chromatic@18.9.3
Automate visual testing across browsers. Gather UI feedback. Versioned documentation.
AI Security Review
scanned 19d ago · by lpm-firewall-aiSource inspection found expected Chromatic CLI, configuration, and build upload behavior. The scanner’s Unicode concern maps to parser identifier tables; the inspected code did not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes the Chromatic command or imports its declared API.
Impact
No unauthorized credential transfer, persistence, destructive action, or unrelated control-surface mutation was established.
Mechanism
The CLI dispatches to a selected task; inspected code reads local project configuration and submits build files through the client-provided upload action.
AI rationale
Source inspection found expected Chromatic CLI, configuration, and build upload behavior. The scanner’s Unicode concern maps to parser identifier tables; the inspected code did not establish malicious behavior.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies Chromatic as a Storybook testing CLI and declares its runtime entrypoints; no lifecycle hook appears in the inspected manifest.
- The CLI dispatches to an explicitly selected command, including its interactive initialization task.
- The flagged Unicode characters occur in JavaScript identifier handling and parser tables, not in bidi control characters.
- The runtime reads Chromatic project configuration and uploads build files through the client-provided upload action.
- The Turbosnap bundle checks the Storybook directory and its dependent story files.
Evidence against
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
6 flaggeddist/turbosnapManifest-nE5p1wOL.cjsView file
2!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L3: const e=require(`./chunk-gGpyby2o.cjs`),t=require(`./meow-CbdXCBsh.cjs`),n=require(`./getStorybookProjectRoot-CjW5HTIC.cjs`),r=require(`./projectFiles-CTjP5AZJ.cjs`),i=require(`./l...
L4: Usage
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/turbosnapManifest-nE5p1wOL.cjsView on unpkg · L2dist/projectFiles-CTjP5AZJ.cjsView file
15contains invisible/control Unicode U+200C (zero width non-joiner)
`:case`\r`:case`\u2028`:case`\u2029`:b(),p=`default`;return;case void 0:return b(),S(`eof`)}b()},value(){switch(_){case`{`:case`[`:return S(`punctuator`,b());case`n`:return b(),C(`ull`),S(`null`,null);case`t`:return b(),C(`rue`),S(`boolean`
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/projectFiles-CTjP5AZJ.cjsView on unpkg · L15Findings
2 Critical2 High4 Medium4 Low
CriticalTrojan Source Unicodedist/projectFiles-CTjP5AZJ.cjs
CriticalManifest Confusionpackage.json
HighCross File Remote Execution Contextdist/node-src-DD_1NbSt.cjs
HighSemantic Analysis Limiteddist/projectFiles-CTjP5AZJ.cjs
MediumDynamic Requiredist/turbosnapManifest-nE5p1wOL.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to chromatic@18.9.3.
See all versions of chromatic for other recorded verdicts.
- Review the evidence and your use of chromatic@18.9.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.