chromatic@18.13.1
Automate visual testing across browsers. Gather UI feedback. Versioned documentation.
AI Security Review
scanned 15d ago · by lpm-firewall-aiSource inspection found no malicious behavior. The flagged subprocess and network capabilities support the user-invoked Storybook CLI, while authenticated API calls use caller-supplied credentials and the package's Chromatic endpoint configuration.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user invokes one of the package's CLI commands.
Impact
The inspected source establishes ordinary CLI and service behavior, with no unauthorized disclosure or system change.
Mechanism
The CLI processes Storybook files and uses the configured Chromatic API endpoint for its service operations.
AI rationale
Source inspection found no malicious behavior. The flagged subprocess and network capabilities support the user-invoked Storybook CLI, while authenticated API calls use caller-supplied credentials and the package's Chromatic endpoint configuration.
Network endpoints1
index.chromatic.com
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a user-invoked CLI and declares no package-level lifecycle hook.
- The CLI defaults its API endpoint to https://index.chromatic.com; its API client sends authenticated requests to that configured service.
- The share helper receives its user token from its caller, and the CLI uses caller-supplied project credentials for Chromatic API operations.
- The inspected subprocess use is in Storybook file parsing, and the init code adds a Chromatic script to a project package file.
- The only runtime dependency is semver; its inspected manifest and entrypoint identify a version-parsing library.
Evidence against
- The scanner's dynamic execution, shell, and Unicode indicators resolve to CLI and bundled library behavior; inspection found no concrete attack chain.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
6 flaggeddist/projectFiles-CTFob_0i.cjsView file
15contains invisible/control Unicode U+200C (zero width non-joiner)
`:case`\r`:case`\u2028`:case`\u2029`:b(),p=`default`;return;case void 0:return b(),S(`eof`)}b()},value(){switch(_){case`{`:case`[`:return S(`punctuator`,b());case`n`:return b(),C(`ull`),S(`null`,null);case`t`:return b(),C(`rue`),S(`boolean`
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/projectFiles-CTFob_0i.cjsView on unpkg · L15•matchType = previous_version_dangerous_delta
matchedPackage = chromatic@18.13.0
matchedIdentity = npm:Y2hyb21hdGlj:18.13.0
similarity = 0.879
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/projectFiles-CTFob_0i.cjsView on unpkg•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Findings
3 Critical4 High4 Medium4 Low
CriticalTrojan Source Unicodedist/projectFiles-CTFob_0i.cjs
CriticalManifest Confusionpackage.json
CriticalPrevious Version Dangerous Deltadist/projectFiles-CTFob_0i.cjs
HighChild Process
HighShell
HighCross File Remote Execution Contextdist/node-src-Bep-ucNr.cjs
HighSemantic Analysis Limiteddist/projectFiles-CTFob_0i.cjs
MediumDynamic Requiredist/projectFiles-CTFob_0i.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to chromatic@18.13.1.
See all versions of chromatic for other recorded verdicts.
- Review the evidence and your use of chromatic@18.13.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.