registry / ttj-skills-browser / 1.2.18

ttj-skills-browser@1.2.18

Renamed to 'ttj-skills-playwright'. Please install: npm i -g ttj-skills-playwright

ttj-skills-browser - Dedicated CDP browser with one-shot commands (eval/goto/screenshot) and page reference visualization

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Installation silently mutates global Claude Code and Codex skill directories with package-controlled instructions. Runtime also self-updates globally after a registry check.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

`npm install` activates `postinstall`; invoking the CLI activates the update check.

Impact

Package-controlled agent instructions persist in foreign global control surfaces and can change through later npm releases.

Mechanism

Postinstall AI-agent skill injection and unattended global self-update.

Policy narrative

On npm installation, the postinstall script copies package-supplied instructions into the user's global Claude Code and Codex skill directories without an explicit setup command. Those instructions direct AI-driven browser automation. Separately, each CLI launch checks npm once daily and, if newer, executes a global npm upgrade, allowing future package releases to replace the installed skill and executable automatically. This is unconsented install-time mutation of broad external AI-agent control surfaces.

Rationale

Source inspection confirms an automatic postinstall write to both `~/.claude/skills` and `~/.agents/skills`, which is a foreign/broad AI-agent control surface. The unattended global update path compounds the persistence and supply-chain risk.

Evidence

package.jsonscripts/install-skill.jsdist/cli.jsdist/browser.jsdist/utils.js.claude/skills/ttj-skills-browser/SKILL.md~/.claude/skills/ttj-skills-browser/SKILL.md~/.agents/skills/ttj-skills-browser/SKILL.md~/.ttj-skills-browser-installed~/.ttj-skills-browser/.last-update-check

Network endpoints2

registry.npmjs.org/ttj-skills-browser/latest127.0.0.1:${port}

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for policy block

`package.json` runs `postinstall` automatically.
`scripts/install-skill.js` copies bundled skill to `~/.claude/skills/ttj-skills-browser/SKILL.md`.
The same postinstall writes to `~/.agents/skills/ttj-skills-browser/SKILL.md` and creates `~/.ttj-skills-browser-installed`.
`dist/cli.js` invokes runtime auto-update before handling normal commands.
`dist/browser.js` checks `registry.npmjs.org` then runs global `npm install -g ttj-skills-browser@latest` without consent.

Evidence against

No source reads or transmits environment secrets, credentials, or SSH/cloud files.
Observed network use is npm update checking and local CDP, not direct data exfiltration.
Browser evaluation/navigation requires an explicit CLI command after installation.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 62.1 KB of source, external domains: 127.0.0.1, registry.npmjs.org, www.google.com, www.naver.com

Source & flagged code

7 flagged

package.jsonView file

Lines 1-39json

2 "name": "ttj-skills-browser",

3 "version": "1.2.18",

4 "description": "ttj-skills-browser - Dedicated CDP browser with one-shot commands (eval/goto/screenshot) and page reference visualization",

5 "type": "module",

6 "bin": {

7 "ttj-skills-browser": "dist/cli.js"

8 },

9 "main": "./dist/cli.js",

10 "files": [

11 "dist",

12 ".claude/skills",

13 "scripts"

14 ],

15 "scripts": {

16 "build": "tsc",

17 "start": "node dist/cli.js",

18 "prepare": "npm run build",

19 "postinstall": "node scripts/install-skill.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

20 },

21 "dependencies": {

22 "chalk": "^5.3.0",

23 "playwright-core": "^1.61.1"

24 },

25 "devDependencies": {

26 "typescript": "^5.4.0",

27 "@types/node": "^20.11.0"

28 },

29 "keywords": [

30 "playwright",

31 "browser",

32 "automation",

33 "cli"

34 ],

35 "author": "TTJ",

36 "license": "MIT",

37 "repository": {

38 "type": "git",

39 "url": "git+https://github.com/ddoojoang/ttj-skills-browser.git"

dist/utils.jsView file

Lines 1-25javascript

1/**

2 * ttj-skills-browser - Utility functions (pure where possible)

3 */

4import os from 'os';

5import path from 'path';

6import net from 'net';

7import https from 'https';

8import { exec } from 'child_process';

9import { promisify } from 'util';

10import { readFile, access } from 'fs/promises';

11import { fileURLToPath } from 'url';

12const execAsync = promisify(exec);

13const PACKAGE_NAME = 'ttj-skills-browser';

14const NPM_REGISTRY = 'https://registry.npmjs.org';

15/**

16 * Detect the current operating system in a platform-agnostic way.

