chromatic@18.14.0
Automate visual testing across browsers. Gather UI feedback. Versioned documentation.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe CLI sends build-command and stack-trace details as runtime telemetry on build failure, which can expose identifying or sensitive command information. This supports a warning-level telemetry verdict; no malicious behavior was established.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the Chromatic CLI and a Storybook build fails.
Impact
Build commands or stack traces may contain local or identifying details and are sent to Chromatic during CLI use.
Mechanism
The CLI tracks a failure event with the configured build command and stack trace, then sends it through its Chromatic Index GraphQL client. Telemetry can be disabled with documented-in-source environment variables.
AI rationale
The CLI sends build-command and stack-trace details as runtime telemetry on build failure, which can expose identifying or sensitive command information. This supports a warning-level telemetry verdict; no malicious behavior was established.
Evidence
dist/node-src-BqhCRdYm.cjs
Network endpoints1
${e.env.CHROMATIC_INDEX_URL}/graphql
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- A failed Storybook build triggers a telemetry event containing the configured build command and a stack trace.
- The event is sent through the Chromatic Index GraphQL client as CLI telemetry.
- Telemetry can be disabled with CHROMATIC_DISABLE_ANALYTICS, CHROMATIC_DISABLE_TELEMETRY, or DO_NOT_TRACK.
Evidence against
- The package describes itself as a visual testing tool and exposes a separate Node API and CLI.
- The telemetry is tied to a failed build during CLI use; no install-time hook is declared in the reviewed manifest.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
GitDependency
Source & flagged code
11 flaggeddist/execa-CoW7oosm.cjsView file
2!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`);let t=require(`node:util`),n=require(`node:child_process`),r=require(`node:fs`),i=require(`node:os`),a=require(`node:path`);a=e.a(a,1);let o...
L4: `?(--i,a+=1):e===`u`&&t[a+2]===`{`?a=t.indexOf(`}`,a+3):a+=De[e]??1}}let a=r===e.length;return a||n.push(e.slice(r)),{nextTokens:n,leadingWhitespaces:i,trailingWhitespaces:a}},Ee=n...
High
Child Process
Package source references child process execution.
dist/execa-CoW7oosm.cjsView on unpkg · L22!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`);let t=require(`node:util`),n=require(`node:child_process`),r=require(`node:fs`),i=require(`node:os`),a=require(`node:path`);a=e.a(a,1);let o...
L4: `?(--i,a+=1):e===`u`&&t[a+2]===`{`?a=t.indexOf(`}`,a+3):a+=De[e]??1}}let a=r===e.length;return a||n.push(e.slice(r)),{nextTokens:n,leadingWhitespaces:i,trailingWhitespaces:a}},Ee=n...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/execa-CoW7oosm.cjsView on unpkg · L2Findings
3 Critical7 High5 Medium5 Low
CriticalTrojan Source Unicodedist/v1-CQ6OvI4-.cjs
CriticalManifest Confusionpackage.json
CriticalPrevious Version Dangerous Deltadist/noPackageJson-BJgjUoPA.cjs
HighChild Processdist/execa-CoW7oosm.cjs
HighShell
HighSame File Env Network Executiondist/node-src-BqhCRdYm.cjs
HighCommand Output Exfiltrationdist/node-src-BqhCRdYm.cjs
HighSandbox Evasion Gated Capabilitydist/node-src-BqhCRdYm.cjs
HighCross File Remote Execution Contextdist/node-src-BqhCRdYm.cjs
HighSemantic Analysis Limiteddist/log-kvNRZrIg.cjs#virtual:normalized:round1
MediumDynamic Requiredist/execa-CoW7oosm.cjs
Affected versions and remediation
This report applies to chromatic@18.14.0.
See all versions of chromatic for other recorded verdicts.
- Review the evidence and your use of chromatic@18.14.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.