logod-chrome-mcp@1.0.2

로고드 크롬 엠시피 — 클로드가 내 크롬을 직접 조종하게 해주는 전용 도구

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Automatic postinstall mutation of ~/.claude/skills is a concrete AI-agent extension lifecycle risk. It is package-owned and opt-out capable, so the evidence supports a warning rather than a publication block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during a detected global installation on a system with ~/.claude.

Impact

This changes an AI-agent control surface without an explicit setup command, allowing package-authored instructions to influence later Claude sessions.

Mechanism

The installer creates ~/.claude/skills/chrome-mcp-vibemaker-doctor and copies its SKILL.md there; that skill directs future Claude sessions to run Bash commands.

AI rationale

Evidence

dist/scripts/postinstall.jsdist/skill/SKILL.md~/.claude/skills/chrome-mcp-vibemaker-doctor/SKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package declares an automatic postinstall script.
During a global install, postinstall invokes a Claude Code skill installer.
The installer copies a package-owned skill into the user's Claude skills directory.
The installed skill directs Claude to execute commands through its Bash tool.

Evidence against

The skill installation is skipped unless ~/.claude exists and can be opted out with VIBEMAKER_NO_SKILL=1.
The postinstall code limits this behavior to detected global installations.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 31 file(s), 254 KB of source, external domains: 127.0.0.1, github.com

Source & flagged code

15 flagged

package.jsonView file

•scripts.postinstall = node dist/scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/scripts/postinstall.jsView file

69} L70: fs_1.default.mkdirSync(VIBEMAKER_INSTALL_ROOT, { recursive: true }); L71: fs_1.default.mkdirSync(path_1.default.dirname(VIBEMAKER_EXT_DIR), { recursive: true }); L72: const zipPath = path_1.default.join(VIBEMAKER_INSTALL_ROOT, 'extension.zip'); ... L78: try { L79: fs_1.default.copyFileSync(BUNDLED_EXT_ZIP, zipPath); L80: usedBundled = true; ... L134: fs_1.default.rmSync(VIBEMAKER_EXT_DIR, { recursive: true, force: true }); L135: fs_1.default.mkdirSync(VIBEMAKER_EXT_DIR, { recursive: true }); L136: if (os_1.default.platform() === 'win32') { ... L162: const extIdLine = `Extension ID: ${constant_1.EXTENSION_ID}\n`; L163: fs_1.default.writeFileSync(path_1.default.join(VIBEMAKER_EXT_DIR, 'VERSION'), versionLine + buildLine + releaseLine + extIdLine);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/scripts/postinstall.jsView on unpkg · L69

dist/run_host.shView file

•path = dist/run_host.sh kind = build_helper sizeBytes = 9790 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/run_host.shView on unpkg

dist/extension.zipView file

•path = dist/extension.zip kind = high_entropy_blob sizeBytes = 10750950 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/extension.zipView on unpkg

•path = dist/extension.zip kind = compressed_blob sizeBytes = 10750950 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/extension.zipView on unpkg

•path = dist/extension.zip kind = nested_archive_needs_inspection sizeBytes = 10750950 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/extension.zipView on unpkg

dist/scripts/postinstall.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/scripts/postinstall.js#virtual:normalized:round1View on unpkg

dist/scripts/doctor.jsView file

•matchType = normalized_sha256 matchedPackage = logod-chrome-mcp@1.0.0 matchedPath = dist/scripts/doctor.js matchedIdentity = npm:bG9nb2QtY2hyb21lLW1jcA:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High