chromatic@18.7.0
Automate visual testing across browsers. Gather UI feedback. Versioned documentation.
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the reviewed runtime behavior fits Chromatic’s CLI and browser detection functions. Scanner indicators alone do not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The CLI runs when a user invokes its command; the browser detector runs when imported or called.
Impact
No confirmed attack impact was found.
Mechanism
The source exposes CLI functionality, analytics controls, and configured GraphQL requests. No malicious transfer, unrequested account action, persistence, or install-time mutation was established.
AI rationale
The manifest has no install lifecycle hook, and the reviewed runtime behavior fits Chromatic’s CLI and browser detection functions. Scanner indicators alone do not establish malicious behavior.
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest maps the package entrypoints to the browser detector and Node CLI; it defines no lifecycle script.
- The CLI exposes an analytics opt-out through environment settings.
- The runtime sends GraphQL requests through its configured client.
- The flagged bundles import CLI, filesystem, and project-discovery modules consistent with the package’s visual testing purpose.
Evidence against
- Scanner labels for dynamic loading, network access, environment access, and invisible Unicode do not establish an attack; inspected source shows CLI and product behavior.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
10 flaggeddist/node-src-DRRoD7Co.cjsView file
2!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`),t=require(`./v1-B5SQ5ORP.cjs`),n=require(`./meow-CbdXCBsh.cjs`),r=require(`./noPackageJson-zIsQeKSL.cjs`),i=require(`./getStorybookProjectRo...
L4: `+Error().stack):t&&console.log(`RxJS: Back to a better error behavior. Thank you. <3`),t=e},get [redacted](){return t}}})),te=e.t((e=>{Object.defineProp...
L5: `+e.map(function(e,t){return t+1+`) `+e.toString()}).join(`
L6: `):``,this.name=`UnsubscriptionError`,this.errors=e,this}return e.prototype=Object.create(Error.prototype),e})()})),U=e.t((e=>{Object.defineProperty(e,`__esModule`,{value:!0});var ...
L7: `],[`r`
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/node-src-DRRoD7Co.cjsView on unpkg · L22!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`),t=require(`./v1-B5SQ5ORP.cjs`),n=require(`./meow-CbdXCBsh.cjs`),r=require(`./noPackageJson-zIsQeKSL.cjs`),i=require(`./getStorybookProjectRo...
L4: `+Error().stack):t&&console.log(`RxJS: Back to a better error behavior. Thank you. <3`),t=e},get [redacted](){return t}}})),te=e.t((e=>{Object.defineProp...
L5: `+e.map(function(e,t){return t+1+`) `+e.toString()}).join(`
L6: `):``,this.name=`UnsubscriptionError`,this.errors=e,this}return e.prototype=Object.create(Error.prototype),e})()})),U=e.t((e=>{Object.defineProperty(e,`__esModule`,{value:!0});var ...
L7: `],[`r`
Findings
3 Critical5 High4 Medium4 Low
CriticalTrojan Source Unicodedist/build-DavbdcXs.cjs
CriticalManifest Confusionpackage.json
CriticalPrevious Version Dangerous Deltadist/projectFiles-Dh2Zexvl.cjs
HighSame File Env Network Executiondist/node-src-DRRoD7Co.cjs
HighCommand Output Exfiltrationdist/node-src-DRRoD7Co.cjs
HighSandbox Evasion Gated Capabilitydist/node-src-DRRoD7Co.cjs
HighCross File Remote Execution Contextdist/node-src-DRRoD7Co.cjs
HighSemantic Analysis Limiteddist/build-DavbdcXs.cjs
MediumDynamic Requiredist/node-src-DRRoD7Co.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to chromatic@18.7.0.
See all versions of chromatic for other recorded verdicts.
- Review the evidence and your use of chromatic@18.7.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.