chromatic@18.13.2
Automate visual testing across browsers. Gather UI feedback. Versioned documentation.
AI Security Review
scanned 14d ago · by lpm-firewall-aiInspected source shows no lifecycle hooks and no concrete attack behavior. The flagged execution and network primitives occur in the user-invoked CLI and its bundled utilities, with requests directed to the Chromatic service.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes the CLI or imports the browser helper.
Impact
No unrelated credential transfer or unconsented install-time change was established.
Mechanism
The CLI uses the configured Chromatic service for authentication and visual testing; the browser helper checks user-agent and URL markers.
AI rationale
Inspected source shows no lifecycle hooks and no concrete attack behavior. The flagged execution and network primitives occur in the user-invoked CLI and its bundled utilities, with requests directed to the Chromatic service.
Evidence
package.jsonisChromatic.jsisChromatic.mjsdist/bin.cjsdist/node-src-BW4FgfsB.cjs
Network endpoints1
index.chromatic.com
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the CLI and declares only semver as a runtime dependency; it has no lifecycle hook.
- The CLI sends build and authentication requests to its Chromatic index service, whose default endpoint is index.chromatic.com.
- The flagged process and filesystem code is bundled utility code used by CLI commands; inspection found no package install-time execution or unrelated credential recipient.
- The semver dependency source provides version parsing and comparison functionality.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggeddist/execa-CoW7oosm.cjsView file
2!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`);let t=require(`node:util`),n=require(`node:child_process`),r=require(`node:fs`),i=require(`node:os`),a=require(`node:path`);a=e.a(a,1);let o...
L4: `?(--i,a+=1):e===`u`&&t[a+2]===`{`?a=t.indexOf(`}`,a+3):a+=De[e]??1}}let a=r===e.length;return a||n.push(e.slice(r)),{nextTokens:n,leadingWhitespaces:i,trailingWhitespaces:a}},Ee=n...
High
Child Process
Package source references child process execution.
dist/execa-CoW7oosm.cjsView on unpkg · L22!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`);let t=require(`node:util`),n=require(`node:child_process`),r=require(`node:fs`),i=require(`node:os`),a=require(`node:path`);a=e.a(a,1);let o...
L4: `?(--i,a+=1):e===`u`&&t[a+2]===`{`?a=t.indexOf(`}`,a+3):a+=De[e]??1}}let a=r===e.length;return a||n.push(e.slice(r)),{nextTokens:n,leadingWhitespaces:i,trailingWhitespaces:a}},Ee=n...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/execa-CoW7oosm.cjsView on unpkg · L2Findings
2 Critical5 High4 Medium4 Low
CriticalTrojan Source Unicodedist/build-BzcoQsye.cjs
CriticalManifest Confusionpackage.json
HighChild Processdist/execa-CoW7oosm.cjs
HighShell
HighSame File Env Network Executiondist/noPackageJson-XI_fi2hi.cjs
HighCross File Remote Execution Contextdist/node-src-BW4FgfsB.cjs
HighSemantic Analysis Limiteddist/build-BzcoQsye.cjs
MediumDynamic Requiredist/execa-CoW7oosm.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to chromatic@18.13.2.
See all versions of chromatic for other recorded verdicts.
- Review the evidence and your use of chromatic@18.13.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.