jb-chrome-mcp

The fragment appears to be a setup wrapper for a local Chrome DevTools MCP integration and contains no evident malicious payload. The primary supply-chain risk is automatic execution of a remotely resolved npm package via npx -y, combined with access to the user's Chrome profile. Pin and integrity-check the package version, verify mcporter and npx provenance, and use a dedicated Chrome profile when possible.