Loading npm security reports…
chromatic@18.8.0: Suspicious npm security report (Warn) | LPM Firewall
Flagged — allowed with a warning
Allowed by default policy, but 16 finding(s) warrant review before installing.
scanned 2mo ago · by lpm-firewall-ai No concrete malicious chain was established, but incomplete analyzability of user-invoked process-capable bundled code prevents a clean decision. Downgrade to a warning rather than block because there is no install hook or verified attack behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the chromatic CLI or an application invokes its Node runtime.
Impact
Potential runtime command execution remains unresolved; no concrete malicious action was verified.
Mechanism
User-invoked bundled CLI code with unresolved process-execution capability.
AI rationale
No concrete malicious chain was established, but incomplete analyzability of user-invoked process-capable bundled code prevents a clean decision. Downgrade to a warning rather than block because there is no install hook or verified attack behavior.
Evidence
dist/node-src-DxPDZFM8.cjs dist/v1-gSblGgw-.cjs dist/meow-CbdXCBsh.cjs
public snapshot AI called this Suspicious at 72.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
The shipped runtime contains very large minified bundles with process-execution primitives, preventing a conclusive source-level exclusion of unsafe behavior. The command entrypoint loads bundled modules only when the user runs the CLI, but the inspected bundle is unusually broad and includes opaque embedded content. The package has no lifecycle script in its manifest, so the observed execution capability is not automatically triggered at installation. Evidence against
No preinstall, install, or postinstall hook is declared. No self-dependency is declared; the only runtime dependency is semver. No confirmed credential theft, foreign configuration mutation, destructive action, or non-package-aligned network exfiltration was found. Behavioral surface
Source Crypto DynamicRequire EnvironmentVars Filesystem Network
Supply chain HighEntropyStrings Minified PossibleObfuscation
10 flagged 1 Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`}),require(`./chunk-gGpyby2o.cjs`);const e=require(`./node-src-DxPDZFM8.cjs`),t=require(`./build-DavbdcXs.cjs`),n=re...
L2: !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/node.cjs View on unpkg · L1 29 contains invisible/control Unicode U+FEFF (zero width no-break space)
}`;var _=Tf(function(){return it(o,h+`return `+p).apply(n,c)});if(_.source=p,xu(_))throw _;return _}function hf(e){return td(e).toLowerCase()}function gf(e){return td(e).toUpperCase()}function _f(e,t,r){if(e=td(e),e&&(r||t===n))return Gn(e)
Critical Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/v1-gSblGgw-.cjs View on unpkg · L29 3 Critical 5 High 4 Medium 4 Low
Critical Trojan Source Unicode dist/v1-gSblGgw-.cjs
Critical Manifest Confusion package.json
Critical Previous Version Dangerous Delta dist/meow-CbdXCBsh.cjs
High Same File Env Network Execution dist/v1-gSblGgw-.cjs
High Command Output Exfiltration dist/v1-gSblGgw-.cjs
High Obfuscated Payload Loader dist/v1-gSblGgw-.cjs
High Cross File Remote Execution Context dist/node-src-DxPDZFM8.cjs
High Semantic Analysis Limited dist/v1-gSblGgw-.cjs
Medium Dynamic Require dist/node.cjs
Medium Network
Medium Environment Vars
Medium Structural Risk Force Deep Review
Low
Affected versions and remediation This report applies to chromatic@18.8.0 .
See all versions of chromatic for other recorded verdicts.
Review the evidence and your use of chromatic@18.8.0 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-09-12 10:22:29.221Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
UrlStrings
Manifest No manifest risk signals triggered.
scanned 30 file(s), 5.03 MB of source, external domains: app.netlify.com, babel.dev, babeljs.io, bitbucket.org, bun.sh, ci.appveyor.com, cirrus-ci.com, classic.yarnpkg.com, codeload.github.com, console.aws.amazon.com, docs.expo.dev, docs.npmjs.com, docs.snyk.io, dogs.are.great, dotenvx.com, expo.fyi, fonts.googleapis.com, foo.com, gist.githubusercontent.com, git-scm.com, github.com, index.chromatic.com, pnpm.io, privatecloudstatus.snyk.io, registry.npmjs.org, registry.yarnpkg.com, schemas.android.com, snyk.co, snyk.io, status.chromatic.com, status.snyk.io, storybook.js.org, support.snyk.io, todo.sr.ht, twitter.com, user-images.githubusercontent.com, www.apple.com, www.chromatic.com, www.w3.org, yarnpkg.com
Oversized source lightweight scan
dist/v1-gSblGgw-.cjs 2.12 MB file, sampled 256 KB
Filesystem EnvironmentVars Crypto HighEntropyStrings Minified UrlStrings docs.snyk.io privatecloudstatus.snyk.io snyk.co snyk.io status.snyk.io storybook.js.org support.snyk.io www.chromatic.com
59
`+e.slice(o+1):c+=e.slice(i),c.slice(1)}function me(e){for(var t=``,n=0,r,i=0;i<e.length;n>=65536?i+=2:i++)n=ne(e,i),r=M[n],!r&&W(n)?(t+=e[i],n>=65536&&(t+=e[i+1])):t+=r||I(n);retu...
L60: `:``}t.exports.dump=Ce})),require_js_yaml$2=require_chunk$2.t(((e,t)=>{var n=require_loader$1(),r=require_dumper$1();function i(e,t){return function(){throw Error(`Function yaml.`+...
L61: `;if(t[e]===se)return`
...
