Loading npm security reports…

logod-chrome-mcp@1.0.0: AI-agent control-surface risk | LPM Firewall

registry / logod-chrome-mcp / 1.0.0

logod-chrome-mcp@1.0.0

로고드 크롬 엠시피 — 클로드가 내 크롬을 직접 조종하게 해주는 전용 도구

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically modifies Claude Code's global skill control surface and fetches a remote browser-extension archive. The installed skill is configured to activate on broad troubleshooting language and instruct the agent to execute shell commands.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package globally through npm or pnpm.

Impact

Future Claude Code conversations can be influenced to execute package-directed troubleshooting commands without a separate user setup action.

Mechanism

Postinstall global AI-agent skill injection and remote extension download.

Policy narrative

The npm postinstall hook activates during a global install. It downloads and extracts a remote extension, then copies a bundled skill into the existing Claude Code global skills directory. The skill is intended to auto-trigger on general MCP problem reports and tells Claude Code to run Bash commands directly. This changes a separate AI-agent control surface without an explicit user-command setup flow.

Rationale

This is unconsented install-time mutation of a foreign global AI-agent control surface, combined with an automatic remote payload download. The guard requiring an existing Claude directory does not provide user consent.

Evidence

package.jsondist/scripts/postinstall.jsdist/skill/SKILL.md~/.claude/skills/chrome-mcp-vibemaker-doctor/SKILL.md~/.mcp-chrome-vibemaker/extension.zip~/Downloads/mcp-chrome-vibemaker-extension-v<version>

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/scripts/postinstall.jsView file

69} L70: fs_1.default.mkdirSync(VIBEMAKER_INSTALL_ROOT, { recursive: true }); L71: fs_1.default.mkdirSync(path_1.default.dirname(VIBEMAKER_EXT_DIR), { recursive: true }); L72: const zipPath = path_1.default.join(VIBEMAKER_INSTALL_ROOT, 'extension.zip'); ... L118: fs_1.default.rmSync(VIBEMAKER_EXT_DIR, { recursive: true, force: true }); L119: fs_1.default.mkdirSync(VIBEMAKER_EXT_DIR, { recursive: true }); L120: if (os_1.default.platform() === 'win32') { ... L146: const extIdLine = `Extension ID: ${constant_1.EXTENSION_ID}\n`; L147: fs_1.default.writeFileSync(path_1.default.join(VIBEMAKER_EXT_DIR, 'VERSION'), versionLine + buildLine + releaseLine + extIdLine); L148: } ... L188: console.log(` ┌────────────────────────────────────────────────────────────────────┐`); L189: console.log(`

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/scripts/postinstall.jsView on unpkg · L69

•matchType = normalized_sha256 matchedPackage = auto-chrome-mcp-bridge@1.2.0 matchedPath = dist/scripts/postinstall.js matchedIdentity = npm:YXV0by1jaHJvbWUtbWNwLWJyaWRnZQ:1.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/postinstall.jsView on unpkg

dist/run_host.shView file

•path = dist/run_host.sh kind = build_helper sizeBytes = 10054 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/run_host.shView on unpkg

dist/scripts/postinstall.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/scripts/postinstall.js#virtual:normalized:round1View on unpkg

dist/scripts/utils.jsView file

•matchType = normalized_sha256 matchedPackage = auto-chrome-mcp-bridge@1.6.0 matchedPath = dist/scripts/utils.js matchedIdentity = npm:YXV0by1jaHJvbWUtbWNwLWJyaWRnZQ:1.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/utils.jsView on unpkg

dist/scripts/browser-config.jsView file

•matchType = normalized_sha256 matchedPackage = @ethanwilkins/mcp-chrome-bridge-2026@2.4.4 matchedPath = dist/scripts/browser-config.js matchedIdentity = npm:[redacted]:2.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/browser-config.jsView on unpkg

dist/scripts/report.jsView file

•matchType = normalized_sha256 matchedPackage = @ethanwilkins/mcp-chrome-bridge-2026@2.4.4 matchedPath = dist/scripts/report.js matchedIdentity = npm:[redacted]:2.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/report.jsView on unpkg

dist/mcp/mcp-server-stdio.jsView file

•matchType = normalized_sha256 matchedPackage = mcp-chrome-scalemaker-bridge@1.0.37 matchedPath = dist/mcp/mcp-server-stdio.js matchedIdentity = npm:[redacted]:1.0.37 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp/mcp-server-stdio.jsView on unpkg

dist/file-handler.jsView file

•matchType = normalized_sha256 matchedPackage = auto-chrome-mcp-bridge@1.6.0 matchedPath = dist/file-handler.js matchedIdentity = npm:YXV0by1jaHJvbWUtbWNwLWJyaWRnZQ:1.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/file-handler.jsView on unpkg

dist/transports/playwright/cdp-client.jsView file

•matchType = normalized_sha256 matchedPackage = auto-chrome-mcp-bridge@1.6.0 matchedPath = dist/transports/playwright/cdp-client.js matchedIdentity = npm:YXV0by1jaHJvbWUtbWNwLWJyaWRnZQ:1.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/transports/playwright/cdp-client.jsView on unpkg