chromatic@18.6.1
Automate visual testing across browsers. Gather UI feedback. Versioned documentation.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource inspection contradicts the static malicious label: this package has no lifecycle hooks and its risky primitives are bundled CLI and dependency functionality reached through explicit commands. No concrete malicious chain was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Explicit invocation of the chromatic CLI.
Impact
No unconsented install-time execution, credential exfiltration, persistence, or agent-control mutation was confirmed.
Mechanism
Runs Chromatic visual-test and project-hashing workflows.
AI rationale
Source inspection contradicts the static malicious label: this package has no lifecycle hooks and its risky primitives are bundled CLI and dependency functionality reached through explicit commands. No concrete malicious chain was found.
Evidence
package.jsondist/bin.cjsdist/getFileHashes-D6WuRXoP.cjsdist/v1-BPL0QeOt.cjs
Network endpoints1
index.chromatic.com
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no lifecycle scripts, so installation does not trigger package code.
- The command entry point dispatches only after the user invokes the CLI.
- The configured network service is the package-aligned Chromatic index endpoint.
- No bidi control characters were found in the flagged bundle, and no hidden payload execution was confirmed.
Evidence against
- The bundled CLI reads project files, environment settings, and can invoke development tools during explicit visual-test workflows.
- Bundled third-party code contains generic dynamic loading, shell, and evaluation primitives that static matching can flag.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetwork
HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings
Source & flagged code
11 flaggeddist/v1-BPL0QeOt.cjsView file
30contains invisible/control Unicode U+FEFF (zero width no-break space)
}`;var _=Tf(function(){return it(o,h+`return `+p).apply(n,c)});if(_.source=p,xu(_))throw _;return _}function hf(e){return td(e).toLowerCase()}function gf(e){return td(e).toUpperCase()}function _f(e,t,r){if(e=td(e),e&&(r||t===n))return Gn(e)
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/v1-BPL0QeOt.cjsView on unpkg · L30209For a list of features, visit: https://github.[redacted]-shell/README.md.
L210: `,examples:[[`Run a simple command`,`$0 echo Hello`],[`Run a command with a glob pattern`,`$0 echo '*.js'`],[`Run a command with a redirection`,`$0 echo Hello World '>' hello.txt`]...
L211: `),i!==-1){let n=o+r.substring(0,i);r=r.substring(i+1),o=``,e(t===null?n:`${t} ${n}`)}while(i!==-1);o+=r}),i.on(`end`,()=>{let n=a.end();n!==``&&e(t===null?n:`${t} ${n}`)}),i}funct...
High
Child Process
Package source references child process execution.
dist/v1-BPL0QeOt.cjsView on unpkg · L20960`+e.slice(o+1):c+=e.slice(i),c.slice(1)}function pe(e){for(var t=``,n=0,r,i=0;i<e.length;n>=65536?i+=2:i++)n=te(e,i),r=M[n],!r&&W(n)?(t+=e[i],n>=65536&&(t+=e[i+1])):t+=r||I(n);retu...
L61: `:``}t.exports.dump=Se})),require_js_yaml$2=require_chunk$2.t(((e,t)=>{var n=require_loader$1(),r=require_dumper$1();function i(e,t){return function(){throw Error(`Function yaml.`+...
L62: `;if(t[e]===oe)return`
...
L64: `&&(t=t.replace(/\n/g,n)),yield F(e,t)});return function(t,n){return e.apply(this,arguments)}})(),t.hardlinksWork=(()=>{var e=(0,(r||i()).default)(function*(e){let t=`test-file`+Ma...
L65: `)}let ae=13,oe=10}),(function(e,t,n){"use strict";Object.defineProperty(t,`__esModule`,{value:!0}),t.getPathKey=h;let r=n(36),i=n(0),a=n(45).default;var o=n(171);let s=o.getCacheD...
L66: %s`,O,O
Findings
3 Critical6 High5 Medium4 Low
CriticalTrojan Source Unicodedist/v1-BPL0QeOt.cjs
CriticalManifest Confusionpackage.json
CriticalPrevious Version Dangerous Deltadist/getFileHashes-D6WuRXoP.cjs
HighChild Processdist/v1-BPL0QeOt.cjs
HighSame File Env Network Executiondist/v1-BPL0QeOt.cjs
HighCommand Output Exfiltrationdist/v1-BPL0QeOt.cjs
HighObfuscated Payload Loaderdist/v1-BPL0QeOt.cjs
HighCross File Remote Execution Contextdist/node-src-Df-Z5FpB.cjs
HighSemantic Analysis Limiteddist/v1-BPL0QeOt.cjs
MediumDynamic Requiredist/v1-BPL0QeOt.cjs
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to chromatic@18.6.1.
See all versions of chromatic for other recorded verdicts.
- Review the evidence and your use of chromatic@18.6.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.