@adithyasak/t3@0.0.39-adi.1
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe source enables runtime telemetry by default, including a persistent hashed identifier derived from local Codex or Claude account IDs. I found no clear user-facing disclosure in the inspected package files, so this merits a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source closely matched a different package identity
Trigger
When the T3 server starts or users perform tracked actions; telemetry is enabled unless disabled through configuration.
Impact
Usage and platform data are reported to an analytics service without a clear user-facing disclosure in the inspected package files.
Mechanism
The CLI derives an identifier from a Codex account ID, Claude user ID, or a generated anonymous ID, then posts event batches to PostHog.
AI rationale
The source enables runtime telemetry by default, including a persistent hashed identifier derived from local Codex or Claude account IDs. I found no clear user-facing disclosure in the inspected package files, so this merits a warning rather than a block.
Evidence
dist/bin.mjs~/.codex/auth.json~/.claude.json~/.t3/telemetry/anonymous-id
Network endpoints1
us.i.posthog.com/batch/
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes a CLI and declares no lifecycle scripts in its manifest.
- Runtime PostHog telemetry is enabled by default and can be disabled with T3CODE_TELEMETRY_ENABLED.
- Telemetry sends an identifier and usage events with platform, architecture, version, and client type to PostHog.
- The identifier can be derived by hashing a Codex account ID or Claude user ID; startup telemetry reports thread and project counts.
Evidence against
- The inspected manifest has no install, preinstall, or postinstall hook.
- The inspected telemetry payload contains usage and platform fields; I found no credential forwarding to an unrelated host.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
10 flaggeddist/service-launcher.mjsView file
2L3: import * as NodeChildProcess from "node:child_process";
L4: import * as NodeCrypto from "node:crypto";
High
Child Process
Package source references child process execution.
dist/service-launcher.mjsView on unpkg · L2dist/client/assets/typescript-S0auFSj_.jsView file
1import{a as e}from"./Icon-Bs5kt4yk.js";var t=e({default:()=>n}),n=[Object.freeze(JSON.parse('{"displayName":"TypeScript","name":"typescript","patterns":[{"include":"#directives"},{...
L2: //# sourceMappingURL=typescript-S0auFSj_.js.map
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/client/assets/typescript-S0auFSj_.jsView on unpkg · L1dist/client/assets/ComposerPromptEditor-CCVBTG28.jsView file
Findings
1 Critical6 High8 Medium4 Low
CriticalTrojan Source Unicodedist/client/assets/ComposerPromptEditor-CCVBTG28.js
HighChild Processdist/service-launcher.mjs
HighShell
HighCross File Remote Execution Contextdist/NodeServices-C2qGgLRw.mjs
HighKnown Malware Source Similaritydist/NodePtyAdapter-DIz0KE9m.mjs
HighKnown Malware Source Similaritydist/BunPtyAdapter-BK-hDQyj.mjs
HighPackage Source Clone Identity Mismatchdist/client/assets/blade-OEdTArYC.js
MediumDynamic Requiredist/client/assets/typescript-S0auFSj_.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Wasm Moduledist/client/assets/ghostty-vt-DdA0Zryv.wasm
Affected versions and remediation
This report applies to @adithyasak/t3@0.0.39-adi.1.
See all versions of @adithyasak/t3 for other recorded verdicts.
- Review the evidence and your use of @adithyasak/t3@0.0.39-adi.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.