registry / wimotek-chromium-sync / 1.0.9
wimotek-chromium-sync@1.0.9
Universal Chromium Session & Cookie Synchronizer with SSH Tunnel
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe launcher delegates to the Python CLI, which defaults to local Chromium and synchronizes configured nodes when explicitly run. Review found no lifecycle hooks or unrelated credential collection.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
The CLI runs when explicitly invoked; library helpers act when called by the importing application.
Impact
Cookie access and transfer are sensitive but serve the package's stated synchronization function; no unrelated collection or automatic install-time activity was found.
Mechanism
The CLI defaults to local CDP and uses explicitly configured nodes and credentials for remote SSH tunnels.
AI rationale
The launcher delegates to the Python CLI, which defaults to local Chromium and synchronizes configured nodes when explicitly run. Review found no lifecycle hooks or unrelated credential collection.
Evidence
Temporary SSH key and askpass files when caller-supplied SSH credentials are used
Network endpoints1
127.0.0.1
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest defines no lifecycle scripts; its Python entry point and CLI describe a Chromium session and cookie synchronizer.
- The npm launcher only forwards its arguments to the Python CLI.
- With no node configuration, the CLI defaults to a local Chromium endpoint at 127.0.0.1:9222.
- The CLI performs synchronization only when its main function runs and calls syncer.run(); the cookie helper connects to the caller-specified CDP host and port.
Evidence against
- Remote SSH tunnels can use caller-provided SSH credentials, and the package writes supplied key or password data to temporary files for that connection.
- The package reads and transfers Chromium cookies, a sensitive capability that matches its stated synchronization purpose and is invoked by the user.
Behavioral surface
ChildProcess
Source & flagged code
9 flaggedchromium_sync/__init__.pyView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
chromium_sync/__init__.pyView on unpkg•path = chromium_sync/__init__.py
kind = build_helper
sizeBytes = 262
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
chromium_sync/__init__.pyView on unpkgbin/cli.jsView file
•matchType = normalized_sha256
matchedPackage = wimotek-chromium-sync@1.0.7
matchedPath = bin/cli.js
matchedIdentity = npm:d2ltb3Rlay1jaHJvbWl1bS1zeW5j:1.0.7
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Findings
3 High1 Medium5 Low
HighSemantic Analysis Limitedchromium_sync/__init__.py
HighKnown Malware Source Similaritybin/cli.js
HighKnown Malware Source Fingerprint Signaturebin/cli.js
MediumShips Build Helperchromium_sync/__init__.py
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencebin/cli.js
LowAi Review Evidencechromium_sync/cli.py
LowAi Review Evidencechromium_sync/core.py
LowAi Review Evidencechromium_sync/cli.py
Affected versions and remediation
This report applies to wimotek-chromium-sync@1.0.9.
See all versions of wimotek-chromium-sync for other recorded verdicts.
- Review the evidence and your use of wimotek-chromium-sync@1.0.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.