registry / reflex-browser / 0.12.0
reflex-browser@0.12.0
Token-efficient browser automation for AI agents. Local MCP server + CLI: compressed page snapshots, batched actions, forensic failures.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe flagged primitives are disclosed, runtime-only browser-automation features; source inspection found no install hook, credential exfiltration, remote payload execution, or foreign agent-control-surface mutation. The scanner's exfiltration conclusion overstates the observed credit/auth API payloads.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs the reflex CLI or configures and invokes its MCP server.
Impact
Authenticated browser actions can occur in the user-selected automation session; no source evidence sends copied browser data to the package service.
Mechanism
Local Playwright browser automation with Chrome-profile seeding and credit API calls.
AI rationale
The flagged primitives are disclosed, runtime-only browser-automation features; source inspection found no install hook, credential exfiltration, remote payload execution, or foreign agent-control-surface mutation. The scanner's exfiltration conclusion overstates the observed credit/auth API payloads.
Evidence
package.jsonREADME.mddist/reflex.jsdist/mcp.jsdist/daemon.js
Network endpoints3
reflex.openlabs.workers.devreflexmcp.com127.0.0.1
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- Runtime profile seeding copies Chrome cookie/login-data files on Windows/Linux into the package-owned browser profile.
- The MCP client sends limited trial/credit telemetry to the Reflex API after user runtime actions.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Browser, profile, and MCP behavior is activated by the package CLI/MCP entrypoints, not installation.
- The first-call payload contains tool/result/client/device metadata, not page contents or browser credentials.
- Cross-origin browser fetch is blocked unless REFLEX_ALLOW_CROSS_ORIGIN_FETCH=1.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
4 flaggeddist/reflex.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: "use strict";var S=(e,t)=>()=>{try{return t||e((t={exports:{}}).exports,t),t.exports}catch(r){throw t=0,r}};var je=S((Xn,C)=>{"use strict";var oe=require("fs"),Ht=require("path"),{...
L3: `)){let o=n.match(/^\s*(\d+)\s+(.*)$/);if(o&&o[1]===r&&/chrome|chromium|ms-playwright|playwright[\/\\]/i.test(o[2]))return!0}return!1}function Gt(e){if(process.platform==="win32")r...
L4: `)){let n=r.match(/^\s*(\d+)\s+(\d+)\s+(\d+)\s+(.*)$/);if(!n)continue;let[,o,s,i,l]=n;if(s===String(e)&&/chrome|chromium|ms-playwright/i.test(l)&&!/crashpad/i.test(l))return{pid:pa...
L5: <style>html{color-scheme:dark}body{margin:0;display:grid;place-items:center;min-height:100vh;
...
L8: .s{margin-top:.5rem;color:#9
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/reflex.jsView on unpkg · L11#!/usr/bin/env node
L2: "use strict";var S=(e,t)=>()=>{try{return t||e((t={exports:{}}).exports,t),t.exports}catch(r){throw t=0,r}};var je=S((Xn,C)=>{"use strict";var oe=require("fs"),Ht=require("path"),{...
L3: `)){let o=n.match(/^\s*(\d+)\s+(.*)$/);if(o&&o[1]===r&&/chrome|chromium|ms-playwright|playwright[\/\\]/i.test(o[2]))return!0}return!1}function Gt(e){if(process.platform==="win32")r...
High
Findings
1 Critical3 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/reflex.js
HighChild Processdist/reflex.js
HighSame File Env Network Executiondist/reflex.js
HighSandbox Evasion Gated Capabilitydist/reflex.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to reflex-browser@0.12.0.
See all versions of reflex-browser for other recorded verdicts.
- Review the evidence and your use of reflex-browser@0.12.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.