logod-chrome-mcp@1.0.4

로고드 크롬 엠시피 — 클로드가 내 크롬을 직접 조종하게 해주는 전용 도구

AI Security Review

scanned 27d ago · by lpm-firewall-ai

Global postinstall silently installs a first-party Claude Code skill into ~/.claude/skills when Claude Code is already present, which is a guarded agent-extension lifecycle write. The skill is package-scoped, opt-out gated, and aligned with the Chrome MCP doctor, so it is a warning rather than a publish block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall during a detected global install, when ~/.claude exists and VIBEMAKER_NO_SKILL is not 1.

Impact

Claude Code can load this package's troubleshooting skill and run its shell fixes without a separate install-time consent prompt. Scope stays on the package-owned skill path.

Mechanism

installClaudeCodeSkill creates ~/.claude/skills/logod-chrome-mcp-doctor and copies dist/skill/SKILL.md there, also removing the legacy skill folder.

AI rationale

Evidence

package.jsondist/scripts/postinstall.jsdist/skill/SKILL.md~/.claude/skills/logod-chrome-mcp-doctor/SKILL.md~/.claude/skills/chrome-mcp-vibemaker-doctor

Network endpoints1

github.com/studioddkk/mcp-chrome-vibemaker/releases/latest/download/chrome-mcp-vibemaker-extension.zip

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json registers a postinstall script that runs dist/scripts/postinstall.js.
On a detected global install, main() calls installClaudeCodeSkill() with no interactive consent prompt.
installClaudeCodeSkill writes dist/skill/SKILL.md into ~/.claude/skills/logod-chrome-mcp-doctor when ~/.claude exists, unless VIBEMAKER_NO_SKILL=1, and deletes the legacy chrome-mcp-vibemaker-doctor skill directory.
The installed skill is a Claude Code skill that auto-triggers on connection complaints and instructs the agent to run logod-mcp doctor, --fix, and related shell commands.

Evidence against

Local installs skip skill installation and only print manual native-host registration steps.
The write is limited to this package's skill directory and refuses to overwrite a SKILL.md whose name is not logod-chrome-mcp-doctor.
An environment opt-out exists, and the hook does not edit ~/.claude.json or project .mcp.json itself.
No credential harvesting, hidden exfiltration, eval, or self-dependency lifecycle chain was found in the install path.

Behavioral surface

Source

Source & flagged code

16 flagged

package.jsonView file

•scripts.postinstall = node dist/scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/scripts/postinstall.jsView file

Lines 91-131javascript

91 path_1.default.join(VIBEMAKER_INSTALL_ROOT, 'agent.db-journal'),

92 path_1.default.join(VIBEMAKER_INSTALL_ROOT, 'agent.db-wal'),

93 path_1.default.join(VIBEMAKER_INSTALL_ROOT, 'agent.db-shm'),

94 ];

95 for (const p of legacyDbPaths) {

96 try {

97 if (fs_1.default.existsSync(p)) {

98 fs_1.default.unlinkSync(p);

99 console.log((0, utils_1.colorText)(`[cleanup] removed legacy agent DB: ${path_1.default.basename(p)}`, 'blue'));

100 }

101 }

102 catch (_a) {

103 // 실패는 silent — install 자체엔 영향 없음

104 }

105 }

106}

107async function downloadAndExtractExtension() {

108 if (process.env.VIBEMAKER_SKIP_EXTENSION_DOWNLOAD === '1') {

109 console.log((0, utils_1.colorText)('Skipping extension download (VIBEMAKER_SKIP_EXTENSION_DOWNLOAD=1)', 'yellow'));

110 return null;

111 }

112 fs_1.default.mkdirSync(VIBEMAKER_INSTALL_ROOT, { recursive: true });

113 fs_1.default.mkdirSync(path_1.default.dirname(VIBEMAKER_EXT_DIR), { recursive: true });

114 const zipPath = path_1.default.join(VIBEMAKER_INSTALL_ROOT, 'extension.zip');

115 // v1.0.2: 확장을 패키지에 동봉했다. GitHub Release 주소가 404 라 설치가 통째로

116 // 막히던 문제를 없앤다. 동봉본이 있으면 네트워크를 아예 타지 않는다.

117 const BUNDLED_EXT_ZIP = path_1.default.join(__dirname, '..', 'extension.zip');

118 let usedBundled = false;

119 if (fs_1.default.existsSync(BUNDLED_EXT_ZIP)) {

120 try {

121 fs_1.default.copyFileSync(BUNDLED_EXT_ZIP, zipPath);

122 usedBundled = true;

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/scripts/postinstall.jsView on unpkg · L111

123 console.log((0, utils_1.colorText)('Using bundled extension (no download needed)', 'blue'));

124 }

125 catch (e) {

126 console.log((0, utils_1.colorText)('Bundled extension copy failed (' + e.message + ') - falling back to download', 'yellow'));

127 }

128 }

129 if (!usedBundled) {

130 console.log((0, utils_1.colorText)(`Downloading extension from GitHub Release…`, 'blue'));

131 try {

•matchType = previous_version_dangerous_delta matchedPackage = logod-chrome-mcp@1.0.2 matchedIdentity = npm:bG9nb2QtY2hyb21lLW1jcA:1.0.2 similarity = 0.970 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/scripts/postinstall.jsView on unpkg

dist/run_host.shView file

•path = dist/run_host.sh kind = build_helper sizeBytes = 9790 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/run_host.shView on unpkg

dist/extension.zipView file

•path = dist/extension.zip kind = high_entropy_blob sizeBytes = 10777803 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/extension.zipView on unpkg

•path = dist/extension.zip kind = compressed_blob sizeBytes = 10777803 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/extension.zipView on unpkg

•path = dist/extension.zip kind = nested_archive_needs_inspection sizeBytes = 10777803 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/extension.zipView on unpkg

dist/scripts/postinstall.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/scripts/postinstall.js#virtual:normalized:round1View on unpkg

dist/scripts/doctor.jsView file

•matchType = normalized_sha256 matchedPackage = logod-chrome-mcp@1.0.0 matchedPath = dist/scripts/doctor.js matchedIdentity = npm:bG9nb2QtY2hyb21lLW1jcA:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High