chromatic@18.7.1
Automate visual testing across browsers. Gather UI feedback. Versioned documentation.
AI Security Review
scanned 19d ago · by lpm-firewall-aiInspected source does not substantiate the scanner's malicious label: the manifest has no install lifecycle hook, and flagged code maps to CLI, build, dependency-analysis, and telemetry functionality. No concrete unauthorized attack behavior was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Package code is activated by a consumer running a CLI command or calling the Node API; no install lifecycle hook is declared.
Impact
No attacker impact was confirmed; the inspected behaviors support visual testing, build reporting, project analysis, and explicitly requested setup.
Mechanism
The flagged process, filesystem, and network primitives occur in CLI, build, dependency-analysis, or telemetry paths. No concrete unauthorized transfer, payload execution, persistence, or broad consumer-project mutation was established.
AI rationale
Inspected source does not substantiate the scanner's malicious label: the manifest has no install lifecycle hook, and flagged code maps to CLI, build, dependency-analysis, and telemetry functionality. No concrete unauthorized attack behavior was found.
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The manifest routes browser and Node exports to their package modules; no install lifecycle hook is declared.
- The Node implementation records named CLI telemetry events through its configured client, consistent with product telemetry.
- Flagged executable helpers are in CLI paths: file parsing uses a parser subprocess, and initialization asks the user to select a framework.
- Other flagged bundles import filesystem, Storybook, package-manifest, and lockfile helpers for project analysis.
Evidence against
- The malicious scanner label is not supported by the inspected source: the process and network matches are in CLI, build, dependency-analysis, or telemetry functionality.
- The main CLI bundle includes a platform machine-ID helper, but no invocation of that helper was found in the reviewed bundle.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
10 flaggeddist/node.cjsView file
1Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`}),require(`./chunk-gGpyby2o.cjs`);const e=require(`./node-src-R62mLR7W.cjs`),t=require(`./build-DavbdcXs.cjs`),n=re...
L2: !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/node.cjsView on unpkg · L1dist/node-src-R62mLR7W.cjsView file
2!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`),t=require(`./v1-B5SQ5ORP.cjs`),n=require(`./meow-CbdXCBsh.cjs`),r=require(`./noPackageJson-zIsQeKSL.cjs`),i=require(`./getStorybookProjectRo...
L4: `+Error().stack):t&&console.log(`RxJS: Back to a better error behavior. Thank you. <3`),t=e},get [redacted](){return t}}})),ae=e.t((e=>{Object.defineProp...
L5: `+e.map(function(e,t){return t+1+`) `+e.toString()}).join(`
L6: `):``,this.name=`UnsubscriptionError`,this.errors=e,this}return e.prototype=Object.create(Error.prototype),e})()})),H=e.t((e=>{Object.defineProperty(e,`__esModule`,{value:!0});var ...
L7: `],[`r`
High
Findings
3 Critical5 High4 Medium4 Low
CriticalTrojan Source Unicodedist/build-DavbdcXs.cjs
CriticalManifest Confusionpackage.json
CriticalPrevious Version Dangerous Deltadist/projectFiles-Dh2Zexvl.cjs
HighSame File Env Network Executiondist/main-EJHBcwvz.cjs
HighCommand Output Exfiltrationdist/main-EJHBcwvz.cjs
HighSandbox Evasion Gated Capabilitydist/node-src-R62mLR7W.cjs
HighCross File Remote Execution Contextdist/node-src-R62mLR7W.cjs
HighSemantic Analysis Limiteddist/build-DavbdcXs.cjs
MediumDynamic Requiredist/node.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to chromatic@18.7.1.
See all versions of chromatic for other recorded verdicts.
- Review the evidence and your use of chromatic@18.7.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.