registry / chromepilot / 0.1.4
chromepilot@0.1.4
ChromePilot CLI
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
8 flaggeddist/updater.jsView file
15import path from "node:path";
L16: import { spawnSync } from "node:child_process";
L17: import { fileURLToPath } from "node:url";
High
5* - 每次命令使用时(preAction)节流(默认 1h)对比 npm registry 最新版本,落后则自动
L6: * `npm install -g chromepilot@latest`;运行中的进程无法替换自身,下一条命令起生效。
L7: * - 开发软链模式(wrapper 指向 hc-hw local worktree 的 dist)跳过 CLI 自更新,由开发者
...
L15: import path from "node:path";
L16: import { spawnSync } from "node:child_process";
L17: import { fileURLToPath } from "node:url";
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/updater.jsView on unpkg · L5dist/commands/external.jsView file
241stdio: "inherit",
L242: shell: true,
L243: });
High
Shell
Findings
6 High3 Medium7 Low
HighChild Processdist/updater.js
HighShelldist/commands/external.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighRuntime Package Installdist/updater.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/assets/extension/background.js
LowWeak Cryptodist/version-manager.js
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to chromepilot@0.1.4.
See all versions of chromepilot for other recorded verdicts.
- Review the evidence and your use of chromepilot@0.1.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.