registry / AI-agent control-surface risk / logod-chrome-mcp
logod-chrome-mcp
로고드 크롬 엠시피 — 클로드가 내 크롬을 직접 조종하게 해주는 전용 도구
This report shows the evidence for logod-chrome-mcp@1.0.0. 1 of 5 known versions is blocked or flagged. The newest version, 1.0.5, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is unconsented install-time mutation of a foreign global AI-agent control surface, combined with an automatic remote payload download. The guard requiring an existing Claude directory does not provide user consent.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Installing the package globally through npm or pnpm.
Impact
Future Claude Code conversations can be influenced to execute package-directed troubleshooting commands without a separate user setup action.
Mechanism
Postinstall global AI-agent skill injection and remote extension download.
Policy narrative
The npm postinstall hook activates during a global install. It downloads and extracts a remote extension, then copies a bundled skill into the existing Claude Code global skills directory. The skill is intended to auto-trigger on general MCP problem reports and tells Claude Code to run Bash commands directly. This changes a separate AI-agent control surface without an explicit user-command setup flow.
AI rationale
This is unconsented install-time mutation of a foreign global AI-agent control surface, combined with an automatic remote payload download. The guard requiring an existing Claude directory does not provide user consent.
Evidence
package.jsondist/scripts/postinstall.jsdist/skill/SKILL.md~/.claude/skills/chrome-mcp-vibemaker-doctor/SKILL.md~/.mcp-chrome-vibemaker/extension.zip~/Downloads/mcp-chrome-vibemaker-extension-v<version>
Network endpoints1
github.com/studioddkk/mcp-chrome-vibemaker/releases/latest/download/chrome-mcp-vibemaker-extension.zip
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- The package runs a postinstall script automatically.
- On global installation, it downloads and extracts an unsigned remote browser extension.
- The postinstall script copies a package-provided skill into Claude Code's global skills directory without an explicit setup command.
- That installed skill directs Claude Code to run shell commands automatically for broadly worded user requests.
Evidence against
- No runtime dependency on this package's own name was found.
- The inspected MCP runtime endpoints are localhost-only; no credential exfiltration code was found in the reviewed files.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node dist/scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node dist/scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/scripts/postinstall.jsView file
69}
L70: fs_1.default.mkdirSync(VIBEMAKER_INSTALL_ROOT, { recursive: true });
L71: fs_1.default.mkdirSync(path_1.default.dirname(VIBEMAKER_EXT_DIR), { recursive: true });
L72: const zipPath = path_1.default.join(VIBEMAKER_INSTALL_ROOT, 'extension.zip');
...
L118: fs_1.default.rmSync(VIBEMAKER_EXT_DIR, { recursive: true, force: true });
L119: fs_1.default.mkdirSync(VIBEMAKER_EXT_DIR, { recursive: true });
L120: if (os_1.default.platform() === 'win32') {
...
L146: const extIdLine = `Extension ID: ${constant_1.EXTENSION_ID}\n`;
L147: fs_1.default.writeFileSync(path_1.default.join(VIBEMAKER_EXT_DIR, 'VERSION'), versionLine + buildLine + releaseLine + extIdLine);
L148: }
...
L188: console.log(` ┌────────────────────────────────────────────────────────────────────┐`);
L189: console.log(`
Findings
1 Critical9 High5 Medium4 Low
CriticalAi Agent Control Hijackdist/scripts/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/scripts/postinstall.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/scripts/postinstall.js
HighKnown Malware Source Similaritydist/scripts/utils.js
HighKnown Malware Source Similaritydist/scripts/browser-config.js
HighKnown Malware Source Similaritydist/scripts/report.js
HighKnown Malware Source Similaritydist/mcp/mcp-server-stdio.js
HighKnown Malware Source Similaritydist/file-handler.js
HighKnown Malware Source Similaritydist/transports/playwright/cdp-client.js
Affected versions and remediation
This report applies to logod-chrome-mcp@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing logod-chrome-mcp@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
5 known versions1.0.5latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 16, 2026, 1:51 PM1.0.4SuspiciousAgent extension lifecycle riskWarnPublishedSep 26, 2026, 3:23 AM1.0.3SuspiciousAgent extension lifecycle riskWarnPublishedSep 26, 2026, 1:42 AM1.0.2SuspiciousAgent extension lifecycle riskWarnPublishedSep 23, 2026, 7:58 AM