registry / wimotek-chromium-sync / 1.0.11
wimotek-chromium-sync@1.0.11
Universal Chromium Session & Cookie Synchronizer with SSH Tunnel
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe reviewed code uses cookies and browser storage to synchronize caller-configured Chromium nodes, with SSH credentials used to establish configured tunnels. No automatic collection or transfer to an unrelated host was identified.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A user invokes the CLI or calls synchronizer methods; package import alone only loads definitions.
Impact
Intended synchronization of browser session data between the user's configured nodes.
Mechanism
Connects to configured Chromium nodes, reads cookies and browser storage, and copies selected state between nodes.
AI rationale
The reviewed code uses cookies and browser storage to synchronize caller-configured Chromium nodes, with SSH credentials used to establish configured tunnels. No automatic collection or transfer to an unrelated host was identified.
Evidence
Temporary SSH key and askpass files created at runtime
Network endpoints2
{host}:{port} (caller-specified CDP endpoint; defaults to 127.0.0.1:9222)Configured SSH host
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a Chromium session and cookie synchronizer and defines a Python entry point and CLI.
- The JavaScript CLI wrapper launches the package's Python CLI with the user's arguments.
- Importing the Python package exposes synchronizer functions and classes; it does not invoke them.
- Cookie access connects to a caller-specified CDP host and port, defaulting to 127.0.0.1:9222.
- SSH key data is written to a temporary file for the configured SSH tunnel.
Evidence against
- The synchronizer handles sensitive cookies and browser storage, but the inspected code transfers them between configured Chromium nodes as part of its stated purpose.
- The code can create SSH tunnels, but targets and credentials come from caller-supplied node configuration.
Behavioral surface
ChildProcess
Source & flagged code
9 flaggedchromium_sync/__init__.pyView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
chromium_sync/__init__.pyView on unpkg•path = chromium_sync/__init__.py
kind = build_helper
sizeBytes = 342
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
chromium_sync/__init__.pyView on unpkg1"""
wimotek-chromium-sync Package
Universal Chromium Session & Cookie Synchronizer with SSH Tunnel and Cluster Support
"""
from .core import ChromiumSync, NodeConfig, merge_cookies, filter_cookies, co
Low
Ai Review Evidence
Importing the Python package exposes synchronizer functions and classes; it does not invoke them.
chromium_sync/__init__.pyView on unpkg · L1Findings
3 High1 Medium5 Low
HighSemantic Analysis Limitedchromium_sync/__init__.py
HighKnown Malware Source Similaritybin/cli.js
HighKnown Malware Source Fingerprint Signaturebin/cli.js
MediumShips Build Helperchromium_sync/__init__.py
LowAi Review Evidencepackage.json
LowAi Review Evidencebin/cli.js
LowAi Review Evidencechromium_sync/__init__.py
LowAi Review Evidencechromium_sync/core.py
LowAi Review Evidencechromium_sync/core.py
Affected versions and remediation
This report applies to wimotek-chromium-sync@1.0.11.
See all versions of wimotek-chromium-sync for other recorded verdicts.
- Review the evidence and your use of wimotek-chromium-sync@1.0.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.