chromatic@18.6.0
Automate visual testing across browsers. Gather UI feedback. Versioned documentation.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiDirect inspection found no lifecycle hook, self-dependency, hidden payload loader, or concrete malicious execution chain. Static findings are explained by bundled CLI and third-party code.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user explicitly runs the Chromatic CLI.
Impact
No unconsented install-time execution, persistence, or credential exfiltration was established.
Mechanism
Project build and visual-testing CLI operations.
AI rationale
Direct inspection found no lifecycle hook, self-dependency, hidden payload loader, or concrete malicious execution chain. Static findings are explained by bundled CLI and third-party code.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes library and explicit CLI entrypoints, with no lifecycle-script section.
- The three flagged bundles start with generated Sentry debug-ID scaffolding; their dynamic-code findings are consistent with bundled third-party tooling rather than an install-time payload.
- The manifest has no runtime dependency on chromatic itself.
Evidence against
- The CLI reads project files and environment configuration and contacts Chromatic service endpoints when explicitly run.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
11 flaggeddist/v1-BPL0QeOt.cjsView file
30contains invisible/control Unicode U+FEFF (zero width no-break space)
}`;var _=Tf(function(){return it(o,h+`return `+p).apply(n,c)});if(_.source=p,xu(_))throw _;return _}function hf(e){return td(e).toLowerCase()}function gf(e){return td(e).toUpperCase()}function _f(e,t,r){if(e=td(e),e&&(r||t===n))return Gn(e)
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/v1-BPL0QeOt.cjsView on unpkg · L3060`+e.slice(o+1):c+=e.slice(i),c.slice(1)}function pe(e){for(var t=``,n=0,r,i=0;i<e.length;n>=65536?i+=2:i++)n=te(e,i),r=M[n],!r&&W(n)?(t+=e[i],n>=65536&&(t+=e[i+1])):t+=r||I(n);retu...
L61: `:``}t.exports.dump=Se})),require_js_yaml$2=require_chunk$2.t(((e,t)=>{var n=require_loader$1(),r=require_dumper$1();function i(e,t){return function(){throw Error(`Function yaml.`+...
L62: `;if(t[e]===oe)return`
...
L64: `&&(t=t.replace(/\n/g,n)),yield F(e,t)});return function(t,n){return e.apply(this,arguments)}})(),t.hardlinksWork=(()=>{var e=(0,(r||i()).default)(function*(e){let t=`test-file`+Ma...
L65: `)}let ae=13,oe=10}),(function(e,t,n){"use strict";Object.defineProperty(t,`__esModule`,{value:!0}),t.getPathKey=h;let r=n(36),i=n(0),a=n(45).default;var o=n(171);let s=o.getCacheD...
L66: %s`,O,O
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/v1-BPL0QeOt.cjsView on unpkg · L60Findings
3 Critical7 High4 Medium5 Low
CriticalTrojan Source Unicodedist/v1-BPL0QeOt.cjs
CriticalManifest Confusionpackage.json
CriticalPrevious Version Dangerous Deltadist/getFileHashes-D6WuRXoP.cjs
HighChild Process
HighShell
HighSame File Env Network Executiondist/v1-BPL0QeOt.cjs
HighCommand Output Exfiltrationdist/v1-BPL0QeOt.cjs
HighObfuscated Payload Loaderdist/v1-BPL0QeOt.cjs
HighCross File Remote Execution Contextdist/node-src-g_vKlWCV.cjs
HighSemantic Analysis Limiteddist/v1-BPL0QeOt.cjs
MediumDynamic Requiredist/v1-BPL0QeOt.cjs
MediumNetwork
Medium
Affected versions and remediation
This report applies to chromatic@18.6.0.
See all versions of chromatic for other recorded verdicts.
- Review the evidence and your use of chromatic@18.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.