Loading npm security reports…
chromatic@18.9.0: Suspicious npm security report (Warn) | LPM Firewall
Flagged — allowed with a warning
Allowed by default policy, but 16 finding(s) warrant review before installing.
scanned 2mo ago · by lpm-firewall-ai No concrete malicious chain was established, but dynamic code in a large minified artifact prevents a decisive clean verdict under the required inspection boundary.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user or CI job invokes a Chromatic command.
Impact
Project build artifacts may be sent to the configured service.
Mechanism
CLI build-file upload over HTTP
AI rationale
No concrete malicious chain was established, but dynamic code in a large minified artifact prevents a decisive clean verdict under the required inspection boundary.
Evidence
dist/node-src-zJMqNv7a.cjs
public snapshot AI called this Suspicious at 62.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
A large minified bundle invokes the Function constructor, leaving a dynamic-code path that bounded static review cannot fully attribute. The CLI upload routine packages a file and sends it in an HTTP POST request. Evidence against
The manifest has no preinstall, install, postinstall, or prepare lifecycle hook. The manifest exposes command-line binaries, so the main behavior requires an explicit command invocation. The inspected upload code is consistent with the package's visual-testing service and no source evidence established credential theft, remote payload execution, persistence, or destructive behavior. Behavioral surface
Source Crypto DynamicRequire EnvironmentVars Filesystem Network
Supply chain HighEntropyStrings Minified PossibleObfuscation UrlStrings
Manifest No manifest risk signals triggered.
10 flagged 1 Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`}),require(`./chunk-gGpyby2o.cjs`);const e=require(`./node-src-zJMqNv7a.cjs`),t=require(`./build-DavbdcXs.cjs`),n=re...
L2: !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/node.cjs View on unpkg · L1 29 contains invisible/control Unicode U+FEFF (zero width no-break space)
}`;var _=Tf(function(){return it(o,h+`return `+p).apply(n,c)});if(_.source=p,xu(_))throw _;return _}function hf(e){return td(e).toLowerCase()}function gf(e){return td(e).toUpperCase()}function _f(e,t,r){if(e=td(e),e&&(r||t===n))return Gn(e)
Critical Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/v1-gSblGgw-.cjs View on unpkg · L29 3 Critical 5 High 4 Medium 4 Low
Critical Trojan Source Unicode dist/v1-gSblGgw-.cjs
Critical Manifest Confusion package.json
Critical Previous Version Dangerous Delta dist/meow-CbdXCBsh.cjs
High Same File Env Network Execution dist/v1-gSblGgw-.cjs
High Command Output Exfiltration dist/v1-gSblGgw-.cjs
High Obfuscated Payload Loader dist/v1-gSblGgw-.cjs
High Cross File Remote Execution Context dist/node-src-zJMqNv7a.cjs
High Semantic Analysis Limited dist/v1-gSblGgw-.cjs
Medium Dynamic Require dist/node.cjs
Medium Network
Medium Environment Vars
Medium Structural Risk Force Deep Review
Low
Affected versions and remediation This report applies to chromatic@18.9.0 .
See all versions of chromatic for other recorded verdicts.
Review the evidence and your use of chromatic@18.9.0 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-09-15 18:33:54.720Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
scanned 30 file(s), 5.03 MB of source, external domains: app.netlify.com, babel.dev, babeljs.io, bitbucket.org, bun.sh, ci.appveyor.com, cirrus-ci.com, classic.yarnpkg.com, codeload.github.com, console.aws.amazon.com, docs.expo.dev, docs.npmjs.com, docs.snyk.io, dogs.are.great, dotenvx.com, expo.fyi, fonts.googleapis.com, foo.com, gist.githubusercontent.com, git-scm.com, github.com, index.chromatic.com, pnpm.io, privatecloudstatus.snyk.io, registry.npmjs.org, registry.yarnpkg.com, schemas.android.com, snyk.co, snyk.io, status.chromatic.com, status.snyk.io, storybook.js.org, support.snyk.io, todo.sr.ht, twitter.com, user-images.githubusercontent.com, www.apple.com, www.chromatic.com, www.w3.org, yarnpkg.com
Oversized source lightweight scan
dist/v1-gSblGgw-.cjs 2.12 MB file, sampled 256 KB
Filesystem EnvironmentVars Crypto HighEntropyStrings Minified UrlStrings docs.snyk.io privatecloudstatus.snyk.io snyk.co snyk.io status.snyk.io storybook.js.org support.snyk.io www.chromatic.com
59
`+e.slice(o+1):c+=e.slice(i),c.slice(1)}function me(e){for(var t=``,n=0,r,i=0;i<e.length;n>=65536?i+=2:i++)n=ne(e,i),r=M[n],!r&&W(n)?(t+=e[i],n>=65536&&(t+=e[i+1])):t+=r||I(n);retu...
L60: `:``}t.exports.dump=Ce})),require_js_yaml$2=require_chunk$2.t(((e,t)=>{var n=require_loader$1(),r=require_dumper$1();function i(e,t){return function(){throw Error(`Function yaml.`+...
L61: `;if(t[e]===se)return`
...
L63: `&&(t=t.replace(/\n/g,n)),yield F(e,t)});return function(t,n){return e.apply(this,arguments)}})(),t.hardlinksWork=(()=>{var e=(0,(r||i()).default)(function*(e){let t=`test-file`+Ma...
