chromatic@18.2.0
⚠ Under reviewAutomate visual testing across browsers. Gather UI feedback. Versioned documentation.
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Oversized source lightweight scan
dist/node-src-CVSyADHJ.cjs2.46 MB file, sampled 256 KB
ChildProcessEnvironmentVarsDynamicRequirePossibleObfuscationHighEntropyStringsMinifiedUrlStringsstatus.chromatic.comwww.chromatic.com
Source & flagged code
8 flaggeddist/meow-CbdXCBsh.cjsView file
2!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`);var t=e.t(((e,t)=>{t.exports=(e,t=process.argv)=>{let n=e.startsWith(`-`)?``:e.length===1?`-`:`--`,r=t.indexOf(n+e),i=t.indexOf(`--`);return...
L4: `):n+=i;return n}let _=!1,v=/\r\n|[\n\r\u2028\u2029]/;function y(e,t,n,r){let i=Object.assign({column:0,line:-1},e.start),a=Object.assign({},i,e.end),{linesAbove:o=2,linesBelow:s=3...
High
Child Process
Package source references child process execution.
dist/meow-CbdXCBsh.cjsView on unpkg · L2dist/node.cjsView file
1Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`}),require(`./chunk-gGpyby2o.cjs`);const e=require(`./node-src-CVSyADHJ.cjs`),t=require(`./build-BV9aNfpL.cjs`),n=re...
L2: !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/node.cjsView on unpkg · L1Findings
3 Critical4 High4 Medium3 Low
CriticalTrojan Source Unicodedist/build-BV9aNfpL.cjs
CriticalManifest Confusionpackage.json
CriticalPrevious Version Dangerous Deltadist/node-src-CVSyADHJ.cjs
HighChild Processdist/meow-CbdXCBsh.cjs
HighSame File Env Network Executiondist/main-Ciu3_he1.cjs
HighCross File Remote Execution Contextdist/node-src-CVSyADHJ.cjs
HighSemantic Analysis Limiteddist/build-BV9aNfpL.cjs
MediumDynamic Requiredist/node.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to chromatic@18.2.0.
See all versions of chromatic for other recorded verdicts.
- Review the evidence and your use of chromatic@18.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.