@agentic-dev.ai/emo@0.1.10
EMO by Agentic-dev: your own team of AI agents, on your computer, on your Claude subscription.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package reports runtime activity to its own hub by default for signed-in users, and the telemetry is linked to their email. The payload is restricted to activity metadata, so this is suspicious telemetry rather than data exfiltration.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Periodic server activity reporting after the user signs into the hub and has an active license.
Impact
The hub operator can associate usage patterns, agent names, action types, and token counts with the signed-in user; message content and tool arguments are excluded.
Mechanism
The reporter uses the account email in Firestore paths and sends heartbeat and summarized agent activity records using the user’s hub token.
AI rationale
The package reports runtime activity to its own hub by default for signed-in users, and the telemetry is linked to their email. The payload is restricted to activity metadata, so this is suspicious telemetry rather than data exfiltration.
Evidence
server.mjslib/hub-activity.mjslib/license.mjsstate/hub-activity.json
Network endpoints1
firestore.googleapis.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The activity reporter runs periodically by default for a licensed user signed into the hub.
- It uses the signed-in user’s email in activity state and Firestore document paths.
- Reported action metadata includes agent names, action types, timestamps, status, duration, token counts, and tool-category counts; it excludes message content and tool arguments.
- The activity records are sent to the product’s Firestore hub.
Evidence against
- The manifest has no install, preinstall, or postinstall hook.
- The reporter is limited to activity metadata rather than prompts, answers, tool arguments, or file names.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
14 flaggedhub.jsonView file
4patternName = google_api_key
severity = high
line = 4
High
4patternName = google_api_key
severity = high
line = 4
High
bin/emo.mjsView file
8import path from 'node:path';
L9: import { spawn, spawnSync } from 'node:child_process';
L10: import { fileURLToPath } from 'node:url';
High
139const [cmd = 'start', arg] = process.argv.slice(2);
L140: // Windows PowerShell 5.1 opens the console on an old code page and the Hebrew comes out garbled: switch it to UTF-8
L141: if (WIN && process.stdout.isTTY) { try { spawnSync('chcp', ['65001'], { shell: true, stdio: 'ignore' }); } catch {} }
Findings
4 Critical7 High5 Medium6 Low
CriticalSame File Env Network Executionserver.mjs
CriticalHardcoded Runtime Data Exfiltrationmcp/sumit.mjs
CriticalCredential Exfiltrationserver.mjs
CriticalPrevious Version Dangerous Deltaserver.mjs
HighHigh Secrethub.json
HighChild Processbin/emo.mjs
HighShellbin/emo.mjs
HighTrigger Reachable Persistencebin/emo.mjs
HighShips High Entropy Blobpublic/models/hey_jarvis_v0.1.onnx
HighSemantic Analysis Limitedmcp/gmail.mjs#virtual:normalized:round1
HighSecret Patternhub.json
MediumNetwork
Medium
Affected versions and remediation
This report applies to @agentic-dev.ai/emo@0.1.10.
See all versions of @agentic-dev.ai/emo for other recorded verdicts.
- Review the evidence and your use of @agentic-dev.ai/emo@0.1.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.