L64: `)}let oe=13,se=10}),(function(e,t,n){"use strict";Object.defineProperty(t,`__esModule`,{value:!0}),t.getPathKey=h;let r=n(36),i=n(0),a=n(45).default;var o=n(171);let s=o.getCacheD...
L65: %s`,O,O
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/v1-gSblGgw-.cjs View on unpkg · L59 2 !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const require_chunk$2=require(`./chunk-gGpyby2o.cjs`),require_main$2=require(`./main-YTS_kgLz.cjs`),require_src$6=require(`./src-BwxDKFhA.cjs`),require_meow=require(`./meow-CbdXCBs...
L4: `);for(let e=n;e<a.length;e++){let n=a[e];if(n.length>1024)continue;let o=WEBPACK_ERROR_REGEXP.test(n)?n.replace(WEBPACK_ERROR_REGEXP,`$1`):n;if(!o.match(/\S*Error: /)){for(let e o...
L5: `,n);n=t===-1?e.length:t}else if(r!==-1&&e[n]===`/`&&e[n+1]===`*`){let i=e.indexOf(`*/`,n);i===-1?(t+=e[n],n++):(n=i+2,r=e.indexOf(`*/`,n))}else t+=e[n],n++;return t}function ae(e)...
...
L7: `+t);let[,r]=n;return r.replace(/\s/g,``
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/v1-gSblGgw-.cjs View on unpkg · L2 2 !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const require_chunk$2=require(`./chunk-gGpyby2o.cjs`),require_main$2=require(`./main-YTS_kgLz.cjs`),require_src$6=require(`./src-BwxDKFhA.cjs`),require_meow=require(`./meow-CbdXCBs...
L4: `);for(let e=n;e<a.length;e++){let n=a[e];if(n.length>1024)continue;let o=WEBPACK_ERROR_REGEXP.test(n)?n.replace(WEBPACK_ERROR_REGEXP,`$1`):n;if(!o.match(/\S*Error: /)){for(let e o...
L5: `,n);n=t===-1?e.length:t}else if(r!==-1&&e[n]===`/`&&e[n+1]===`*`){let i=e.indexOf(`*/`,n);i===-1?(t+=e[n],n++):(n=i+2,r=e.indexOf(`*/`,n))}else t+=e[n],n++;return t}function ae(e)...
...
L7: `+t);let[,r]=n;return r.replace(/\s/g,``
High Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/v1-gSblGgw-.cjs View on unpkg · L2 • stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/v1-gSblGgw-.cjs View on unpkg 2 !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const require_chunk$2=require(`./chunk-gGpyby2o.cjs`),require_main$2=require(`./main-YTS_kgLz.cjs`),require_src$6=require(`./src-BwxDKFhA.cjs`),require_meow=require(`./meow-CbdXCBs...
L4: `);for(let e=n;e<a.length;e++){let n=a[e];if(n.length>1024)continue;let o=WEBPACK_ERROR_REGEXP.test(n)?n.replace(WEBPACK_ERROR_REGEXP,`$1`):n;if(!o.match(/\S*Error: /)){for(let e o...
L5: `,n);n=t===-1?e.length:t}else if(r!==-1&&e[n]===`/`&&e[n+1]===`*`){let i=e.indexOf(`*/`,n);i===-1?(t+=e[n],n++):(n=i+2,r=e.indexOf(`*/`,n))}else t+=e[n],n++;return t}function ae(e)...
...
L7: `+t);let[,r]=n;return r.replace(/\s/g,``
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/v1-gSblGgw-.cjs View on unpkg · L2 2 Cross-file remote execution chain: dist/node-src-zJMqNv7a.cjs spawns dist/build-DavbdcXs.cjs; helper contains network access plus dynamic code execution.
L2: !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`),t=require(`./v1-gSblGgw-.cjs`),n=require(`./meow-CbdXCBsh.cjs`),r=require(`./noPackageJson-zIsQeKSL.cjs`),i=require(`./getStorybookProjectRo...
L4: `+Error().stack):t&&console.log(`RxJS: Back to a better error behavior. Thank you. <3`),t=e},get [redacted](){return t}}})),ie=e.t((e=>{Object.defineProp...
L5: `+e.map(function(e,t){return t+1+`) `+e.toString()}).join(`
L6: `):``,this.name=`UnsubscriptionError`,thi
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/node-src-zJMqNv7a.cjs View on unpkg · L2 • scripts registry_only=build,build-storybook,chromatic,chromatic-prebuilt,chromatic-staging,chromatic-verbose,clean:sourcemaps,dev
Critical Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.json View on unpkg • matchType = previous_version_dangerous_delta
matchedPackage = chromatic@18.8.1
matchedIdentity = npm:Y2hyb21hdGlj:18.8.1
similarity = 0.765
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/meow-CbdXCBsh.cjs View on unpkg Weak Crypto
dist/v1-gSblGgw-.cjs
Entrypoints main → isChromatic.js module → isChromatic.mjs types → ./isChromatic.d.ts exports map bin → chroma, chromatic, chromatic-cli
Runtime node >=22.0.0
Artifact 6.98 MB · 36 files 2 signature(s) · provenance
Install lifecycle prepare
Behavioral surface Crypto DynamicRequire EnvironmentVars Filesystem Network HighEntropyStrings Minified PossibleObfuscation UrlStrings Manifest: clean