@adithyasak/t3@0.0.34-adi.1
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package implements default-enabled transmission of a stable identifier derived from foreign AI authentication files. Hashing does not remove the tracking capability, and the behavior is activated during normal use. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source closely matched a different package identity
Trigger
A user runs the t3 CLI or its server runtime.
Impact
Enables unconsented cross-tool user tracking and external disclosure of derived account data.
Mechanism
Hashes an identifier from Codex or Claude configuration and transmits it as telemetry.
AI rationale
The package implements default-enabled transmission of a stable identifier derived from foreign AI authentication files. Hashing does not remove the tracking capability, and the behavior is activated during normal use. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.
Evidence
package.jsondist/bin.mjs.codex/auth.json.claude.json~/.t3/telemetry/anonymous-id
Network endpoints1
us.i.posthog.com/batch/
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Malware with medium false-positive risk.
Evidence for warning
- The CLI reads the Codex account identifier from the user's authentication file.
- It falls back to the Claude user identifier and hashes the selected value.
- Telemetry is enabled by default and posts the resulting stable identifier to PostHog.
Evidence against
- The manifest has no install lifecycle script.
- No confirmed archive upload, encrypted payload execution, or token-value exfiltration was found in the inspected code.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings
NoLicense
Source & flagged code
22 flaggeddist/bin.mjsView file
3import { _ as __commonJSMin, a as isQuitError, b as __toESM, c as layer$97, d as pipeThroughDuplex, f as toArrayBuffer, g as ChildProcessSpawner, h as make$142, i as Terminal$1, l ...
L4: import { $ as decode$5, $a as spaced, $i as runForkWith, $l as Reference, $n as nowUnsafe, $o as failCause$3, $r as flatMap$1, $s as ConsoleRef, $t as toRepresentations, $u as Clas...
L5: import { $ as runFold$1, A as fromQueue, At as mapInput$1, B as merge$4, Bt as make$155, C as flatMap$3, D as fromEffect, Et as forEach$1, F as make$156, G as orDie$1, Ht as bounde...
...
L9: import { createRequire } from "node:module";
L10: import * as NodeChildProcess from "node:child_process";
L11: import { Duplex, Readable } from "node:stream";
...
L20: import { cwd } from "process";
L21: import * as NodeNet from
Critical
Sensitive Archive Exfiltration
Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.
dist/bin.mjsView on unpkg · L33import { _ as __commonJSMin, a as isQuitError, b as __toESM, c as layer$97, d as pipeThroughDuplex, f as toArrayBuffer, g as ChildProcessSpawner, h as make$142, i as Terminal$1, l ...
L4: import { $ as decode$5, $a as spaced, $i as runForkWith, $l as Reference, $n as nowUnsafe, $o as failCause$3, $r as flatMap$1, $s as ConsoleRef, $t as toRepresentations, $u as Clas...
L5: import { $ as runFold$1, A as fromQueue, At as mapInput$1, B as merge$4, Bt as make$155, C as flatMap$3, D as fromEffect, Et as forEach$1, F as make$156, G as orDie$1, Ht as bounde...
...
L9: import { createRequire } from "node:module";
L10: import * as NodeChildProcess from "node:child_process";
L11: import { Duplex, Readable } from "node:stream";
...
L20: import { cwd } from "process";
L21: import * as NodeNet from
Findings
4 Critical14 High8 Medium4 Low
CriticalSensitive Archive Exfiltrationdist/bin.mjs
CriticalCredential Exfiltrationdist/bin.mjs
CriticalEncrypted Payload Temp Executiondist/bin.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/bin.mjs
HighChild Processdist/bin.mjs
HighShelldist/bin.mjs
HighCredential Redirect Persistencedist/bin.mjs
HighEntrypoint Foreign Package Code Overwritedist/bin.mjs
HighCommand Output Exfiltrationdist/bin.mjs
HighSandbox Evasion Gated Capabilitydist/bin.mjs
HighRemote Agent Bridgedist/bin.mjs
HighCross File Remote Execution Context
Affected versions and remediation
This report applies to @adithyasak/t3@0.0.34-adi.1.
See all versions of @adithyasak/t3 for other recorded verdicts.
- Review the evidence and your use of @adithyasak/t3@0.0.34-adi.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.