registry / logod-chrome-mcp / 1.0.5
logod-chrome-mcp@1.0.5
로고드 크롬 엠시피 — 클로드가 내 크롬을 직접 조종하게 해주는 전용 도구
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe postinstall hook automatically installs a package-owned Claude skill that can guide later agent-run commands, so a warning is warranted. The inspected behavior does not establish a concrete attack supporting a block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package globally while a Claude Code directory exists in the user’s home directory.
Impact
The package changes agent configuration without a separate setup prompt, enabling later agent-run commands under the skill’s instructions.
Mechanism
The postinstall hook copies the bundled skill into the user’s Claude skills directory; the skill is intended to activate on reports of package problems and directs Claude to run diagnostic or repair commands.
AI rationale
The postinstall hook automatically installs a package-owned Claude skill that can guide later agent-run commands, so a warning is warranted. The inspected behavior does not establish a concrete attack supporting a block.
Evidence
package.jsondist/scripts/postinstall.jsdist/skill/SKILL.md
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package postinstall hook runs during installation; global installs call the Claude skill setup automatically.
- The setup writes a package-owned skill under the user’s Claude skills directory when that directory exists; an environment variable can opt out.
- The installed skill directs Claude to run the package’s diagnostic and repair commands through Bash when users report related problems.
Evidence against
- The setup is scoped to a named package skill and skips installation when the Claude directory is absent.
- The inspected source establishes agent configuration setup but does not establish credential theft or another concrete attack.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
16 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node dist/scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node dist/scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/scripts/postinstall.jsView file
111}
L112: fs_1.default.mkdirSync(LOGOD_INSTALL_ROOT, { recursive: true });
L113: fs_1.default.mkdirSync(path_1.default.dirname(LOGOD_EXT_DIR), { recursive: true });
L114: const zipPath = path_1.default.join(LOGOD_INSTALL_ROOT, 'extension.zip');
...
L120: try {
L121: fs_1.default.copyFileSync(BUNDLED_EXT_ZIP, zipPath);
L122: usedBundled = true;
...
L176: fs_1.default.rmSync(LOGOD_EXT_DIR, { recursive: true, force: true });
L177: fs_1.default.mkdirSync(LOGOD_EXT_DIR, { recursive: true });
L178: await extractZipCompat(zipPath, LOGOD_EXT_DIR);
...
L198: const extIdLine = `Extension ID: ${constant_1.EXTENSION_ID}\n`;
L199: fs_1.default.writeFileSync(path_1.default.join(LOGOD_EXT_DIR, 'VERSION'), versionLine + buildLine + releaseLine + extIdLine);
Findings
1 Critical11 High6 Medium5 Low
CriticalAi Agent Control Hijackdist/scripts/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy Blobdist/extension.zip
HighSemantic Analysis Limiteddist/scripts/postinstall.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/scripts/doctor.js
HighKnown Malware Source Similaritydist/scripts/utils.js
HighKnown Malware Source Similaritydist/scripts/browser-config.js
HighKnown Malware Source Similaritydist/scripts/report.js
HighKnown Malware Source Similaritydist/mcp/mcp-server-stdio.js
HighKnown Malware Source Similaritydist/file-handler.js
High
Affected versions and remediation
This report applies to logod-chrome-mcp@1.0.5.
See all versions of logod-chrome-mcp for other recorded verdicts.
- Review the evidence and your use of logod-chrome-mcp@1.0.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.