chromatic@18.7.4
Automate visual testing across browsers. Gather UI feedback. Versioned documentation.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malicious behavior was established, but incomplete analysis of large runtime bundles prevents a clean verdict. The observed network behavior is user-invoked and package-aligned.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs a Chromatic CLI command.
Impact
Project metadata and build hashes may be sent to the service; the full generated bundle could not be conclusively analyzed.
Mechanism
CLI project analysis and build-hash upload
AI rationale
No concrete malicious behavior was established, but incomplete analysis of large runtime bundles prevents a clean verdict. The observed network behavior is user-invoked and package-aligned.
Evidence
dist/node-src-DvSZKaNv.cjs
Decision evidence
public snapshotAI called this Suspicious at 71.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The package registers three executable CLI commands.
- The CLI prepares project build data and sends build hashes through a GraphQL client.
- Large generated runtime bundles include shell and network-capable code, and static analysis of them was incomplete.
Evidence against
- The manifest has no preinstall, install, or postinstall hook.
- No source-confirmed credential theft, persistence, destructive action, or agent-control write was found.
- The observed upload path is consistent with the package's visual-testing CLI function.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
10 flaggeddist/node.cjsView file
1Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`}),require(`./chunk-gGpyby2o.cjs`);const e=require(`./node-src-DvSZKaNv.cjs`),t=require(`./build-DavbdcXs.cjs`),n=re...
L2: !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/node.cjsView on unpkg · L1dist/v1-gSblGgw-.cjsView file
29contains invisible/control Unicode U+FEFF (zero width no-break space)
}`;var _=Tf(function(){return it(o,h+`return `+p).apply(n,c)});if(_.source=p,xu(_))throw _;return _}function hf(e){return td(e).toLowerCase()}function gf(e){return td(e).toUpperCase()}function _f(e,t,r){if(e=td(e),e&&(r||t===n))return Gn(e)
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/v1-gSblGgw-.cjsView on unpkg · L29Findings
3 Critical5 High4 Medium4 Low
CriticalTrojan Source Unicodedist/v1-gSblGgw-.cjs
CriticalManifest Confusionpackage.json
CriticalPrevious Version Dangerous Deltadist/meow-CbdXCBsh.cjs
HighSame File Env Network Executiondist/v1-gSblGgw-.cjs
HighCommand Output Exfiltrationdist/v1-gSblGgw-.cjs
HighObfuscated Payload Loaderdist/v1-gSblGgw-.cjs
HighCross File Remote Execution Contextdist/node-src-DvSZKaNv.cjs
HighSemantic Analysis Limiteddist/v1-gSblGgw-.cjs
MediumDynamic Requiredist/node.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to chromatic@18.7.4.
See all versions of chromatic for other recorded verdicts.
- Review the evidence and your use of chromatic@18.7.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.