Loading npm security reports…

unbrowse@11.4.1: Malicious npm security report (Block) | LPM Firewall

registry / unbrowse / 11.4.1

unbrowse@11.4.1

Route/action layer for AI agents: one call (unbrowse "task" --url) reuses first-party site routes instead of browser loops. In-process CLI + Agent Skill + SDK. Bee aliases: @unbrowse/pollen-cli.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

At runtime, the package looks for a separate AI-agent substrate and accesses its private root key. For a hard-coded target key, it creates an attestation signature and transmits it with a backend request.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A runtime contract declaration on a machine containing the targeted aiko root key.

Impact

The backend receives a signature made with another agent's private identity, enabling targeted identity abuse.

Mechanism

Hidden targeted private-key signing and remote attestation.

Attack narrative

The package conceals an aiko integration behind the unbrowse name. It detects agent-related paths, reads aiko's root key, and only for a pinned public key derives a signing key and signs contract-declaration bytes. Those attestation headers are sent to the package backend. This is targeted use of a foreign private identity, not ordinary package setup.

AI rationale

The hidden cross-agent identity logic accesses a foreign private key and uses it to authenticate outbound requests for a pinned target. Opt-in telemetry does not mitigate this concrete runtime credential abuse.

Evidence

dist-sdk/runtime/aiko-identity.jsdist-sdk/values/contract-attest.jsdist-sdk/lib/contract-thin-client.js~/.aiko/keys/root.key

Network endpoints1

beta-api.unbrowse.ai/v1/contract/declare

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist-sdk/values/memzero.jsView file

24// eslint-disable-next-line @typescript-eslint/no-require-imports L25: const sodium = require("sodium-native"); L26: if (sodium &&

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-sdk/values/memzero.jsView on unpkg · L24

runtime/keytar-f6bnxfss.nodeView file

•path = runtime/keytar-f6bnxfss.node kind = native_binary sizeBytes = 99528 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

runtime/keytar-f6bnxfss.nodeView on unpkg

runtime/unbrowse_core-xa5rf2hy.wasmView file

•path = runtime/unbrowse_core-xa5rf2hy.wasm kind = wasm_module sizeBytes = 127674 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

runtime/unbrowse_core-xa5rf2hy.wasmView on unpkg

runtime/curl-impersonate-fetch.pyView file

•path = runtime/curl-impersonate-fetch.py kind = build_helper sizeBytes = 3888 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/curl-impersonate-fetch.pyView on unpkg

runtime/mcp.jsView file

•path = runtime/mcp.js kind = oversized_source_file sizeBytes = 13654777 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

runtime/mcp.jsView on unpkg

•path = runtime/mcp.js kind = oversized_cli_entrypoint sizeBytes = 13654777 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

runtime/mcp.jsView on unpkg

bin/unbrowse.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/unbrowse.js#virtual:normalized:round1View on unpkg

dist-sdk/runtime/paths.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = unbrowse@11.1.5 matchedIdentity = npm:dW5icm93c2U:11.1.5 similarity = 0.700 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-sdk/runtime/paths.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 41-81json

41 "import": "./dist-sdk/wallet-standard.js"

42 }

43 },

44 "files": [

45 "runtime",

46 "bin",

47 "dist-sdk",

48 "vendor/kuri",

49 "vendor/contract",

50 "vendor/utls-proxy",

51 "scripts/release-assets.mjs",

52 "scripts/postinstall.mjs",

53 "scripts/prune-foreign-binaries.mjs",

54 "scripts/postinstall-ping.mjs",

55 "scripts/verify-release-assets.mjs",

56 "README.md",

57 "SKILL.md",

58 "LICENSE"

59 ],

60 "scripts": {

61 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L61

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L61

62 "build:sdk": "tsc -p tsconfig.sdk.json",

63 "check:sdk-entry": "node scripts/assert-sdk-entry.mjs",

64 "prepack": "bun ../../scripts/build-release-manifest.ts && npm run build:runtime && npm run build:sdk && npm run check:sdk-entry && node scripts/prepare-pack.mjs && node scripts/assert-kuri-vendor.mjs && node scripts/assert-utls-vendor.mjs",

65 "prepublishOnly": "node scripts/assert-release-flow.mjs && node scripts/verify-release-assets.mjs",

66 "start": "bun src/index.ts",

67 "dev": "bun --watch src/index.ts",

68 "build:runtime": "bash ../../scripts/build-runtime-scrubbed.sh packages/skill/runtime"

69 },

70 "dependencies": {

71 "@fastify/cors": "^11.2.0",

72 "bs58": "^6.0.0",

73 "cheerio": "^1.2.0",

74 "cloakbrowser": "0.5.10",

75 "dotenv": "^17.3.1",

76 "fastify": "^5.7.4",

77 "nanoid": "^5.1.6",

78 "ws": "^8.19.0"

79 },

80 "optionalDependencies": {

81 "keytar": "^7.9.0"

dist-sdk/values/memzero.jsView file

Lines 4-44javascript

4 * Preferred: libsodium memzero, which compiles to a volatile-write asm

5 * sequence the optimizer cannot elide.

6 *

7 * Fallback: `Uint8Array.fill(0)`. Best-effort under V8 — the VM

runtime/keytar-f6bnxfss.nodeView file

•path = runtime/keytar-f6bnxfss.node kind = native_binary sizeBytes = 99528 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

runtime/keytar-f6bnxfss.nodeView on unpkg

runtime/unbrowse_core-xa5rf2hy.wasmView file

•path = runtime/unbrowse_core-xa5rf2hy.wasm kind = wasm_module sizeBytes = 127674 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

runtime/unbrowse_core-xa5rf2hy.wasmView on unpkg

runtime/curl-impersonate-fetch.pyView file

•path = runtime/curl-impersonate-fetch.py kind = build_helper sizeBytes = 3888 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/curl-impersonate-fetch.pyView on unpkg

runtime/mcp.jsView file

•path = runtime/mcp.js kind = oversized_source_file sizeBytes = 13654777 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

runtime/mcp.jsView on unpkg

•path = runtime/mcp.js kind = oversized_cli_entrypoint sizeBytes = 13654777 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

runtime/mcp.jsView on unpkg

bin/unbrowse.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/unbrowse.js#virtual:normalized:round1View on unpkg

dist-sdk/runtime/paths.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = unbrowse@11.1.5 matchedIdentity = npm:dW5icm93c2U:11.1.5 similarity = 0.700 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-sdk/runtime/paths.jsView on unpkg