registry / publish-browser-extension / 5.1.0

publish-browser-extension@5.1.0

Easily publish web extensions to their stores

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Install-time prepare may set a repository-local pre-commit hook through simple-git-hooks. Runtime publishing uploads user-selected ZIPs and supplied credentials to extension-store APIs; no unconsented exfiltration is established.

Static reason

No blocking static signals were detected.

Trigger

npm prepare lifecycle; explicit publish-extension or publish-extension init command

Impact

Repository hook mutation; intended extension ZIP and store credentials are sent to configured official APIs.

Mechanism

prepare-time VCS hook setup and user-invoked store publishing

Rationale

This is not concrete malware or credential exfiltration: network use is limited to package-aligned store/OAuth endpoints and occurs through explicit CLI actions. The prepare-time Git-hook setup is a real non-malicious lifecycle mutation that warrants a warning under policy.

Evidence

package.jsonbin/publish-extension.mjsdist/cli.mjsdist/init-B7pE83dc.mjsREADME.md.git/hooks/pre-commit.env.submit.env.submit.backup-<timestamp>

Network endpoints5

chromewebstore.googleapis.com/oauth2.googleapis.com/tokenapi.addons.microsoftedge.microsoft.comaddons.mozilla.org

publish-browser-extension@5.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code