chromatic@18.9.4
Automate visual testing across browsers. Gather UI feedback. Versioned documentation.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe scanner findings are explained by bundled CLI dependencies and explicit visual-testing functionality. Source inspection found no lifecycle hook, hidden payload, or concrete malicious data flow.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs a Chromatic command.
Impact
No unconsented installation-time execution, persistence, credential harvesting, or destructive action was established.
Mechanism
Authenticated visual-test and Storybook upload workflow.
AI rationale
The scanner findings are explained by bundled CLI dependencies and explicit visual-testing functionality. Source inspection found no lifecycle hook, hidden payload, or concrete malicious data flow.
Network endpoints1
index.chromatic.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes command-line binaries but contains no lifecycle scripts, so installation does not trigger package code.
- The flagged Storybook helper only normalizes project paths and derives relative paths.
- The flagged v1 bundle contains TurboSnap dependency-tracing logic over Storybook and package-lock files.
- The runtime reads the Chromatic project token supplied by the caller for its authenticated CLI workflow.
- The noPackageJson bundle reports that the CLI must be run from a JavaScript project.
Evidence against
- Bundled dependencies contain dynamic loading, process execution, and network primitives, but inspection found no concealed payload or install-time activation.
- CHROMATIC_INDEX_URL is configurable, but the default is index.chromatic.com and the token is caller-supplied for Chromatic authentication.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
9 flaggeddist/node.cjsView file
1Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`}),require(`./chunk-gGpyby2o.cjs`);const e=require(`./node-src-B3Zyu6y_.cjs`),t=require(`./build-DavbdcXs.cjs`),n=re...
L2: !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/node.cjsView on unpkg · L1dist/v1-CCLANSv5.cjsView file
29contains invisible/control Unicode U+FEFF (zero width no-break space)
}`;var v=Ef(function(){return ot(o,g+`return `+m).apply(n,l)});if(v.source=m,Su(v))throw v;return v}function gf(e){return nd(e).toLowerCase()}function _f(e){return nd(e).toUpperCase()}function vf(e,t,r){if(e=nd(e),e&&(r||t===n))return Z(e);
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/v1-CCLANSv5.cjsView on unpkg · L292
Findings
2 Critical5 High4 Medium4 Low
CriticalTrojan Source Unicodedist/v1-CCLANSv5.cjs
CriticalManifest Confusionpackage.json
HighSame File Env Network Executiondist/getStorybookProjectRoot-CjW5HTIC.cjs
HighCommand Output Exfiltrationdist/getStorybookProjectRoot-CjW5HTIC.cjs
HighObfuscated Payload Loaderdist/v1-CCLANSv5.cjs
HighCross File Remote Execution Contextdist/node-src-B3Zyu6y_.cjs
HighSemantic Analysis Limiteddist/noPackageJson-zIsQeKSL.cjs
MediumDynamic Requiredist/node.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowWeak Cryptodist/v1-CCLANSv5.cjs
Affected versions and remediation
This report applies to chromatic@18.9.4.
See all versions of chromatic for other recorded verdicts.
- Review the evidence and your use of chromatic@18.9.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.