chromatic@18.13.4
Automate visual testing across browsers. Gather UI feedback. Versioned documentation.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe CLI sends runtime telemetry automatically after a Storybook build failure, including a user-configurable command that may contain project-specific details. The opt-out reduces the risk, but the source does not establish in-run consent or disclosure, so this warrants a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the Chromatic CLI and the Storybook build fails.
Impact
The configured build command may disclose command arguments or project-specific details to the telemetry service.
Mechanism
The CLI sends a telemetry event through the configured Chromatic GraphQL client; environment variables can disable analytics.
AI rationale
The CLI sends runtime telemetry automatically after a Storybook build failure, including a user-configurable command that may contain project-specific details. The opt-out reduces the risk, but the source does not establish in-run consent or disclosure, so this warrants a warning rather than a block.
Evidence
dist/node-src-D4DkVIjO.cjs
Network endpoints1
CHROMATIC_INDEX_URL/graphql (configurable Chromatic endpoint)
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- After a Storybook build failure, the CLI records the error category, stack trace, configurable build command and runtime details in a telemetry event.
- The event is sent through a GraphQL mutation named TrackCLITelemetryEvent.
- The GraphQL client targets CHROMATIC_INDEX_URL/graphql, a configurable Chromatic endpoint.
- Analytics can be disabled with CHROMATIC_DISABLE_ANALYTICS, CHROMATIC_DISABLE_TELEMETRY or DO_NOT_TRACK.
- buildCommand is a CLI option, so the telemetry field can contain a user-configured command.
Evidence against
- The package has no install lifecycle scripts, and its root entry only checks whether a browser is running Chromatic.
- The telemetry is limited to CLI build failures; the stack trace is scrubbed, and the Git email is hashed.
- An environment-variable opt-out is provided.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
8 flaggeddist/execa-D4ZUVBkd.cjsView file
2!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`);let t=require(`node:util`),n=require(`node:child_process`),r=require(`node:fs`),i=require(`node:os`),a=require(`node:path`);a=e.a(a,1);let o...
L4: `?(--i,a+=1):e===`u`&&t[a+2]===`{`?a=t.indexOf(`}`,a+3):a+=De[e]??1}}let a=r===e.length;return a||n.push(e.slice(r)),{nextTokens:n,leadingWhitespaces:i,trailingWhitespaces:a}},Ee=n...
High
Child Process
Package source references child process execution.
dist/execa-D4ZUVBkd.cjsView on unpkg · L2dist/node.cjsView file
1Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`}),require(`./chunk-gGpyby2o.cjs`);const e=require(`./node-src-D4DkVIjO.cjs`),t=require(`./build-1bCbWP31.cjs`),n=re...
L2: !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/node.cjsView on unpkg · L1Findings
3 Critical4 High4 Medium5 Low
CriticalTrojan Source Unicodedist/v1-KnBUpTTH.cjs
CriticalManifest Confusionpackage.json
CriticalPrevious Version Dangerous Deltadist/meow-Ch9Klnn9.cjs
HighChild Processdist/execa-D4ZUVBkd.cjs
HighShell
HighCross File Remote Execution Contextdist/node-src-D4DkVIjO.cjs
HighSemantic Analysis Limiteddist/v1-KnBUpTTH.cjs
MediumDynamic Requiredist/node.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowWeak Cryptodist/v1-KnBUpTTH.cjs
LowFilesystem
Affected versions and remediation
This report applies to chromatic@18.13.4.
See all versions of chromatic for other recorded verdicts.
- Review the evidence and your use of chromatic@18.13.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.