L63: `&&(t=t.replace(/\n/g,n)),yield F(e,t)});return function(t,n){return e.apply(this,arguments)}})(),t.hardlinksWork=(()=>{var e=(0,(r||i()).default)(function*(e){let t=`test-file`+Ma...
L64: `)}let oe=13,se=10}),(function(e,t,n){"use strict";Object.defineProperty(t,`__esModule`,{value:!0}),t.getPathKey=h;let r=n(36),i=n(0),a=n(45).default;var o=n(171);let s=o.getCacheD...
L65: %s`,O,O
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/v1-gSblGgw-.cjs View on unpkg · L59 2 !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const require_chunk$2=require(`./chunk-gGpyby2o.cjs`),require_main$2=require(`./main-YTS_kgLz.cjs`),require_src$6=require(`./src-BwxDKFhA.cjs`),require_meow=require(`./meow-CbdXCBs...
L4: `);for(let e=n;e<a.length;e++){let n=a[e];if(n.length>1024)continue;let o=WEBPACK_ERROR_REGEXP.test(n)?n.replace(WEBPACK_ERROR_REGEXP,`$1`):n;if(!o.match(/\S*Error: /)){for(let e o...
L5: `,n);n=t===-1?e.length:t}else if(r!==-1&&e[n]===`/`&&e[n+1]===`*`){let i=e.indexOf(`*/`,n);i===-1?(t+=e[n],n++):(n=i+2,r=e.indexOf(`*/`,n))}else t+=e[n],n++;return t}function ae(e)...
...
L7: `+t);let[,r]=n;return r.replace(/\s/g,``
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/v1-gSblGgw-.cjs View on unpkg · L2 2 !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const require_chunk$2=require(`./chunk-gGpyby2o.cjs`),require_main$2=require(`./main-YTS_kgLz.cjs`),require_src$6=require(`./src-BwxDKFhA.cjs`),require_meow=require(`./meow-CbdXCBs...
L4: `);for(let e=n;e<a.length;e++){let n=a[e];if(n.length>1024)continue;let o=WEBPACK_ERROR_REGEXP.test(n)?n.replace(WEBPACK_ERROR_REGEXP,`$1`):n;if(!o.match(/\S*Error: /)){for(let e o...
L5: `,n);n=t===-1?e.length:t}else if(r!==-1&&e[n]===`/`&&e[n+1]===`*`){let i=e.indexOf(`*/`,n);i===-1?(t+=e[n],n++):(n=i+2,r=e.indexOf(`*/`,n))}else t+=e[n],n++;return t}function ae(e)...
...
L7: `+t);let[,r]=n;return r.replace(/\s/g,``
High Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/v1-gSblGgw-.cjs View on unpkg · L2 • stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/v1-gSblGgw-.cjs View on unpkg 2 !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const require_chunk$2=require(`./chunk-gGpyby2o.cjs`),require_main$2=require(`./main-YTS_kgLz.cjs`),require_src$6=require(`./src-BwxDKFhA.cjs`),require_meow=require(`./meow-CbdXCBs...
L4: `);for(let e=n;e<a.length;e++){let n=a[e];if(n.length>1024)continue;let o=WEBPACK_ERROR_REGEXP.test(n)?n.replace(WEBPACK_ERROR_REGEXP,`$1`):n;if(!o.match(/\S*Error: /)){for(let e o...
L5: `,n);n=t===-1?e.length:t}else if(r!==-1&&e[n]===`/`&&e[n+1]===`*`){let i=e.indexOf(`*/`,n);i===-1?(t+=e[n],n++):(n=i+2,r=e.indexOf(`*/`,n))}else t+=e[n],n++;return t}function ae(e)...
...
L7: `+t);let[,r]=n;return r.replace(/\s/g,``
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/v1-gSblGgw-.cjs View on unpkg · L2 2 Cross-file remote execution chain: dist/node-src-DxPDZFM8.cjs spawns dist/build-DavbdcXs.cjs; helper contains network access plus dynamic code execution.
L2: !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`),t=require(`./v1-gSblGgw-.cjs`),n=require(`./meow-CbdXCBsh.cjs`),r=require(`./noPackageJson-zIsQeKSL.cjs`),i=require(`./getStorybookProjectRo...
L4: `+Error().stack):t&&console.log(`RxJS: Back to a better error behavior. Thank you. <3`),t=e},get [redacted](){return t}}})),ae=e.t((e=>{Object.defineProp...
L5: `+e.map(function(e,t){return t+1+`) `+e.toString()}).join(`
L6: `):``,this.name=`UnsubscriptionError`,thi
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/node-src-DxPDZFM8.cjs View on unpkg · L2 • scripts registry_only=build,build-storybook,chromatic,chromatic-prebuilt,chromatic-staging,chromatic-verbose,clean:sourcemaps,dev
Critical Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.json View on unpkg • matchType = previous_version_dangerous_delta
matchedPackage = chromatic@18.8.1
matchedIdentity = npm:Y2hyb21hdGlj:18.8.1
similarity = 0.794
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/meow-CbdXCBsh.cjs View on unpkg Weak Crypto
dist/v1-gSblGgw-.cjs
Entrypoints main → isChromatic.js module → isChromatic.mjs types → ./isChromatic.d.ts exports map bin → chroma, chromatic, chromatic-cli
Runtime node >=22.0.0
Artifact 6.98 MB · 36 files 2 signature(s) · provenance
Install lifecycle prepare
Behavioral surface Crypto DynamicRequire EnvironmentVars Filesystem Network HighEntropyStrings Minified PossibleObfuscation UrlStrings Manifest: clean