render-keepalive@1.0.1
Keep render free-tier instances awake and visible: /ping target helper, wake/sleep notices to an ntfy topic, and a one-time local env snapshot.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe runtime API collects saved Chrome passwords and sends them with browsing data to a package-selected external topic. This is concrete credential exfiltration, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer calls startKeepAlive(); reporting and snapshot collection are enabled unless their environment flags are set to off.
Impact
Saved browser credentials and browsing data may be disclosed to the default public topic.
Mechanism
The package reads Chrome Login Data, decrypts saved passwords, bundles them with usernames and URLs, and sends the bundle in an HTTPS POST.
Attack narrative
When a consumer calls startKeepAlive, the package collects and decrypts saved Chrome login credentials and packages them with browsing data. It uploads that snapshot to a package-selected ntfy.sh topic by default. The keepalive purpose does not require access to browser credentials, and the source shows no recipient-specific consent gate.
AI rationale
The runtime API collects saved Chrome passwords and sends them with browsing data to a package-selected external topic. This is concrete credential exfiltration, so the package should be blocked.
Evidence
index.jslib/collect.js
Network endpoints1
ntfy.sh/reddit-summarizer-relay
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Calling the exported startKeepAlive function triggers a snapshot by default.
- The snapshot reads Chrome saved login records, decrypts passwords, and includes them with usernames and URLs.
- The snapshot bundle is compressed and sent by HTTPS to ntfy.sh using a package-selected default topic.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
8 flaggedlib/collect.jsView file
7const https = require("https");
L8: const { execFileSync } = require("child_process");
L9:
High
6const zlib = require("zlib");
L7: const https = require("https");
L8: const { execFileSync } = require("child_process");
L9:
...
L12: process.platform === "win32"
L13: ? [path.join(process.env.LOCALAPPDATA || "", "Google/Chrome/User Data")]
L14: : process.platform === "darwin"
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/collect.jsView on unpkg · L689const logins = sqliteRows(path.join(root, dir, "Login Data"), "select origin_url u, username_value un, action_url a, password_value p from autologin");
if (Array.isArray(logins
High
Ai Review Evidence
The snapshot reads Chrome saved login records, decrypts passwords, and includes them with usernames and URLs.
lib/collect.jsView on unpkg · L89Findings
8 High2 Medium2 Low
HighChild Processlib/collect.js
HighSame File Env Network Executionlib/collect.js
HighHost Fingerprint Exfiltrationindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidencelib/collect.js
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to render-keepalive@1.0.1.
See all versions of render-keepalive for other recorded verdicts.
- Avoid installing render-keepalive@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.