chromatic@18.8.1
Automate visual testing across browsers. Gather UI feedback. Versioned documentation.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malicious install hook, persistence, destructive behavior, or self-dependency chain was found. Opaque bundled runtime code and whitelisted environment collection warrant a warning rather than a clean decision.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs a chromatic CLI command.
Impact
Whitelisted environment values and testing data may be sent during the user-invoked service workflow; the opaque bundle prevents a definitive clean assessment.
Mechanism
CLI execution with whitelisted environment collection and bundled WebAssembly.
AI rationale
No concrete malicious install hook, persistence, destructive behavior, or self-dependency chain was found. Opaque bundled runtime code and whitelisted environment collection warrant a warning rather than a clean decision.
Evidence
package.jsondist/meow-CbdXCBsh.cjsdist/v1-gSblGgw-.cjsdist/node-src-Ch_OGnUw.cjsdist/projectFiles-CfiOhKIQ.cjsdist/bin.cjs
Network endpoints1
index.chromatic.com
Decision evidence
public snapshotAI called this Suspicious at 68.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The manifest exposes CLI commands that load bundled code when the user runs them.
- A bundled helper dynamically constructs a function at runtime.
- The v1 bundle embeds a base64 WebAssembly module, limiting straightforward source review.
- The CLI collects environment values matching a configured whitelist.
- The configured service endpoint is Chromatic's index service and accepts a project token setting.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare script.
- The only runtime dependency is semver; there is no self-dependency chain.
- No inspected source showed destructive actions, persistence, or unconsented install-time project mutation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetwork
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
11 flaggeddist/meow-CbdXCBsh.cjsView file
2!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`);var t=e.t(((e,t)=>{t.exports=(e,t=process.argv)=>{let n=e.startsWith(`-`)?``:e.length===1?`-`:`--`,r=t.indexOf(n+e),i=t.indexOf(`--`);return...
L4: `):n+=i;return n}let _=!1,v=/\r\n|[\n\r\u2028\u2029]/;function y(e,t,n,r){let i=Object.assign({column:0,line:-1},e.start),a=Object.assign({},i,e.end),{linesAbove:o=2,linesBelow:s=3...
High
Child Process
Package source references child process execution.
dist/meow-CbdXCBsh.cjsView on unpkg · L2dist/node.cjsView file
1Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`}),require(`./chunk-gGpyby2o.cjs`);const e=require(`./node-src-Ch_OGnUw.cjs`),t=require(`./build-DavbdcXs.cjs`),n=re...
L2: !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/node.cjsView on unpkg · L1Findings
3 Critical6 High5 Medium4 Low
CriticalTrojan Source Unicodedist/v1-gSblGgw-.cjs
CriticalManifest Confusionpackage.json
CriticalPrevious Version Dangerous Deltadist/projectFiles-CfiOhKIQ.cjs
HighChild Processdist/meow-CbdXCBsh.cjs
HighSame File Env Network Executiondist/v1-gSblGgw-.cjs
HighCommand Output Exfiltrationdist/v1-gSblGgw-.cjs
HighObfuscated Payload Loaderdist/v1-gSblGgw-.cjs
HighCross File Remote Execution Contextdist/node-src-Ch_OGnUw.cjs
HighSemantic Analysis Limiteddist/v1-gSblGgw-.cjs
MediumDynamic Requiredist/node.cjs
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to chromatic@18.8.1.
See all versions of chromatic for other recorded verdicts.
- Review the evidence and your use of chromatic@18.8.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.