chromatic@18.5.0
Automate visual testing across browsers. Gather UI feedback. Versioned documentation.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection found no lifecycle hook or concrete malicious execution chain. Scanner flags are explained by large bundled CLI and dependency code containing normal subprocess, telemetry, parsing, and network primitives.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User invokes a chromatic CLI command.
Impact
User-authorized project and CI processing only.
Mechanism
Builds and submits visual-testing data to Chromatic services.
AI rationale
Source inspection found no lifecycle hook or concrete malicious execution chain. Scanner flags are explained by large bundled CLI and dependency code containing normal subprocess, telemetry, parsing, and network primitives.
Evidence
package.jsondist/bin.cjsdist/main-DbwUCIG1.cjsdist/node-src-Ba_AaIzK.cjsdist/v1-B5XHfelt.cjs
Network endpoints3
index.chromatic.comstatus.chromatic.comwww.chromatic.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no preinstall, install, postinstall, or prepare script.
- The bin entry only dispatches explicit CLI subcommands.
- Bundled child-process, eval, and network code is dependency/CLI functionality; no hidden payload, agent-config mutation, or exfiltration chain was found.
- Chromatic-specific configuration and service URLs align with the declared visual-testing CLI.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
11 flaggeddist/v1-B5XHfelt.cjsView file
75contains invisible/control Unicode U+FEFF (zero width no-break space)
}`;var _=Tf(function(){return it(o,h+`return `+p).apply(n,c)});if(_.source=p,xu(_))throw _;return _}function hf(e){return td(e).toLowerCase()}function gf(e){return td(e).toUpperCase()}function _f(e,t,r){if(e=td(e),e&&(r||t===n))return Gn(e)
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/v1-B5XHfelt.cjsView on unpkg · L752!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const require_chunk$2=require(`./chunk-gGpyby2o.cjs`),require_main$2=require(`./main-YTS_kgLz.cjs`),require_src$6=require(`./src-BwxDKFhA.cjs`),require_meow=require(`./meow-CbdXCBs...
L4: `);for(let e=n;e<a.length;e++){let n=a[e];if(n.length>1024)continue;let o=WEBPACK_ERROR_REGEXP.test(n)?n.replace(WEBPACK_ERROR_REGEXP,`$1`):n;if(!o.match(/\S*Error: /)){for(let e o...
High
Child Process
Package source references child process execution.
dist/v1-B5XHfelt.cjsView on unpkg · L22!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const require_chunk$2=require(`./chunk-gGpyby2o.cjs`),require_main$2=require(`./main-YTS_kgLz.cjs`),require_src$6=require(`./src-BwxDKFhA.cjs`),require_meow=require(`./meow-CbdXCBs...
L4: `);for(let e=n;e<a.length;e++){let n=a[e];if(n.length>1024)continue;let o=WEBPACK_ERROR_REGEXP.test(n)?n.replace(WEBPACK_ERROR_REGEXP,`$1`):n;if(!o.match(/\S*Error: /)){for(let e o...
L5: \r
...
L9: `);if(u===-1){n(`have not received end of HTTP headers yet...`),o();return}let d=l.slice(0,u).toString(`ascii`).split(`\r
L10: `),f=d.shift();if(!f)return e.destroy(),r(Error(`No header received from proxy CONNECT respons
Findings
3 Critical6 High4 Medium4 Low
CriticalTrojan Source Unicodedist/v1-B5XHfelt.cjs
CriticalManifest Confusionpackage.json
CriticalPrevious Version Dangerous Deltadist/node-src-Ba_AaIzK.cjs
HighChild Processdist/v1-B5XHfelt.cjs
HighSame File Env Network Executiondist/v1-B5XHfelt.cjs
HighCommand Output Exfiltrationdist/v1-B5XHfelt.cjs
HighObfuscated Payload Loaderdist/v1-B5XHfelt.cjs
HighCross File Remote Execution Contextdist/v1-B5XHfelt.cjs
HighSemantic Analysis Limiteddist/v1-B5XHfelt.cjs
MediumDynamic Requiredist/v1-B5XHfelt.cjs
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to chromatic@18.5.0.
See all versions of chromatic for other recorded verdicts.
- Review the evidence and your use of chromatic@18.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.