17 */

18export const getOsType = () => process.platform === 'win32'

19 ? 'windows'

20 : process.platform === 'darwin'

21 ? 'macos'

22 : 'linux';

23/**

24 * Return the current user's home directory (never hardcode a username).

25 */

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/utils.jsView on unpkg · L5

•matchType = normalized_sha256 matchedPackage = ttj-sk[redacted]@1.2.17 matchedPath = dist/utils.js matchedIdentity = npm:dHRqLXNraWxscy1icm93c2Vy:1.2.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils.jsView on unpkg

scripts/install-skill.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * Claude Code / Codex 스킬 자동 설치

4 * npm install 후 Claude Code와 Codex의 사용자 전역 스킬 위치에 복사합니다.

5 */

7import fs from 'fs';

8import path from 'path';

9import { fileURLToPath } from 'url';

10import { homedir } from 'os';

12const __dirname = path.dirname(fileURLToPath(import.meta.url));

14const skillName = 'ttj-skills-browser';

15const skillSourceDir = path.join(__dirname, '..', '.claude', 'skills', skillName);

16const skillFile = 'SKILL.md';

18function ensureDir(dir) {

19 if (!fs.existsSync(dir)) {

20 fs.mkdirSync(dir, { recursive: true });

21 }

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-skill.jsView on unpkg · L14

22}

24// Codex frontmatter must stay in sync with the source description. We reuse

25// the source's own `description:` line so it never drifts (e.g. stale

26// "Playwright CLI" wording). Codex-specific fields (auto-invoke-keywords,

27// allowed-tools) are dropped — only name + description are kept.

28function extractDescription(content) {

29 const match = content.match(/^description:\s*(.+)$/m);

30 return match ? match[1].trim() : `${skillName} - dedicated CDP browser CLI`;

31}

33function toCodexSkill(content) {

34 const description = extractDescription(content);

dist/browser.jsView file

•matchType = normalized_sha256 matchedPackage = ttj-sk[redacted]@1.2.17 matchedPath = dist/browser.js matchedIdentity = npm:dHRqLXNraWxscy1icm93c2Vy:1.2.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/browser.jsView on unpkg

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = ttj-sk[redacted]@1.2.17 matchedPath = dist/cli.js matchedIdentity = npm:dHRqLXNraWxscy1icm93c2Vy:1.2.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = ttj-sk[redacted]@1.2.16 matchedIdentity = npm:dHRqLXNraWxscy1icm93c2Vy:1.2.16 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/utils.jsView file

5import path from 'path'; L6: import net from 'net'; L7: import https from 'https'; L8: import { exec } from 'child_process'; L9: import { promisify } from 'util'; ... L17: */ L18: export const getOsType = () => process.platform === 'win32' L19: ? 'windows' ... L25: */ L26: export const getHomeDir = () => os.homedir(); L27: /** ... L33: const isWindows = getOsType() === 'windows';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/utils.jsView on unpkg · L5

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils.jsView on unpkg

scripts/install-skill.jsView file

14Install-time AI-agent control hijack evidence: L14: const skillName = 'ttj-sk[redacted]'; L15: const sk[redacted] = path.join(__dirname, '..', '.claude', 'skills', skillName); L16: const skillFile = 'SKILL.md'; ... L19: if (!fs.existsSync(dir)) { L20: fs.mkdirSync(dir, { recursive: true }); L21: } ... L53: // Claude Code: 기존 /ttj-sk[redacted] 호출 방식 유지 L54: const claudeTargetDir = path.join(homedir(), '.claude', 'skills', skillName); L55: const claudeTargetFile = path.join(claudeTargetDir, skillFile); L56: ensureDir(claudeTargetDir); L57: fs.copyFileSync(sourceFile, claudeTargetFile); L58: console.log(`✅ Claude Code 스킬 설치 완료: ${claudeTargetFile}`); Payload evidence from .claude/skills/ttj-sk[redacted]/SKILL.md: L69: L70: ### eval — 활성 탭에서 JS 실행 (결과는 JSON으로 stdout 출력) L71: ```bash ... L79: ```bash L80: ttj-sk[redacted] goto https://www.naver.com L81: ttj-sk[redacted] goto naver.com # https:// 자동 보완

