddist/main-BNmoik4g.cjsView file
2!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`),t=require(`./node-src-BeXPfRNx.cjs`),n=require(`./v1--bJvkUld.cjs`),r=require(`./src-Cs-FRDH1.cjs`),i=require(`./meow-BcLCtnkU.cjs`),a=requi...
L4: ${u.join(`
High
Child Process
Package source references child process execution.
dist/main-BNmoik4g.cjsView on unpkg · L24${u.join(`
L5: `)}`)}function cee(e){if(!n.dn)return;let{description:t=`< unknown name >`,op:r=`< unknown op >`}=n.V(e),{spanId:i}=e.spanContext(),a=`[Tracing] Finishing "${r}" ${n.F(e)===e?`root...
L6: `).find(e=>e.includes(`IOPlatformUUID`));if(!e)return``;let t=e.split(`" = "`);if(t.length===2)return t[1].slice(0,-1)}catch(e){r.diag.debug(`error reading machine id: ${e}`)}retur...
High
2!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`),t=require(`./node-src-BeXPfRNx.cjs`),n=require(`./v1--bJvkUld.cjs`),r=require(`./src-Cs-FRDH1.cjs`),i=require(`./meow-BcLCtnkU.cjs`),a=requi...
L4: ${u.join(`
L5: `)}`)}function cee(e){if(!n.dn)return;let{description:t=`< unknown name >`,op:r=`< unknown op >`}=n.V(e),{spanId:i}=e.spanContext(),a=`[Tracing] Finishing "${r}" ${n.F(e)===e?`root...
L6: `).find(e=>e.includes(`IOPlatformUUID`));if(!e)return``;let t=e.split(`" = "`);if(t.length===2)return t[1].slice(0,-1)}catch(e){r.diag.debug(`error reading machine id: ${e}`)}retur...
Findings
3 Critical6 High4 Medium4 Low
CriticalTrojan Source Unicodedist/projectFiles-Cy-xkgpn.cjs
CriticalManifest Confusionpackage.json
CriticalPrevious Version Dangerous Deltadist/execa-CoW7oosm.cjs
HighChild Processdist/main-BNmoik4g.cjs
HighShelldist/main-BNmoik4g.cjs
HighSame File Env Network Executiondist/main-BNmoik4g.cjs
HighCommand Output Exfiltrationdist/main-BNmoik4g.cjs
HighCross File Remote Execution Contextdist/node-src-BeXPfRNx.cjs
HighSemantic Analysis Limiteddist/projectFiles-Cy-xkgpn.cjs
MediumDynamic Requiredist/main-BNmoik4g.cjs
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to chromatic@18.12.2.
See all versions of chromatic for other recorded verdicts.
- Review the evidence and your use of chromatic@18.12.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.