registry / chromepilot / 0.2.0
chromepilot@0.2.0
⚠ Under reviewChromePilot CLI
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
8 flaggeddist/index.jsView file
25import { autoCliUpdate } from "./updater.js";
L26: import { spawn } from "node:child_process";
L27: import fs from "node:fs";
High
139doStartServer: () => new Promise((resolve, reject) => {
L140: const child = spawn(process.execPath, [cli, "start"], {
L141: stdio: ["ignore", "inherit", "inherit"],
L142: env: process.env,
L143: });
...
L149: const cfg = loadConfig();
L150: const res = await fetch(`http://localhost:${cfg.port}/api/reload`, {
L151: method: "POST",
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L139134else {
L135: process.stderr.write(`[chromepilot] 检测到 ${restart.length} 项 server 版本/指纹不一致,自动重启 server + reload 扩展...\n`);
L136: const cli = process.argv[1];
...
L139: doStartServer: () => new Promise((resolve, reject) => {
L140: const child = spawn(process.execPath, [cli, "start"], {
L141: stdio: ["ignore", "inherit", "inherit"],
...
L149: const cfg = loadConfig();
L150: const res = await fetch(`http://localhost:${cfg.port}/api/reload`, {
L151: method: "POST",
Findings
1 Critical5 High2 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/commands/doctor.js
HighChild Processdist/index.js
HighShelldist/commands/external.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/assets/extension/background.js
LowWeak Cryptodist/version-manager.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to chromepilot@0.2.0.
See all versions of chromepilot for other recorded verdicts.
- Review the evidence and your use of chromepilot@0.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.