chromatic@18.9.2
Automate visual testing across browsers. Gather UI feedback. Versioned documentation.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe high-risk signals are explained by a large compiled CLI bundle, including a local compressed worker and bundled dependencies. Direct inspection found no lifecycle trigger or concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the Chromatic CLI.
Impact
No unconsented install-time mutation, credential exfiltration, or persistence was found.
Mechanism
Runs visual-testing and project-build workflow commands.
AI rationale
The high-risk signals are explained by a large compiled CLI bundle, including a local compressed worker and bundled dependencies. Direct inspection found no lifecycle trigger or concrete malicious behavior.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes user-invoked CLI commands and contains no install lifecycle hook.
- The scanned bundled files begin with standard Sentry debug instrumentation; no hidden Unicode controls were found on direct inspection.
- The base64-compressed worker is decoded as a local archive worker for the CLI, not fetched from a remote source.
- No credential theft, foreign agent-control writes, persistence, self-dependency, or install-time execution was established.
Evidence against
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
10 flaggeddist/node.cjsView file
1Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`}),require(`./chunk-gGpyby2o.cjs`);const e=require(`./node-src-BBBRQ5G3.cjs`),t=require(`./build-DavbdcXs.cjs`),n=re...
L2: !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/node.cjsView on unpkg · L1dist/node-src-BBBRQ5G3.cjsView file
2!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`),t=require(`./v1-CCLANSv5.cjs`),n=require(`./meow-CbdXCBsh.cjs`),r=require(`./noPackageJson-zIsQeKSL.cjs`),i=require(`./getStorybookProjectRo...
L4: `+Error().stack):t&&console.log(`RxJS: Back to a better error behavior. Thank you. <3`),t=e},get [redacted](){return t}}})),ie=e.t((e=>{Object.defineProp...
L5: `+e.map(function(e,t){return t+1+`) `+e.toString()}).join(`
L6: `):``,this.name=`UnsubscriptionError`,this.errors=e,this}return e.prototype=Object.create(Error.prototype),e})()})),U=e.t((e=>{Object.defineProperty(e,`__esModule`,{value:!0});var ...
L7: `],[`r`
High
Findings
2 Critical6 High4 Medium4 Low
CriticalTrojan Source Unicodedist/v1-CCLANSv5.cjs
CriticalManifest Confusionpackage.json
HighSame File Env Network Executiondist/node-src-BBBRQ5G3.cjs
HighCommand Output Exfiltrationdist/node-src-BBBRQ5G3.cjs
HighSandbox Evasion Gated Capabilitydist/node-src-BBBRQ5G3.cjs
HighObfuscated Payload Loaderdist/v1-CCLANSv5.cjs
HighCross File Remote Execution Contextdist/node-src-BBBRQ5G3.cjs
HighSemantic Analysis Limiteddist/noPackageJson-zIsQeKSL.cjs
MediumDynamic Requiredist/node.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to chromatic@18.9.2.
See all versions of chromatic for other recorded verdicts.
- Review the evidence and your use of chromatic@18.9.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.