registry / unbrowse / 11.7.0

unbrowse@11.7.0

Route/action layer for AI agents: one call (unbrowse "task" --url) reuses first-party site routes instead of browser loops. In-process CLI + Agent Skill + SDK. Bee aliases: @unbrowse/pollen-cli.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

No confirmed attack surface was identified. The install hook performs package-local setup, and telemetry execution requires an explicit environment setting.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Package installation triggers the postinstall hook; the update helper requires direct execution.

Impact

No unconsented credential collection, foreign control-surface mutation, payload download, or destructive action was identified.

Mechanism

The launcher imports its packaged runtime, while the helper invokes a local runtime in hint-only mode.

AI rationale

The inspected lifecycle and launcher paths show package-local runtime setup and an explicitly gated telemetry path, not a concrete malicious action. No self-dependency or active exfiltration chain was found in the inspected entry points.

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json registers only the inspected postinstall entry point.
The launcher imports the packaged runtime after setting its argument vector.
Runtime path helpers create only package-specific log and run directories.
The update helper starts the local runtime with an upgrade hint-only argument.

unbrowse@11.7.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code