registry / chromeship / 0.1.3

chromeship@0.1.3

Build, run, and monetize Chrome extensions from one local studio with managed runtimes, backend integrations, a CLI, dashboard, and MCP server.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 20 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 6 file(s), 3.78 MB of source, external domains: 127.0.0.1, api.deepseek.com, api.openai.com, api.resend.com, api.stripe.com, chromeship.com, example.com, github.com, googlechromelabs.github.io, json-schema.org, raw.githubusercontent.com, react.dev, spec.openapis.org, stackoverflow.com, tools.ietf.org, www.chromeship.com, www.docker.com, www.safaribooksonline.com, www.w3.org

Source & flagged code

12 flagged

dist/index.jsView file

139patternName = supabase_service_key severity = critical line = 139 matchedText = SUPABASE...I0",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L139

139patternName = supabase_service_key severity = critical line = 139 matchedText = SUPABASE...I0",

Critical

Secret Pattern

Supabase service role key (JWT) in dist/index.js

dist/index.jsView on unpkg · L139

140patternName = supabase_service_key severity = critical line = 140 matchedText = SUPABASE...1IU"

Critical

Secret Pattern

Supabase service role key (JWT) in dist/index.js

dist/index.jsView on unpkg · L140

137var LOCAL_SUPABASE_CREDENTIALS = { L138: SUPABASE_URL: "http://127.0.0.1:55121", L139: SUPABASE_ANON_KEY: "[redacted].[redacted].CRXP1A7WOeoJeXxjNni43kdQwgnWNReilDMblYTn_I0", ... L161: await rename(tempPath, configPath); L162: if (process.platform !== "win32") { L163: try { ... L176: function getDefaultWorkspaceRoot() { L177: return join(homedir(), "ChromeShip", "projects"); L178: } ... L197: try { L198: parsed = JSON.parse(file); L199: } catch {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L137

2854- Keep permissions narrow. High-risk permissions like debugger, proxy, webRequest, and <all_urls> need explicit user confirmation. L2855: - Do not load remote executable code: no remote scripts, remote import(), remote importScripts(), eval, or new Function. L2856: - HTTPS API calls are fine. Executing code fetched from HTTPS is not.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L2854

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L137

dist/mcp-server.jsView file

15581patternName = supabase_service_key severity = critical line = 15581 matchedText = SUPABASE...I0",

Critical

Secret Pattern

Supabase service role key (JWT) in dist/mcp-server.js

dist/mcp-server.jsView on unpkg · L15581

15582patternName = supabase_service_key severity = critical line = 15582 matchedText = SUPABASE...1IU"

Critical

Secret Pattern

Supabase service role key (JWT) in dist/mcp-server.js

dist/mcp-server.jsView on unpkg · L15582

2944sourceCode = this.opts.code.process(sourceCode, sch); L2945: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2946: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/mcp-server.jsView on unpkg · L2944

dashboard/dist/favicon.icoView file

•path = dashboard/dist/favicon.ico kind = high_entropy_blob sizeBytes = 140832 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dashboard/dist/favicon.icoView on unpkg

dist/run-cli.jsView file

218patternName = supabase_service_key severity = critical line = 218 matchedText = SUPABASE...I0",

Critical

Secret Pattern

Supabase service role key (JWT) in dist/run-cli.js

dist/run-cli.jsView on unpkg · L218

219patternName = supabase_service_key severity = critical line = 219 matchedText = SUPABASE...1IU"

Critical

Secret Pattern

Supabase service role key (JWT) in dist/run-cli.js

dist/run-cli.jsView on unpkg · L219

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code