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-skill.jsView on unpkg · L14

dist/browser.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/browser.jsView on unpkg

dist/cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Findings

1 Critical6 High3 Medium5 Low

CriticalAi Agent Control Hijackscripts/install-skill.js

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitydist/utils.js

HighKnown Malware Source Similaritydist/utils.js

HighKnown Malware Source Similaritydist/browser.js

HighKnown Malware Source Similaritydist/cli.js

HighPrevious Version Dangerous Deltadist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

package.jsonView file

Lines 1-39json

2 "name": "ttj-skills-browser",

3 "version": "1.2.18",

4 "description": "ttj-skills-browser - Dedicated CDP browser with one-shot commands (eval/goto/screenshot) and page reference visualization",

5 "type": "module",

6 "bin": {

7 "ttj-skills-browser": "dist/cli.js"

8 },

9 "main": "./dist/cli.js",

10 "files": [

11 "dist",

12 ".claude/skills",

13 "scripts"

14 ],

15 "scripts": {

16 "build": "tsc",

17 "start": "node dist/cli.js",

18 "prepare": "npm run build",

19 "postinstall": "node scripts/install-skill.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

20 },

21 "dependencies": {

22 "chalk": "^5.3.0",

23 "playwright-core": "^1.61.1"

24 },

25 "devDependencies": {

26 "typescript": "^5.4.0",

27 "@types/node": "^20.11.0"

28 },

29 "keywords": [

30 "playwright",

31 "browser",

32 "automation",

33 "cli"

34 ],

35 "author": "TTJ",

36 "license": "MIT",

37 "repository": {

38 "type": "git",

39 "url": "git+https://github.com/ddoojoang/ttj-skills-browser.git"

dist/utils.jsView file

Lines 1-25javascript

1/**

2 * ttj-skills-browser - Utility functions (pure where possible)

3 */

4import os from 'os';

5import path from 'path';

6import net from 'net';

7import https from 'https';

8import { exec } from 'child_process';

9import { promisify } from 'util';

10import { readFile, access } from 'fs/promises';

11import { fileURLToPath } from 'url';

12const execAsync = promisify(exec);

13const PACKAGE_NAME = 'ttj-skills-browser';

14const NPM_REGISTRY = 'https://registry.npmjs.org';

15/**

16 * Detect the current operating system in a platform-agnostic way.

17 */

18export const getOsType = () => process.platform === 'win32'

19 ? 'windows'

20 : process.platform === 'darwin'

21 ? 'macos'

22 : 'linux';

23/**

24 * Return the current user's home directory (never hardcode a username).

25 */

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/utils.jsView on unpkg · L5

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils.jsView on unpkg

scripts/install-skill.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * Claude Code / Codex 스킬 자동 설치

4 * npm install 후 Claude Code와 Codex의 사용자 전역 스킬 위치에 복사합니다.

5 */

7import fs from 'fs';

8import path from 'path';

9import { fileURLToPath } from 'url';

10import { homedir } from 'os';

12const __dirname = path.dirname(fileURLToPath(import.meta.url));

14const skillName = 'ttj-skills-browser';

15const skillSourceDir = path.join(__dirname, '..', '.claude', 'skills', skillName);

16const skillFile = 'SKILL.md';

18function ensureDir(dir) {

19 if (!fs.existsSync(dir)) {

20 fs.mkdirSync(dir, { recursive: true });

21 }

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-skill.jsView on unpkg · L14

22}

24// Codex frontmatter must stay in sync with the source description. We reuse

25// the source's own `description:` line so it never drifts (e.g. stale

26// "Playwright CLI" wording). Codex-specific fields (auto-invoke-keywords,

27// allowed-tools) are dropped — only name + description are kept.

28function extractDescription(content) {

29 const match = content.match(/^description:\s*(.+)$/m);

30 return match ? match[1].trim() : `${skillName} - dedicated CDP browser CLI`;

31}

33function toCodexSkill(content) {

34 const description = extractDescription(content);

dist/browser.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/browser.jsView on unpkg

dist/cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg